primitive-admin 1.1.0-alpha.3 → 1.1.0-alpha.31

package/dist/src/commands/sync.js

@@ -1,9 +1,15 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, unlinkSync, rmdirSync, statSync } from "fs";
 import { join, basename } from "path";
+import { createHash } from "crypto";
 import * as TOML from "@iarna/toml";
 import { lookup as mimeLookup } from "mime-types";
-import { ApiClient, ConflictError } from "../lib/api-client.js";
+import { ApiClient, ApiError, ConflictError, SchemaRequiredError, OperationRefError, SchemaBreaksOpsError, SchemaHasUncheckableOpsError, TomlParseError, OpsExistError, } from "../lib/api-client.js";
+import { buildDatabaseTypeTomlData, detectExistingOperationForms, normalizeOperationFromToml, } from "../lib/toml-database-config.js";
+import { validateOperations, formatIssue, } from "../lib/toml-params-validator.js";
 import { getServerUrl, resolveAppId } from "../lib/config.js";
+import { resolveSyncDir, isAutoResolvedSyncDir, checkLegacySyncMigration, } from "../lib/sync-paths.js";
+import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
+import { expandWorkflowTomlData } from "../lib/workflow-fragments.js";
 import { success, error, info, warn, keyValue, json, divider, } from "../lib/output.js";
 import chalk from "chalk";
 function ensureDir(dirPath) {
@@ -27,6 +33,89 @@ function saveSyncState(configDir, state) {
     const syncFile = join(configDir, ".primitive-sync.json");
     writeFileSync(syncFile, JSON.stringify(state, null, 2));
 }
+/**
+ * Wrap a server-side error so the printed message identifies which entity
+ * was in flight. Used by every entity create/update/delete call site in the
+ * push loops (issue #684).
+ *
+ * Format: `Failed to ${action} ${kind} ${key}: ${serverMessage}`
+ *
+ * - `ConflictError` is rethrown unchanged so the existing
+ *   `ConflictError → conflicts[]` accumulator in each loop still fires.
+ * - Other errors are rewrapped as a new `ApiError` carrying the wrapped
+ *   message + the original `details[]` and `statusCode`.
+ */
+export function wrapEntityError(err, action, kind, key) {
+    if (err instanceof ConflictError) {
+        return err;
+    }
+    const original = err instanceof Error ? err.message : String(err?.message ?? err);
+    const wrappedMessage = `Failed to ${action} ${kind} ${key}: ${original}`;
+    if (err instanceof ApiError) {
+        return new ApiError(wrappedMessage, err.statusCode, err.code, err.details);
+    }
+    // Non-ApiError (e.g. network failure, JSON parse error) — preserve cause.
+    const wrapped = new Error(wrappedMessage);
+    return wrapped;
+}
+export function computeFileHash(filePath) {
+    const content = readFileSync(filePath);
+    return createHash("sha256").update(content).digest("hex");
+}
+export function shouldPushFile(filePath, storedHash) {
+    if (!storedHash)
+        return true;
+    return computeFileHash(filePath) !== storedHash;
+}
+/**
+ * Canonical-JSON serializer for hash computation.
+ *
+ * Sorts object keys at every level so two semantically-equivalent JSON
+ * blobs produce the same string. Arrays preserve order (step order
+ * matters in workflows). Used by `computeExpandedContentHash`.
+ */
+function canonicalJsonStringify(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return "[" + value.map((v) => canonicalJsonStringify(v)).join(",") + "]";
+    }
+    const keys = Object.keys(value).sort();
+    return ("{" +
+        keys
+            .map((k) => JSON.stringify(k) + ":" + canonicalJsonStringify(value[k]))
+            .join(",") +
+        "}");
+}
+/**
+ * Hash the *expanded* (post-fragment-splice) content of a workflow TOML.
+ *
+ * The raw-file hash (`computeFileHash`) misses fragment-only edits: if a
+ * workflow uses `include = ["x"]` and only `workflow-fragments/x.toml`
+ * changes, the workflow file is byte-identical and shouldPushFile would
+ * skip the push, leaving the server with stale expanded steps.
+ *
+ * This helper hashes the parsed-and-expanded data instead, so fragment
+ * edits change the hash and force a re-push. Pass the already-parsed
+ * `tomlData` (from `parseTomlFile`) — that function runs the expander,
+ * so `tomlData` is the canonical expanded shape the server will see.
+ */
+export function computeExpandedContentHash(parsed) {
+    const canonical = canonicalJsonStringify(parsed);
+    return createHash("sha256").update(canonical).digest("hex");
+}
+/**
+ * Variant of `shouldPushFile` for workflow files: compares the stored hash
+ * against the hash of the *expanded* content rather than the raw file
+ * bytes. Required so that edits to included fragments invalidate the
+ * push-skip cache for any workflow that references them.
+ */
+export function shouldPushExpandedFile(parsed, storedHash) {
+    if (!storedHash)
+        return true;
+    return computeExpandedContentHash(parsed) !== storedHash;
+}
 // TOML serialization helpers
 function serializeAppSettings(settings) {
     const data = {
@@ -69,6 +158,107 @@ function serializeIntegration(integration) {
     };
     return TOML.stringify(data);
 }
+function serializeWebhook(webhook) {
+    const data = {
+        webhook: {
+            key: webhook.webhookKey,
+            displayName: webhook.displayName,
+            description: webhook.description || undefined,
+            status: webhook.status,
+            workflowKey: webhook.workflowKey,
+            verificationScheme: webhook.verificationScheme,
+            toleranceSeconds: webhook.toleranceSeconds,
+            deduplicationEnabled: webhook.deduplicationEnabled,
+            deduplicationWindowMs: webhook.deduplicationWindowMs,
+            secretGracePeriodMs: webhook.secretGracePeriodMs,
+        },
+    };
+    // Parse JSON fields if they're strings
+    if (webhook.allowedIpCidrs) {
+        try {
+            data.allowedIps = { cidrs: JSON.parse(webhook.allowedIpCidrs) };
+        }
+        catch {
+            data.allowedIps = { cidrs: webhook.allowedIpCidrs };
+        }
+    }
+    if (webhook.inputMapping) {
+        try {
+            data.inputMapping = JSON.parse(webhook.inputMapping);
+        }
+        catch {
+            data.inputMapping = { raw: webhook.inputMapping };
+        }
+    }
+    if (webhook.metadata) {
+        try {
+            data.metadata = JSON.parse(webhook.metadata);
+        }
+        catch { }
+    }
+    // Remove undefined values
+    Object.keys(data.webhook).forEach(k => {
+        if (data.webhook[k] === undefined)
+            delete data.webhook[k];
+    });
+    return TOML.stringify(data);
+}
+function serializeCronTrigger(trigger) {
+    const data = {
+        cronTrigger: {
+            key: trigger.triggerKey,
+            displayName: trigger.displayName,
+            description: trigger.description || undefined,
+            cron: trigger.cron,
+            timezone: trigger.timezone || "UTC",
+            workflowKey: trigger.workflowKey,
+            overlapPolicy: trigger.overlapPolicy || "skip",
+            state: trigger.state,
+        },
+    };
+    if (trigger.rootInput) {
+        try {
+            data.rootInput = JSON.parse(trigger.rootInput);
+        }
+        catch {
+            data.rootInput = { raw: trigger.rootInput };
+        }
+    }
+    if (trigger.inputMapping) {
+        try {
+            data.inputMapping = JSON.parse(trigger.inputMapping);
+        }
+        catch {
+            data.inputMapping = { raw: trigger.inputMapping };
+        }
+    }
+    // Remove undefined values
+    Object.keys(data.cronTrigger).forEach(k => {
+        if (data.cronTrigger[k] === undefined)
+            delete data.cronTrigger[k];
+    });
+    return TOML.stringify(data);
+}
+function serializeBlobBucket(bucket) {
+    const data = {
+        bucket: {
+            key: bucket.bucketKey,
+            name: bucket.name,
+            description: bucket.description || undefined,
+            ttlTier: bucket.ttlTier,
+            accessPolicy: bucket.accessPolicy,
+        },
+    };
+    if (bucket.ruleSetId) {
+        data.bucket.ruleSetId = bucket.ruleSetId;
+    }
+    // Remove undefined values
+    Object.keys(data.bucket).forEach(k => {
+        if (data.bucket[k] === undefined)
+            delete data.bucket[k];
+    });
+    return TOML.stringify(data);
+}
 function serializePrompt(prompt) {
     const data = {
         prompt: {
@@ -83,7 +273,7 @@ function serializePrompt(prompt) {
             description: config.description,
             provider: config.provider,
             model: config.model,
-            temperature: config.temperature?.toString(),
+            temperature: config.temperature != null ? Number(config.temperature) : undefined,
             maxTokens: config.maxTokens,
             outputFormat: config.outputFormat,
             systemPrompt: config.systemPrompt,
@@ -96,6 +286,7 @@ function serializeWorkflow(workflow, draft, configs) {
     // Find the active config or use the first one
     const activeConfigId = workflow.activeConfigId;
     const activeConfig = configs?.find((c) => c.configId === activeConfigId) || configs?.[0];
+    const activeConfigName = activeConfig?.configName || "";
     // Determine which steps to use (prefer config steps if non-empty, else draft steps)
     const configSteps = activeConfig?.steps;
     const draftSteps = draft?.steps;
@@ -106,7 +297,8 @@ function serializeWorkflow(workflow, draft, configs) {
             name: workflow.name,
             description: workflow.description,
             status: workflow.status,
-            activeConfigId: activeConfigId,
+            activeConfigName: activeConfigName,
+            accessRule: workflow.accessRule || undefined,
             perUserMaxRunning: workflow.perUserMaxRunning,
             perUserMaxQueued: workflow.perUserMaxQueued,
             dequeueOrder: workflow.dequeueOrder,
@@ -118,7 +310,6 @@ function serializeWorkflow(workflow, draft, configs) {
         steps,
         // Include all configurations
         configs: configs?.map((config) => ({
-            id: config.configId,
             name: config.configName,
             description: config.description,
             status: config.status,
@@ -127,10 +318,235 @@ function serializeWorkflow(workflow, draft, configs) {
     };
     return TOML.stringify(data);
 }
+// Database config serialization helpers
+//
+// Native-TOML form (issue #752): when emitting a database-type config, we
+// prefer nested `[operations.definition]` tables and `[[operations.params]]`
+// rows over JSON-strings stuffed into a single field. The form is sticky
+// per file — if the existing file uses the legacy JSON-string form, we
+// preserve it so we don't generate surprise diffs. New files default to
+// native. Un-TOMLable shapes (null, mixed-type arrays) fall back to JSON
+// string per field with a log message.
+//
+// Issue #666: when the type has a stored `schema` (raw TOML of `[models.*]`
+// blocks), `buildDatabaseTypeTomlData` parses + merges it into the same TOML
+// object so the result round-trips as `[models.<Name>.fields.<field>]`.
+function serializeDatabaseType(typeConfig, operations, ruleSetIdToName, options = {}) {
+    const data = buildDatabaseTypeTomlData(typeConfig, operations, ruleSetIdToName, options);
+    return TOML.stringify(data);
+}
+function serializeEmailTemplate(template) {
+    // The API returns { emailType, hasOverride, override: { subject, htmlBody, textBody }, default: { ... } }
+    // We only serialize overrides (custom templates), using the override fields.
+    const override = template.override || {};
+    const data = {
+        template: {
+            emailType: template.emailType,
+            subject: override.subject || "",
+        },
+    };
+    if (override.htmlBody) {
+        data.template.htmlBody = override.htmlBody;
+    }
+    if (override.textBody) {
+        data.template.textBody = override.textBody;
+    }
+    return TOML.stringify(data);
+}
+function serializeRuleSet(ruleSet) {
+    const data = {
+        ruleSet: {
+            name: ruleSet.name,
+            resourceType: ruleSet.resourceType,
+        },
+    };
+    if (ruleSet.description) {
+        data.ruleSet.description = ruleSet.description;
+    }
+    // Rules are structured as { category: { operation: "expression" } }
+    const rules = typeof ruleSet.rules === "string" ? JSON.parse(ruleSet.rules) : (ruleSet.rules || {});
+    if (Object.keys(rules).length > 0) {
+        data.rules = rules;
+    }
+    return TOML.stringify(data);
+}
+function serializeGroupTypeConfig(config, ruleSetIdToName) {
+    const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
+    const data = {
+        groupTypeConfig: {
+            groupType: config.groupType,
+            ruleSetName: ruleSetName,
+            autoAddCreator: config.autoAddCreator ?? true,
+        },
+    };
+    return TOML.stringify(data);
+}
+function serializeCollectionTypeConfig(config, ruleSetIdToName) {
+    const ruleSetName = config.ruleSetId ? (ruleSetIdToName.get(config.ruleSetId) || "") : "";
+    const data = {
+        collectionTypeConfig: {
+            collectionType: config.collectionType,
+            ruleSetName: ruleSetName,
+        },
+    };
+    return TOML.stringify(data);
+}
+export function parseDatabaseTypeToml(tomlData) {
+    const typeSection = tomlData.type || {};
+    const typeConfig = {
+        databaseType: typeSection.databaseType,
+    };
+    // Support both new key-based reference and legacy ID-based reference
+    if (typeSection.ruleSetName && typeSection.ruleSetName !== "") {
+        typeConfig._ruleSetName = typeSection.ruleSetName;
+    }
+    else if (typeSection.ruleSetId && typeSection.ruleSetId !== "") {
+        typeConfig.ruleSetId = typeSection.ruleSetId;
+    }
+    // Accept both `celContextAccess` (new user-facing key) and `metadataAccess`
+    // (legacy). The newer key wins when both appear.
+    if (typeSection.celContextAccess) {
+        typeConfig.metadataAccess = typeSection.celContextAccess;
+    }
+    else if (typeSection.metadataAccess) {
+        typeConfig.metadataAccess = typeSection.metadataAccess;
+    }
+    if (typeSection.defaultAccess !== undefined) {
+        typeConfig.defaultAccess = typeSection.defaultAccess;
+    }
+    // autoPopulatedFields (issue #750) — pass through unchanged. Both the
+    // shorthand (`ownerId = "user.userId"`) and the verbose object form
+    // (`updatedBy = { value = "user.userId", on = ["create","update"] }`) are
+    // accepted; the server validates and normalizes at write time.
+    if (typeSection.autoPopulatedFields !== undefined) {
+        typeConfig.autoPopulatedFields = typeSection.autoPopulatedFields;
+    }
+    if (tomlData.triggers) {
+        typeConfig.triggers = tomlData.triggers;
+    }
+    // Issue #666: extract the `[models.*]` subtree (if present) and re-serialize
+    // it to a TOML string for the server's `schema` field.
+    //
+    // We always set `schema` — either to the serialized TOML string or to
+    // `null` — so the sync push diff can detect "models removed from local
+    // file" and forward `schema: null` to the server. Without this, removing
+    // `[models.*]` blocks would silently no-op and the next pull would
+    // resurrect the stale server schema, making schema deletion via `sync push`
+    // impossible (codex review on PR #766, [P2]).
+    let schemaSerialized = null;
+    if (tomlData.models && typeof tomlData.models === "object") {
+        try {
+            schemaSerialized = TOML.stringify({ models: tomlData.models });
+        }
+        catch {
+            // Fall through — server-side parser will fail with a clear
+            // TOML_PARSE_ERROR if we somehow produced an invalid round-trip.
+        }
+    }
+    typeConfig.schema = schemaSerialized;
+    // `normalizeOperationFromToml` accepts both forms:
+    //   - legacy: `definition = '{...}'` (JSON string), `params = '{...}'`
+    //   - native: `[operations.definition]` table, `[[operations.params]]` rows
+    // and returns the JS shape the server expects.
+    const operations = (tomlData.operations || []).map((op) => normalizeOperationFromToml(op));
+    return { typeConfig, operations };
+}
+function parseRuleSetToml(tomlData) {
+    const ruleSetSection = tomlData.ruleSet || {};
+    return {
+        name: ruleSetSection.name,
+        resourceType: ruleSetSection.resourceType,
+        description: ruleSetSection.description || null,
+        rules: tomlData.rules || {},
+    };
+}
+export function parseGroupTypeConfigToml(tomlData) {
+    const section = tomlData.groupTypeConfig || {};
+    const result = {
+        groupType: section.groupType,
+        autoAddCreator: section.autoAddCreator ?? true,
+    };
+    // Support both new key-based reference and legacy ID-based reference
+    if (section.ruleSetName && section.ruleSetName !== "") {
+        result._ruleSetName = section.ruleSetName;
+    }
+    else if (section.ruleSetId && section.ruleSetId !== "") {
+        result.ruleSetId = section.ruleSetId;
+    }
+    return result;
+}
+export function parseCollectionTypeConfigToml(tomlData) {
+    const section = tomlData.collectionTypeConfig || {};
+    const result = {
+        collectionType: section.collectionType,
+    };
+    // Support both new key-based reference and legacy ID-based reference
+    if (section.ruleSetName && section.ruleSetName !== "") {
+        result._ruleSetName = section.ruleSetName;
+    }
+    else if (section.ruleSetId && section.ruleSetId !== "") {
+        result.ruleSetId = section.ruleSetId;
+    }
+    return result;
+}
 // Parsing helpers
+//
+// All 20+ TOML parse sites in this file route through `parseTomlFile()`.
+// Workflow fragment expansion is wired in here so every push path (workflows,
+// prompts, tests, etc.) gets it for free. For non-workflow TOMLs the
+// expander is a no-op: if the parsed result has no `include` key, it returns
+// the original object untouched.
 function parseTomlFile(filePath) {
     const content = readFileSync(filePath, "utf-8");
-    return TOML.parse(content);
+    const parsed = TOML.parse(content);
+    return expandWorkflowTomlData(parsed, filePath);
+}
+/**
+ * Paginate through a list endpoint, collecting all items.
+ */
+export async function fetchAll(listFn, pageSize = 100, maxPages = 100) {
+    const all = [];
+    let cursor;
+    let page = 0;
+    do {
+        if (++page > maxPages) {
+            throw new Error(`fetchAll: too many pages (>${maxPages}), aborting to prevent infinite loop`);
+        }
+        const result = await listFn({ limit: pageSize, cursor: cursor });
+        all.push(...result.items);
+        cursor = result.nextCursor || undefined;
+    } while (cursor);
+    return all;
+}
+/**
+ * Safely parse a JSON field that may be a string or already an object.
+ * TOML can parse inline tables as objects, so we need to handle both.
+ */
+export function safeJsonParse(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return JSON.parse(value);
+    return value; // Already an object (TOML parsed it as a table)
+}
+/**
+ * Resolve a key-based rule set name reference to an ID.
+ * Throws if the name cannot be resolved and throwOnMissing is true.
+ */
+export function resolveRuleSetReference(entityConfig, ruleSetNameToId, entityLabel, options = {}) {
+    if (!entityConfig._ruleSetName)
+        return;
+    const resolvedRuleSetId = ruleSetNameToId.get(entityConfig._ruleSetName);
+    if (resolvedRuleSetId) {
+        entityConfig.ruleSetId = resolvedRuleSetId;
+    }
+    else {
+        const msg = `Rule set "${entityConfig._ruleSetName}" not found for ${entityLabel}. The entity would be created without a rule set.`;
+        if (options.throwOnMissing !== false) {
+            throw new Error(msg);
+        }
+    }
+    delete entityConfig._ruleSetName;
 }
 // Test case helpers (exported for unit testing)
 export function slugifyTestCaseName(name) {
@@ -157,15 +573,22 @@ function getTestsDir(configDir, blockType, blockKey) {
     const typeDir = blockType === "prompt" ? "prompts" : "workflows";
     return join(configDir, typeDir, `${blockKey}.tests`);
 }
-export function serializeTestCase(testCase) {
+export function serializeTestCase(testCase, lookupMaps) {
+    // Resolve ID references to key-based references
+    const configName = testCase.configId && lookupMaps?.configIdToName
+        ? (lookupMaps.configIdToName.get(testCase.configId) || "") : "";
+    const evaluatorPromptKey = testCase.evaluatorPromptId && lookupMaps?.promptIdToKey
+        ? (lookupMaps.promptIdToKey.get(testCase.evaluatorPromptId) || "") : "";
+    const evaluatorConfigName = testCase.evaluatorConfigId && lookupMaps?.configIdToName
+        ? (lookupMaps.configIdToName.get(testCase.evaluatorConfigId) || "") : "";
     const data = {
         test: {
             name: testCase.name || "",
             description: testCase.description || "",
             inputVariables: testCase.inputVariables || "{}",
-            configId: testCase.configId || "",
-            evaluatorPromptId: testCase.evaluatorPromptId || "",
-            evaluatorConfigId: testCase.evaluatorConfigId || "",
+            configName: configName,
+            evaluatorPromptKey: evaluatorPromptKey,
+            evaluatorConfigName: evaluatorConfigName,
             expectedOutputPattern: testCase.expectedOutputPattern || "",
             expectedOutputContains: testCase.expectedOutputContains || "[]",
             expectedJsonSubset: testCase.expectedJsonSubset || "{}",
@@ -192,6 +615,18 @@ export function parseTestCaseToml(tomlData) {
     if (test.description && test.description !== "") {
         payload.description = test.description;
     }
+    // Support both new key-based references and legacy ID-based references
+    // Key-based references (portable across apps)
+    if (test.configName && test.configName !== "") {
+        payload._configName = test.configName;
+    }
+    if (test.evaluatorPromptKey && test.evaluatorPromptKey !== "") {
+        payload._evaluatorPromptKey = test.evaluatorPromptKey;
+    }
+    if (test.evaluatorConfigName && test.evaluatorConfigName !== "") {
+        payload._evaluatorConfigName = test.evaluatorConfigName;
+    }
+    // Legacy ID-based references (backward compat)
     if (test.configId && test.configId !== "") {
         payload.configId = test.configId;
     }
@@ -222,7 +657,7 @@ export function parseTestCaseToml(tomlData) {
     }
     return payload;
 }
-async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, testCaseEntities) {
+async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, testCaseEntities, lookupMaps) {
     let testCases;
     try {
         const result = await client.listTestCases(appId, blockType, blockId);
@@ -243,7 +678,7 @@ async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey
         pulledSlugs.add(slug);
         // Write test case TOML
         const tomlPath = join(testsDir, `${slug}.toml`);
-        writeFileSync(tomlPath, serializeTestCase(tc));
+        writeFileSync(tomlPath, serializeTestCase(tc, lookupMaps));
         // Handle attachments
         let attachmentFilenames = [];
         try {
@@ -279,6 +714,7 @@ async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey
             slug,
             modifiedAt: tc.modifiedAt || tc.createdAt || new Date().toISOString(),
             attachmentFilenames: attachmentFilenames.length > 0 ? attachmentFilenames : undefined,
+            contentHash: computeFileHash(tomlPath),
         };
     }
     // Clean up local files for remotely-deleted test cases
@@ -308,21 +744,75 @@ async function pullTestCasesForBlock(client, appId, blockType, blockId, blockKey
     }
     return testCases.length;
 }
-async function pushTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, syncState, dryRun, changes) {
+async function pushTestCasesForBlock(client, appId, blockType, blockId, blockKey, configDir, syncState, dryRun, changes, resolutionMaps, options) {
+    let skipped = 0;
     const testsDir = getTestsDir(configDir, blockType, blockKey);
     if (!existsSync(testsDir))
-        return;
+        return 0;
     const files = readdirSync(testsDir).filter((f) => f.endsWith(".toml"));
     if (files.length === 0)
-        return;
+        return 0;
     const TEN_MB = 10 * 1024 * 1024;
     for (const file of files) {
         const slug = basename(file, ".toml");
         const filePath = join(testsDir, file);
         const tomlData = parseTomlFile(filePath);
         const testPayload = parseTestCaseToml(tomlData);
+        // Resolve key-based references to IDs
+        if (resolutionMaps) {
+            // Resolve configName → configId
+            if (testPayload._configName && !testPayload.configId) {
+                const configMapKey = `${blockKey}#${testPayload._configName}`;
+                const configMap = blockType === "prompt"
+                    ? resolutionMaps.promptConfigNameToId
+                    : resolutionMaps.workflowConfigNameToId;
+                const resolvedId = configMap.get(configMapKey);
+                if (resolvedId) {
+                    testPayload.configId = resolvedId;
+                }
+            }
+            delete testPayload._configName;
+            // Resolve evaluatorPromptKey → evaluatorPromptId
+            if (testPayload._evaluatorPromptKey && !testPayload.evaluatorPromptId) {
+                const resolvedId = resolutionMaps.promptKeyToId.get(testPayload._evaluatorPromptKey);
+                if (resolvedId) {
+                    testPayload.evaluatorPromptId = resolvedId;
+                }
+            }
+            const evaluatorPromptKey = testPayload._evaluatorPromptKey;
+            delete testPayload._evaluatorPromptKey;
+            // Resolve evaluatorConfigName → evaluatorConfigId
+            if (testPayload._evaluatorConfigName && !testPayload.evaluatorConfigId && evaluatorPromptKey) {
+                const configMapKey = `${evaluatorPromptKey}#${testPayload._evaluatorConfigName}`;
+                const resolvedId = resolutionMaps.promptConfigNameToId.get(configMapKey);
+                if (resolvedId) {
+                    testPayload.evaluatorConfigId = resolvedId;
+                }
+            }
+            delete testPayload._evaluatorConfigName;
+        }
         const stateKey = `${blockType}/${blockKey}/${slug}`;
         const existingEntry = syncState?.entities?.testCases?.[stateKey];
+        // Skip if file hasn't changed since last sync (also check for attachment changes)
+        if (!options?.force && existingEntry?.id && !shouldPushFile(filePath, existingEntry.contentHash)) {
+            const attachDir = join(testsDir, slug);
+            const localAttachFiles = existsSync(attachDir)
+                ? readdirSync(attachDir).filter((f) => { try {
+                    return statSync(join(attachDir, f)).isFile();
+                }
+                catch {
+                    return false;
+                } })
+                : [];
+            const prevAttachFiles = existingEntry.attachmentFilenames || [];
+            const attachmentsChanged = localAttachFiles.length !== prevAttachFiles.length ||
+                localAttachFiles.some((f) => !prevAttachFiles.includes(f)) ||
+                prevAttachFiles.some((f) => !localAttachFiles.includes(f));
+            if (!attachmentsChanged) {
+                skipped++;
+                continue;
+            }
+        }
         if (existingEntry?.id) {
             // Update existing test case
             changes.push({ type: "test-case", action: "update", key: `${blockKey}/${slug}` });
@@ -330,6 +820,9 @@ async function pushTestCasesForBlock(client, appId, blockType, blockId, blockKey
                 try {
                     await client.updateTestCase(appId, blockType, blockId, existingEntry.id, testPayload);
                     info(`  Updated test case: ${blockKey}/${slug}`);
+                    if (syncState?.entities?.testCases?.[stateKey]) {
+                        syncState.entities.testCases[stateKey].contentHash = computeFileHash(filePath);
+                    }
                 }
                 catch (err) {
                     warn(`  Failed to update test case ${blockKey}/${slug}: ${err.message}`);
@@ -360,6 +853,7 @@ async function pushTestCasesForBlock(client, appId, blockType, blockId, blockKey
                             blockKey,
                             slug,
                             modifiedAt: created.modifiedAt || created.createdAt || new Date().toISOString(),
+                            contentHash: computeFileHash(filePath),
                         };
                     }
                 }
@@ -438,6 +932,7 @@ async function pushTestCasesForBlock(client, appId, blockType, blockId, blockKey
             }
         }
     }
+    return skipped;
 }
 function formatFileSize(bytes) {
     if (bytes < 1024)
@@ -459,13 +954,21 @@ Examples:
 
 Directory Structure:
   config/
-    .primitive-sync.json        # Sync state (auto-managed)
-    app.toml                    # App settings
-    integrations/*.toml         # Integration configs
-    prompts/*.toml              # Prompt configs
-    prompts/{key}.tests/*.toml  # Prompt test cases
-    workflows/*.toml            # Workflow definitions
-    workflows/{key}.tests/*.toml # Workflow test cases
+    .primitive-sync.json            # Sync state (auto-managed)
+    app.toml                        # App settings
+    integrations/*.toml             # Integration configs
+    webhooks/*.toml                 # Webhook configs
+    cron-triggers/*.toml             # Cron trigger configs
+    blob-buckets/*.toml             # Blob bucket configs
+    prompts/*.toml                  # Prompt configs
+    prompts/{key}.tests/*.toml      # Prompt test cases
+    workflows/*.toml                # Workflow definitions
+    workflows/{key}.tests/*.toml    # Workflow test cases
+    database-types/*.toml           # Database type configs + operations
+    rule-sets/*.toml                # Access rule sets
+    group-type-configs/*.toml       # Group type configs
+    collection-type-configs/*.toml  # Collection type configs
+    email-templates/*.toml          # Email template overrides
 `);
     // Init
     sync
@@ -473,14 +976,28 @@ Directory Structure:
         .description("Initialize a sync directory structure")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory", "./config")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
-        const configDir = options.dir;
+        const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
+        if (isAutoResolvedSyncDir(options.dir)) {
+            info(`Using per-environment sync directory: ${configDir}`);
+            const legacyHint = checkLegacySyncMigration(configDir);
+            if (legacyHint)
+                warn(legacyHint);
+        }
         ensureDir(configDir);
         ensureDir(join(configDir, "integrations"));
+        ensureDir(join(configDir, "webhooks"));
+        ensureDir(join(configDir, "cron-triggers"));
+        ensureDir(join(configDir, "blob-buckets"));
         ensureDir(join(configDir, "prompts"));
         ensureDir(join(configDir, "workflows"));
+        ensureDir(join(configDir, "database-types"));
+        ensureDir(join(configDir, "rule-sets"));
+        ensureDir(join(configDir, "group-type-configs"));
+        ensureDir(join(configDir, "collection-type-configs"));
+        ensureDir(join(configDir, "email-templates"));
         const state = {
             appId: resolvedAppId,
             serverUrl: getServerUrl(),
@@ -497,25 +1014,32 @@ Directory Structure:
         .description("Download configuration from server to TOML files")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory", "./config")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .option("--json", "Output as JSON instead of writing files")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
-        const configDir = options.dir;
+        const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
+        if (isAutoResolvedSyncDir(options.dir) && !options.json) {
+            info(`Using per-environment sync directory: ${configDir}`);
+            const legacyHint = checkLegacySyncMigration(configDir);
+            if (legacyHint)
+                warn(legacyHint);
+        }
         const client = new ApiClient();
         info(`Pulling configuration for app ${resolvedAppId}...`);
         try {
             // Fetch all data
-            const [settings, integrationsResult, promptsResult, workflowsResult] = await Promise.all([
+            const [settings, integrationItems, promptItems, workflowItems, emailTemplatesResult] = await Promise.all([
                 client.getAppSettings(resolvedAppId).catch(() => null),
-                client.listIntegrations(resolvedAppId, { limit: 100 }),
-                client.listPrompts(resolvedAppId, { limit: 100 }),
-                client.listWorkflows(resolvedAppId, { limit: 100 }),
+                fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
+                fetchAll((p) => client.listPrompts(resolvedAppId, p)),
+                fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
+                client.listEmailTemplates(resolvedAppId).catch(() => ({ templates: [] })),
             ]);
             // Fetch details for each entity
-            const integrations = await Promise.all(integrationsResult.items.map((i) => client.getIntegration(resolvedAppId, i.integrationId)));
-            const prompts = await Promise.all(promptsResult.items.map((p) => client.getPrompt(resolvedAppId, p.promptId)));
-            const workflows = await Promise.all(workflowsResult.items.map(async (w) => {
+            const integrations = await Promise.all(integrationItems.map((i) => client.getIntegration(resolvedAppId, i.integrationId)));
+            const prompts = await Promise.all(promptItems.map((p) => client.getPrompt(resolvedAppId, p.promptId)));
+            const workflows = await Promise.all(workflowItems.map(async (w) => {
                 const workflowData = await client.getWorkflow(resolvedAppId, w.workflowId);
                 // Fetch active config with steps if available
                 const activeConfigId = workflowData.workflow?.activeConfigId;
@@ -536,39 +1060,124 @@ Directory Structure:
                 }
                 return workflowData;
             }));
+            // Fetch full details for email template overrides
+            const emailTemplateOverrides = emailTemplatesResult.templates.filter((t) => t.hasOverride);
+            const emailTemplates = await Promise.all(emailTemplateOverrides.map((t) => client.getEmailTemplate(resolvedAppId, t.emailType).catch(() => null))).then((results) => results.filter(Boolean));
             if (options.json) {
-                json({ settings, integrations, prompts, workflows });
+                json({ settings, integrations, prompts, workflows, emailTemplates });
                 return;
             }
+            // Fetch database config resources
+            const [databaseTypeConfigsResult, ruleSetsResult, groupTypeConfigsResult, collectionTypeConfigsResult,] = await Promise.all([
+                client.listDatabaseTypeConfigs(resolvedAppId).catch(() => []),
+                client.listRuleSets(resolvedAppId).catch(() => []),
+                client.listGroupTypeConfigs(resolvedAppId).catch(() => []),
+                client.listCollectionTypeConfigs(resolvedAppId).catch(() => []),
+            ]);
+            // Fetch operations for each database type
+            const databaseTypesWithOps = await Promise.all((Array.isArray(databaseTypeConfigsResult) ? databaseTypeConfigsResult : []).map(async (typeConfig) => {
+                const ops = await client.listDatabaseTypeOperations(resolvedAppId, typeConfig.databaseType).catch(() => []);
+                return { typeConfig, operations: Array.isArray(ops) ? ops : [] };
+            }));
             // Ensure directories exist
             ensureDir(configDir);
             ensureDir(join(configDir, "integrations"));
+            ensureDir(join(configDir, "webhooks"));
+            ensureDir(join(configDir, "cron-triggers"));
+            ensureDir(join(configDir, "blob-buckets"));
             ensureDir(join(configDir, "prompts"));
             ensureDir(join(configDir, "workflows"));
+            ensureDir(join(configDir, "database-types"));
+            ensureDir(join(configDir, "rule-sets"));
+            ensureDir(join(configDir, "group-type-configs"));
+            ensureDir(join(configDir, "collection-type-configs"));
+            ensureDir(join(configDir, "email-templates"));
             // Write app settings
             if (settings) {
-                writeFileSync(join(configDir, "app.toml"), serializeAppSettings(settings));
+                const appTomlPath = join(configDir, "app.toml");
+                writeFileSync(appTomlPath, serializeAppSettings(settings));
                 info("  Wrote app.toml");
             }
             // Write integrations
             const integrationEntities = {};
             for (const integration of integrations) {
                 const filename = `${integration.integrationKey}.toml`;
-                writeFileSync(join(configDir, "integrations", filename), serializeIntegration(integration));
+                const filePath = join(configDir, "integrations", filename);
+                writeFileSync(filePath, serializeIntegration(integration));
                 integrationEntities[integration.integrationKey] = {
                     id: integration.integrationId,
                     modifiedAt: integration.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
                 };
                 info(`  Wrote integrations/${filename}`);
             }
+            // Pull webhooks
+            const webhookItems = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+            const webhooks = await Promise.all(webhookItems.map((w) => client.getWebhook(resolvedAppId, w.webhookId)));
+            const webhooksDir = join(configDir, "webhooks");
+            mkdirSync(webhooksDir, { recursive: true });
+            const webhookEntities = {};
+            for (const webhook of webhooks) {
+                const filename = `${webhook.webhookKey}.toml`;
+                const filePath = join(webhooksDir, filename);
+                writeFileSync(filePath, serializeWebhook(webhook));
+                webhookEntities[webhook.webhookKey] = {
+                    id: webhook.webhookId,
+                    modifiedAt: webhook.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+            }
+            info(`  Pulled ${webhooks.length} webhook(s)`);
+            // Pull cron triggers
+            let cronTriggerItems = [];
+            try {
+                const cronResult = await client.listCronTriggers(resolvedAppId);
+                cronTriggerItems = cronResult.items || [];
+            }
+            catch {
+                // Cron triggers may not be available on older servers
+            }
+            const cronTriggersDir = join(configDir, "cron-triggers");
+            mkdirSync(cronTriggersDir, { recursive: true });
+            const cronTriggerEntities = {};
+            for (const trigger of cronTriggerItems) {
+                const filename = `${trigger.triggerKey}.toml`;
+                const filePath = join(cronTriggersDir, filename);
+                writeFileSync(filePath, serializeCronTrigger(trigger));
+                cronTriggerEntities[trigger.triggerKey] = {
+                    id: trigger.triggerId,
+                    modifiedAt: trigger.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+            }
+            info(`  Pulled ${cronTriggerItems.length} cron trigger(s)`);
+            // Pull blob buckets
+            const blobBucketsResult = await client.listBlobBuckets(resolvedAppId).catch(() => ({ items: [] }));
+            const blobBucketItems = blobBucketsResult.items || [];
+            const blobBucketsDir = join(configDir, "blob-buckets");
+            mkdirSync(blobBucketsDir, { recursive: true });
+            const blobBucketEntities = {};
+            for (const bucket of blobBucketItems) {
+                const filename = `${bucket.bucketKey}.toml`;
+                const filePath = join(blobBucketsDir, filename);
+                writeFileSync(filePath, serializeBlobBucket(bucket));
+                blobBucketEntities[bucket.bucketKey] = {
+                    id: bucket.bucketId,
+                    modifiedAt: bucket.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+            }
+            info(`  Pulled ${blobBucketItems.length} blob bucket(s)`);
             // Write prompts
             const promptEntities = {};
             for (const prompt of prompts) {
                 const filename = `${prompt.promptKey}.toml`;
-                writeFileSync(join(configDir, "prompts", filename), serializePrompt(prompt));
+                const filePath = join(configDir, "prompts", filename);
+                writeFileSync(filePath, serializePrompt(prompt));
                 promptEntities[prompt.promptKey] = {
                     id: prompt.promptId,
                     modifiedAt: prompt.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
                 };
                 info(`  Wrote prompts/${filename}`);
             }
@@ -576,51 +1185,200 @@ Directory Structure:
             const workflowEntities = {};
             for (const { workflow, draft, configs } of workflows) {
                 const filename = `${workflow.workflowKey}.toml`;
-                writeFileSync(join(configDir, "workflows", filename), serializeWorkflow(workflow, draft, configs || []));
+                const filePath = join(configDir, "workflows", filename);
+                writeFileSync(filePath, serializeWorkflow(workflow, draft, configs || []));
+                // Hash the expanded (post-fragment-splice) form so subsequent pushes
+                // can detect fragment-only edits. See `computeExpandedContentHash`.
+                // Pulled workflows never carry `include`, so the expander is a
+                // no-op here — but we use the same canonical-JSON hash function so
+                // the push-side comparison stays consistent.
                 workflowEntities[workflow.workflowKey] = {
                     id: workflow.workflowId,
                     modifiedAt: workflow.modifiedAt || new Date().toISOString(),
                     activeConfigId: workflow.activeConfigId,
+                    contentHash: computeExpandedContentHash(parseTomlFile(filePath)),
                 };
                 info(`  Wrote workflows/${filename}`);
             }
+            // Build lookup maps for test case serialization
+            const configIdToName = new Map();
+            const promptIdToKey = new Map();
+            for (const prompt of prompts) {
+                promptIdToKey.set(prompt.promptId, prompt.promptKey);
+                if (prompt.configs) {
+                    for (const config of prompt.configs) {
+                        configIdToName.set(config.configId, config.configName);
+                    }
+                }
+            }
+            // Also include workflow config names
+            for (const { configs } of workflows) {
+                if (configs) {
+                    for (const config of configs) {
+                        configIdToName.set(config.configId, config.configName);
+                    }
+                }
+            }
+            const testCaseLookupMaps = { configIdToName, promptIdToKey };
+            // Write email templates (use detailed emailTemplates, not summaries)
+            const emailTemplateEntities = {};
+            for (const template of emailTemplates) {
+                const filename = `${template.emailType}.toml`;
+                writeFileSync(join(configDir, "email-templates", filename), serializeEmailTemplate(template));
+                emailTemplateEntities[template.emailType] = {
+                    id: template.emailType,
+                    modifiedAt: template.override?.modifiedAt || new Date().toISOString(),
+                };
+                info(`  Wrote email-templates/${filename}`);
+            }
+            // Clean up local email template files for remotely-deleted overrides
+            const emailTemplatesDir = join(configDir, "email-templates");
+            if (existsSync(emailTemplatesDir)) {
+                const pulledTypes = new Set(emailTemplates.map((t) => t.emailType));
+                const localFiles = readdirSync(emailTemplatesDir).filter((f) => f.endsWith(".toml"));
+                for (const file of localFiles) {
+                    const localType = basename(file, ".toml");
+                    if (!pulledTypes.has(localType)) {
+                        unlinkSync(join(emailTemplatesDir, file));
+                        info(`  Removed email-templates/${file} (override deleted on server)`);
+                    }
+                }
+            }
             // Pull test cases for prompts and workflows
             const testCaseEntities = {};
             let totalTestCases = 0;
             for (const prompt of prompts) {
-                const count = await pullTestCasesForBlock(client, resolvedAppId, "prompt", prompt.promptId, prompt.promptKey, configDir, testCaseEntities);
+                const count = await pullTestCasesForBlock(client, resolvedAppId, "prompt", prompt.promptId, prompt.promptKey, configDir, testCaseEntities, testCaseLookupMaps);
                 if (count > 0) {
                     info(`  Wrote ${count} test case(s) for prompt: ${prompt.promptKey}`);
                 }
                 totalTestCases += count;
             }
             for (const { workflow } of workflows) {
-                const count = await pullTestCasesForBlock(client, resolvedAppId, "workflow", workflow.workflowId, workflow.workflowKey, configDir, testCaseEntities);
+                const count = await pullTestCasesForBlock(client, resolvedAppId, "workflow", workflow.workflowId, workflow.workflowKey, configDir, testCaseEntities, testCaseLookupMaps);
                 if (count > 0) {
                     info(`  Wrote ${count} test case(s) for workflow: ${workflow.workflowKey}`);
                 }
                 totalTestCases += count;
             }
+            // Build ruleSetId → name map for database types and group type configs
+            const ruleSets = Array.isArray(ruleSetsResult) ? ruleSetsResult : [];
+            const ruleSetIdToName = new Map();
+            for (const ruleSet of ruleSets) {
+                ruleSetIdToName.set(ruleSet.ruleSetId, ruleSet.name);
+            }
+            // Write database types
+            const databaseTypeEntities = {};
+            for (const { typeConfig, operations } of databaseTypesWithOps) {
+                const filename = `${typeConfig.databaseType}.toml`;
+                const filePath = join(configDir, "database-types", filename);
+                // Preserve the existing file's per-op form (issue #752): if the
+                // file already exists, read it raw and detect which operations
+                // currently use JSON-string vs native nested-table form.
+                const hints = existsSync(filePath)
+                    ? detectExistingOperationForms(readFileSync(filePath, "utf-8"))
+                    : undefined;
+                writeFileSync(filePath, serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
+                    hints,
+                    defaultForm: "native",
+                    logger: (msg) => info(`  ${msg}`),
+                }));
+                const opsEntities = {};
+                for (const op of operations) {
+                    opsEntities[op.name] = {
+                        modifiedAt: op.modifiedAt || new Date().toISOString(),
+                    };
+                }
+                databaseTypeEntities[typeConfig.databaseType] = {
+                    databaseType: typeConfig.databaseType,
+                    modifiedAt: typeConfig.modifiedAt || new Date().toISOString(),
+                    operations: Object.keys(opsEntities).length > 0 ? opsEntities : undefined,
+                    contentHash: computeFileHash(filePath),
+                    hasSchema: typeof typeConfig.schema === "string" &&
+                        typeConfig.schema.trim().length > 0,
+                };
+                info(`  Wrote database-types/${filename}`);
+            }
+            // Write rule sets
+            const ruleSetEntities = {};
+            for (const ruleSet of ruleSets) {
+                const fileKey = (ruleSet.name || ruleSet.ruleSetId).replace(/[/\\:*?"<>|]/g, "_");
+                const filename = `${fileKey}.toml`;
+                const filePath = join(configDir, "rule-sets", filename);
+                writeFileSync(filePath, serializeRuleSet(ruleSet));
+                ruleSetEntities[fileKey] = {
+                    id: ruleSet.ruleSetId,
+                    modifiedAt: ruleSet.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+                info(`  Wrote rule-sets/${filename}`);
+            }
+            // Write group type configs
+            const groupTypeConfigEntities = {};
+            const groupTypeConfigs = Array.isArray(groupTypeConfigsResult) ? groupTypeConfigsResult : [];
+            for (const config of groupTypeConfigs) {
+                const filename = `${config.groupType}.toml`;
+                const filePath = join(configDir, "group-type-configs", filename);
+                writeFileSync(filePath, serializeGroupTypeConfig(config, ruleSetIdToName));
+                groupTypeConfigEntities[config.groupType] = {
+                    modifiedAt: config.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+                info(`  Wrote group-type-configs/${filename}`);
+            }
+            // Write collection type configs
+            const collectionTypeConfigEntities = {};
+            const collectionTypeConfigs = Array.isArray(collectionTypeConfigsResult)
+                ? collectionTypeConfigsResult
+                : [];
+            for (const config of collectionTypeConfigs) {
+                const filename = `${config.collectionType}.toml`;
+                const filePath = join(configDir, "collection-type-configs", filename);
+                writeFileSync(filePath, serializeCollectionTypeConfig(config, ruleSetIdToName));
+                collectionTypeConfigEntities[config.collectionType] = {
+                    modifiedAt: config.modifiedAt || new Date().toISOString(),
+                    contentHash: computeFileHash(filePath),
+                };
+                info(`  Wrote collection-type-configs/${filename}`);
+            }
             // Save sync state
             const state = {
                 appId: resolvedAppId,
                 serverUrl: getServerUrl(),
                 lastSyncedAt: new Date().toISOString(),
                 entities: {
-                    app: settings ? { modifiedAt: new Date().toISOString() } : undefined,
+                    app: settings ? { modifiedAt: new Date().toISOString(), contentHash: computeFileHash(join(configDir, "app.toml")) } : undefined,
                     integrations: integrationEntities,
+                    webhooks: webhookEntities,
+                    cronTriggers: Object.keys(cronTriggerEntities).length > 0 ? cronTriggerEntities : undefined,
+                    blobBuckets: Object.keys(blobBucketEntities).length > 0 ? blobBucketEntities : undefined,
                     prompts: promptEntities,
                     workflows: workflowEntities,
+                    emailTemplates: Object.keys(emailTemplateEntities).length > 0 ? emailTemplateEntities : undefined,
                     testCases: Object.keys(testCaseEntities).length > 0 ? testCaseEntities : undefined,
+                    databaseTypes: Object.keys(databaseTypeEntities).length > 0 ? databaseTypeEntities : undefined,
+                    ruleSets: Object.keys(ruleSetEntities).length > 0 ? ruleSetEntities : undefined,
+                    groupTypeConfigs: Object.keys(groupTypeConfigEntities).length > 0 ? groupTypeConfigEntities : undefined,
+                    collectionTypeConfigs: Object.keys(collectionTypeConfigEntities).length > 0
+                        ? collectionTypeConfigEntities
+                        : undefined,
                 },
             };
             saveSyncState(configDir, state);
             divider();
             success(`Pulled configuration to ${configDir}`);
             keyValue("Integrations", integrations.length);
+            keyValue("Webhooks", webhooks.length);
+            keyValue("Cron Triggers", cronTriggerItems.length);
+            keyValue("Blob Buckets", blobBucketItems.length);
             keyValue("Prompts", prompts.length);
             keyValue("Workflows", workflows.length);
+            keyValue("Email Templates", emailTemplates.length);
             keyValue("Test Cases", totalTestCases);
+            keyValue("Database Types", databaseTypesWithOps.length);
+            keyValue("Rule Sets", ruleSets.length);
+            keyValue("Group Type Configs", groupTypeConfigs.length);
+            keyValue("Collection Type Configs", collectionTypeConfigs.length);
         }
         catch (err) {
             error(err.message);
@@ -633,49 +1391,194 @@ Directory Structure:
         .description("Upload local TOML configuration to server")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory", "./config")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .option("--dry-run", "Show what would be changed without applying")
         .option("--force", "Overwrite remote even if modified since last pull")
+        .option("--accept-warnings", "Commit schema diffs that have operations with dynamic refs (issue #666 SCHEMA_HAS_UNCHECKABLE_OPS escape hatch)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
-        const configDir = options.dir;
+        const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
+        if (isAutoResolvedSyncDir(options.dir)) {
+            info(`Using per-environment sync directory: ${configDir}`);
+            const legacyHint = checkLegacySyncMigration(configDir);
+            if (legacyHint)
+                warn(legacyHint);
+        }
         const client = new ApiClient();
         if (!existsSync(configDir)) {
             error(`Config directory not found: ${configDir}`);
             process.exit(1);
         }
-        const syncState = loadSyncState(configDir);
+        let syncState = loadSyncState(configDir);
+        // Detect cross-app push: if pushing to a different app, clear entity IDs
+        // so everything goes through the create path
+        const isCrossAppPush = syncState && syncState.appId !== resolvedAppId;
+        if (isCrossAppPush) {
+            info(`Cross-app push detected: ${syncState.appId} → ${resolvedAppId}`);
+            info("All entities will be created fresh in the target app.");
+            syncState = {
+                appId: resolvedAppId,
+                serverUrl: syncState.serverUrl,
+                lastSyncedAt: new Date().toISOString(),
+                entities: {},
+            };
+        }
         info(`Pushing configuration for app ${resolvedAppId}...`);
         try {
             const changes = [];
+            let skippedCount = 0;
             const conflicts = [];
+            // Issue #666: per-class buckets for schema-feature errors. Each entry
+            // groups failures by the code so the end-of-run report can print
+            // them once with the friendly hint.
+            const schemaErrors = {
+                schemaRequired: [],
+                opRefs: [],
+                schemaBreaks: [],
+                uncheckableOps: [],
+                tomlParse: [],
+                opsExist: [],
+            };
+            // Track name→ID mappings for resolving cross-references during push
+            const ruleSetNameToId = new Map();
+            const promptKeyToId = new Map();
+            const promptConfigNameToId = new Map(); // key: "promptKey#configName"
+            const workflowConfigNameToId = new Map(); // key: "workflowKey#configName"
             // Process app settings
             const appTomlPath = join(configDir, "app.toml");
             if (existsSync(appTomlPath)) {
-                const tomlData = parseTomlFile(appTomlPath);
-                const settings = {};
-                if (tomlData.app) {
-                    Object.assign(settings, tomlData.app);
+                const appChanged = options.force || !syncState?.entities?.app?.contentHash ||
+                    shouldPushFile(appTomlPath, syncState.entities.app.contentHash);
+                if (!appChanged) {
+                    skippedCount++;
+                    info("  Skipped app settings (unchanged)");
                 }
-                if (tomlData.auth) {
-                    settings.googleOAuthEnabled = tomlData.auth.googleOAuthEnabled;
-                    settings.passkeyEnabled = tomlData.auth.passkeyEnabled;
-                    settings.magicLinkEnabled = tomlData.auth.magicLinkEnabled;
-                    if (tomlData.auth.passkeys) {
-                        settings.passkeyRpConfig = tomlData.auth.passkeys;
+                else {
+                    const tomlData = parseTomlFile(appTomlPath);
+                    const settings = {};
+                    if (tomlData.app) {
+                        Object.assign(settings, tomlData.app);
+                        // Don't overwrite the target app's name during cross-app push
+                        if (isCrossAppPush) {
+                            delete settings.name;
+                        }
+                    }
+                    if (tomlData.auth) {
+                        settings.googleOAuthEnabled = tomlData.auth.googleOAuthEnabled;
+                        settings.passkeyEnabled = tomlData.auth.passkeyEnabled;
+                        settings.magicLinkEnabled = tomlData.auth.magicLinkEnabled;
+                        if (tomlData.auth.passkeys) {
+                            settings.passkeyRpConfig = tomlData.auth.passkeys;
+                        }
+                    }
+                    if (tomlData.cors) {
+                        settings.corsMode = tomlData.cors.mode;
+                        settings.corsAllowedOrigins = tomlData.cors.allowedOrigins;
+                        settings.corsAllowCredentials = tomlData.cors.allowCredentials;
+                        settings.corsAllowedMethods = tomlData.cors.allowedMethods;
+                        settings.corsMaxAge = tomlData.cors.maxAge;
+                    }
+                    changes.push({ type: "app", action: "update", key: "settings" });
+                    if (!options.dryRun) {
+                        await client.updateAppSettings(resolvedAppId, settings);
+                        info("  Updated app settings");
+                        // Store content hash after successful push
+                        if (syncState) {
+                            if (!syncState.entities.app) {
+                                syncState.entities.app = { modifiedAt: new Date().toISOString() };
+                            }
+                            syncState.entities.app.contentHash = computeFileHash(appTomlPath);
+                        }
                     }
                 }
-                if (tomlData.cors) {
-                    settings.corsMode = tomlData.cors.mode;
-                    settings.corsAllowedOrigins = tomlData.cors.allowedOrigins;
-                    settings.corsAllowCredentials = tomlData.cors.allowCredentials;
-                    settings.corsAllowedMethods = tomlData.cors.allowedMethods;
-                    settings.corsMaxAge = tomlData.cors.maxAge;
-                }
-                changes.push({ type: "app", action: "update", key: "settings" });
-                if (!options.dryRun) {
-                    await client.updateAppSettings(resolvedAppId, settings);
-                    info("  Updated app settings");
+            }
+            // Process rule sets first (other entities may reference them by name)
+            const ruleSetsDir = join(configDir, "rule-sets");
+            if (existsSync(ruleSetsDir)) {
+                const files = readdirSync(ruleSetsDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(ruleSetsDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const ruleSetData = parseRuleSetToml(tomlData);
+                    const fileKey = basename(file, ".toml");
+                    const existingId = syncState?.entities?.ruleSets?.[fileKey]?.id;
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.ruleSets?.[fileKey]?.contentHash)) {
+                        skippedCount++;
+                        ruleSetNameToId.set(ruleSetData.name, existingId);
+                        continue;
+                    }
+                    if (existingId) {
+                        // Update existing rule set
+                        changes.push({ type: "rule-set", action: "update", key: fileKey });
+                        if (!options.dryRun) {
+                            const expectedModifiedAt = options.force
+                                ? undefined
+                                : syncState?.entities?.ruleSets?.[fileKey]?.modifiedAt;
+                            try {
+                                const updated = await client.updateRuleSet(resolvedAppId, existingId, {
+                                    name: ruleSetData.name,
+                                    description: ruleSetData.description,
+                                    rules: ruleSetData.rules,
+                                }, expectedModifiedAt);
+                                info(`  Updated rule set: ${fileKey}`);
+                                if (syncState?.entities?.ruleSets?.[fileKey] && updated?.modifiedAt) {
+                                    syncState.entities.ruleSets[fileKey].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.ruleSets[fileKey].contentHash = computeFileHash(filePath);
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError) {
+                                    conflicts.push({
+                                        type: "rule-set",
+                                        key: fileKey,
+                                        serverModifiedAt: err.serverModifiedAt,
+                                        localModifiedAt: expectedModifiedAt || "unknown",
+                                    });
+                                }
+                                else {
+                                    throw wrapEntityError(err, "update", "rule set", fileKey);
+                                }
+                            }
+                        }
+                        // Track name→ID for cross-reference resolution
+                        ruleSetNameToId.set(ruleSetData.name, existingId);
+                    }
+                    else {
+                        // Create new rule set
+                        changes.push({ type: "rule-set", action: "create", key: fileKey });
+                        if (!options.dryRun) {
+                            let created;
+                            try {
+                                created = await client.createRuleSet(resolvedAppId, {
+                                    name: ruleSetData.name,
+                                    resourceType: ruleSetData.resourceType,
+                                    rules: ruleSetData.rules,
+                                    description: ruleSetData.description,
+                                });
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "rule set", fileKey);
+                            }
+                            info(`  Created rule set: ${fileKey}`);
+                            if (syncState && created?.ruleSetId) {
+                                if (!syncState.entities.ruleSets) {
+                                    syncState.entities.ruleSets = {};
+                                }
+                                syncState.entities.ruleSets[fileKey] = {
+                                    id: created.ruleSetId,
+                                    modifiedAt: created.modifiedAt || new Date().toISOString(),
+                                    contentHash: computeFileHash(filePath),
+                                };
+                            }
+                            // Track name→ID for cross-reference resolution
+                            ruleSetNameToId.set(ruleSetData.name, created.ruleSetId);
+                        }
+                        else {
+                            // In dry-run mode, use a placeholder so dependent entities can resolve
+                            ruleSetNameToId.set(ruleSetData.name, `dry-run-${ruleSetData.name}`);
+                        }
+                    }
                 }
             }
             // Process integrations
@@ -688,6 +1591,11 @@ Directory Structure:
                     const integration = tomlData.integration || {};
                     const key = integration.key || basename(file, ".toml");
                     const existingId = syncState?.entities?.integrations?.[key]?.id;
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.integrations?.[key]?.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
                     const payload = {
                         integrationKey: key,
                         displayName: integration.displayName || key,
@@ -708,6 +1616,7 @@ Directory Structure:
                                 // Update sync state with new modifiedAt
                                 if (syncState?.entities?.integrations?.[key] && updated?.modifiedAt) {
                                     syncState.entities.integrations[key].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.integrations[key].contentHash = computeFileHash(filePath);
                                 }
                             }
                             catch (err) {
@@ -720,7 +1629,7 @@ Directory Structure:
                                     });
                                 }
                                 else {
-                                    throw err;
+                                    throw wrapEntityError(err, "update", "integration", key);
                                 }
                             }
                         }
@@ -728,64 +1637,377 @@ Directory Structure:
                     else {
                         changes.push({ type: "integration", action: "create", key });
                         if (!options.dryRun) {
-                            const created = await client.createIntegration(resolvedAppId, payload);
-                            info(`  Created integration: ${key}`);
-                            // Add new entity to sync state
-                            if (syncState && created?.integrationId && created?.modifiedAt) {
-                                if (!syncState.entities.integrations) {
-                                    syncState.entities.integrations = {};
-                                }
-                                syncState.entities.integrations[key] = {
-                                    id: created.integrationId,
-                                    modifiedAt: created.modifiedAt,
-                                };
+                            try {
+                                const created = await client.createIntegration(resolvedAppId, payload);
+                                info(`  Created integration: ${key}`);
+                                // Add new entity to sync state
+                                if (syncState && created?.integrationId && created?.modifiedAt) {
+                                    if (!syncState.entities.integrations) {
+                                        syncState.entities.integrations = {};
+                                    }
+                                    syncState.entities.integrations[key] = {
+                                        id: created.integrationId,
+                                        modifiedAt: created.modifiedAt,
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "integration", key);
                             }
                         }
                     }
                 }
             }
-            // Process prompts
-            const promptsDir = join(configDir, "prompts");
-            if (existsSync(promptsDir)) {
-                const files = readdirSync(promptsDir).filter((f) => f.endsWith(".toml"));
+            // Process webhooks
+            const webhooksDir = join(configDir, "webhooks");
+            if (existsSync(webhooksDir)) {
+                const files = readdirSync(webhooksDir).filter((f) => f.endsWith(".toml"));
                 for (const file of files) {
-                    const filePath = join(promptsDir, file);
+                    const filePath = join(webhooksDir, file);
                     const tomlData = parseTomlFile(filePath);
-                    const prompt = tomlData.prompt || {};
-                    const key = prompt.key || basename(file, ".toml");
-                    const configs = tomlData.configs || [];
-                    const existingId = syncState?.entities?.prompts?.[key]?.id;
+                    const webhook = tomlData.webhook || {};
+                    const key = webhook.key || basename(file, ".toml");
+                    const existingId = syncState?.entities?.webhooks?.[key]?.id;
+                    if (!options.force && existingId &&
+                        !shouldPushFile(filePath, syncState?.entities?.webhooks?.[key]?.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    const payload = {
+                        webhookKey: key,
+                        displayName: webhook.displayName || key,
+                        description: webhook.description,
+                        workflowKey: webhook.workflowKey,
+                        verificationScheme: webhook.verificationScheme,
+                        status: webhook.status,
+                        toleranceSeconds: webhook.toleranceSeconds,
+                        deduplicationEnabled: webhook.deduplicationEnabled,
+                        deduplicationWindowMs: webhook.deduplicationWindowMs,
+                        secretGracePeriodMs: webhook.secretGracePeriodMs,
+                    };
+                    // Handle JSON fields
+                    if (tomlData.allowedIps?.cidrs) {
+                        payload.allowedIpCidrs = JSON.stringify(tomlData.allowedIps.cidrs);
+                    }
+                    if (tomlData.inputMapping) {
+                        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
+                    }
+                    if (tomlData.metadata) {
+                        payload.metadata = JSON.stringify(tomlData.metadata);
+                    }
                     if (existingId) {
-                        // Update existing prompt
-                        changes.push({ type: "prompt", action: "update", key });
+                        changes.push({ type: "webhook", action: "update", key });
                         if (!options.dryRun) {
                             const expectedModifiedAt = options.force
                                 ? undefined
-                                : syncState?.entities?.prompts?.[key]?.modifiedAt;
+                                : syncState?.entities?.webhooks?.[key]?.modifiedAt;
                             try {
-                                const updated = await client.updatePrompt(resolvedAppId, existingId, {
-                                    displayName: prompt.displayName,
-                                    description: prompt.description,
-                                    inputSchema: prompt.inputSchema,
-                                    status: prompt.status,
-                                }, expectedModifiedAt);
-                                info(`  Updated prompt: ${key}`);
-                                // Update sync state with new modifiedAt
-                                if (syncState?.entities?.prompts?.[key] && updated?.modifiedAt) {
-                                    syncState.entities.prompts[key].modifiedAt = updated.modifiedAt;
+                                const updated = await client.updateWebhook(resolvedAppId, existingId, payload, expectedModifiedAt);
+                                info(`  Updated webhook: ${key}`);
+                                if (syncState?.entities?.webhooks?.[key] && updated?.modifiedAt) {
+                                    syncState.entities.webhooks[key].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.webhooks[key].contentHash = computeFileHash(filePath);
                                 }
                             }
                             catch (err) {
                                 if (err instanceof ConflictError) {
                                     conflicts.push({
-                                        type: "prompt",
+                                        type: "webhook",
                                         key,
                                         serverModifiedAt: err.serverModifiedAt,
                                         localModifiedAt: expectedModifiedAt || "unknown",
                                     });
                                 }
                                 else {
-                                    throw err;
+                                    throw wrapEntityError(err, "update", "webhook", key);
+                                }
+                            }
+                        }
+                    }
+                    else {
+                        changes.push({ type: "webhook", action: "create", key });
+                        if (!options.dryRun) {
+                            try {
+                                const created = await client.createWebhook(resolvedAppId, payload);
+                                info(`  Created webhook: ${key}`);
+                                if (syncState && created?.webhookId && created?.modifiedAt) {
+                                    if (!syncState.entities.webhooks) {
+                                        syncState.entities.webhooks = {};
+                                    }
+                                    syncState.entities.webhooks[key] = {
+                                        id: created.webhookId,
+                                        modifiedAt: created.modifiedAt,
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "webhook", key);
+                            }
+                        }
+                    }
+                }
+            }
+            // Process cron triggers
+            const cronTriggersDir = join(configDir, "cron-triggers");
+            if (existsSync(cronTriggersDir)) {
+                const files = readdirSync(cronTriggersDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(cronTriggersDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const cronTrigger = tomlData.cronTrigger || {};
+                    const key = cronTrigger.key || basename(file, ".toml");
+                    const existingId = syncState?.entities?.cronTriggers?.[key]?.id;
+                    if (!options.force && existingId &&
+                        !shouldPushFile(filePath, syncState?.entities?.cronTriggers?.[key]?.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    const payload = {
+                        triggerKey: key,
+                        displayName: cronTrigger.displayName || key,
+                        description: cronTrigger.description,
+                        cron: cronTrigger.cron,
+                        timezone: cronTrigger.timezone,
+                        workflowKey: cronTrigger.workflowKey,
+                        overlapPolicy: cronTrigger.overlapPolicy,
+                        state: cronTrigger.state,
+                    };
+                    // Handle JSON fields
+                    if (tomlData.rootInput) {
+                        payload.rootInput = JSON.stringify(tomlData.rootInput);
+                    }
+                    if (tomlData.inputMapping) {
+                        payload.inputMapping = JSON.stringify(tomlData.inputMapping);
+                    }
+                    if (existingId) {
+                        changes.push({ type: "cron-trigger", action: "update", key });
+                        if (!options.dryRun) {
+                            try {
+                                const updated = await client.updateCronTrigger(resolvedAppId, existingId, payload);
+                                info(`  Updated cron trigger: ${key}`);
+                                if (syncState?.entities?.cronTriggers?.[key] && updated?.modifiedAt) {
+                                    syncState.entities.cronTriggers[key].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.cronTriggers[key].contentHash = computeFileHash(filePath);
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "update", "cron trigger", key);
+                            }
+                        }
+                    }
+                    else {
+                        changes.push({ type: "cron-trigger", action: "create", key });
+                        if (!options.dryRun) {
+                            try {
+                                const created = await client.createCronTrigger(resolvedAppId, payload);
+                                info(`  Created cron trigger: ${key}`);
+                                if (syncState && created?.triggerId && created?.modifiedAt) {
+                                    if (!syncState.entities.cronTriggers) {
+                                        syncState.entities.cronTriggers = {};
+                                    }
+                                    syncState.entities.cronTriggers[key] = {
+                                        id: created.triggerId,
+                                        modifiedAt: created.modifiedAt,
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "cron trigger", key);
+                            }
+                        }
+                    }
+                }
+            }
+            // Process blob buckets
+            const blobBucketsPushDir = join(configDir, "blob-buckets");
+            if (existsSync(blobBucketsPushDir)) {
+                const files = readdirSync(blobBucketsPushDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(blobBucketsPushDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const bucket = tomlData.bucket || {};
+                    const key = bucket.key || basename(file, ".toml");
+                    const existingId = syncState?.entities?.blobBuckets?.[key]?.id;
+                    if (!options.force && existingId &&
+                        !shouldPushFile(filePath, syncState?.entities?.blobBuckets?.[key]?.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    if (existingId) {
+                        // Blob buckets don't have an update API - skip if already exists
+                        info(`  Blob bucket already exists, skipping: ${key}`);
+                        if (syncState?.entities?.blobBuckets?.[key]) {
+                            syncState.entities.blobBuckets[key].contentHash = computeFileHash(filePath);
+                        }
+                    }
+                    else {
+                        const payload = {
+                            bucketKey: key,
+                            name: bucket.name || key,
+                            ttlTier: bucket.ttlTier,
+                            accessPolicy: bucket.accessPolicy,
+                        };
+                        if (bucket.description)
+                            payload.description = bucket.description;
+                        if (bucket.ruleSetId)
+                            payload.ruleSetId = bucket.ruleSetId;
+                        changes.push({ type: "blob-bucket", action: "create", key });
+                        if (!options.dryRun) {
+                            try {
+                                const created = await client.createBlobBucket(resolvedAppId, payload);
+                                info(`  Created blob bucket: ${key}`);
+                                if (syncState) {
+                                    if (!syncState.entities.blobBuckets) {
+                                        syncState.entities.blobBuckets = {};
+                                    }
+                                    syncState.entities.blobBuckets[key] = {
+                                        id: created.bucketId,
+                                        modifiedAt: created.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                const msg = String(err?.message || err);
+                                if (msg.includes("already exists") || err.statusCode === 409) {
+                                    info(`  Blob bucket already exists on server: ${key}`);
+                                    // Fetch the existing bucket to get its ID
+                                    try {
+                                        const existing = await client.getBlobBucket(resolvedAppId, key);
+                                        if (syncState && existing?.bucketId) {
+                                            if (!syncState.entities.blobBuckets) {
+                                                syncState.entities.blobBuckets = {};
+                                            }
+                                            syncState.entities.blobBuckets[key] = {
+                                                id: existing.bucketId,
+                                                modifiedAt: existing.modifiedAt || new Date().toISOString(),
+                                                contentHash: computeFileHash(filePath),
+                                            };
+                                        }
+                                    }
+                                    catch {
+                                        // Ignore fetch errors
+                                    }
+                                }
+                                else {
+                                    throw wrapEntityError(err, "create", "blob bucket", key);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Process prompts
+            const promptsDir = join(configDir, "prompts");
+            if (existsSync(promptsDir)) {
+                const files = readdirSync(promptsDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(promptsDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const prompt = tomlData.prompt || {};
+                    const key = prompt.key || basename(file, ".toml");
+                    const configs = tomlData.configs || [];
+                    const existingId = syncState?.entities?.prompts?.[key]?.id;
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingId && !shouldPushFile(filePath, syncState?.entities?.prompts?.[key]?.contentHash)) {
+                        skippedCount++;
+                        promptKeyToId.set(key, existingId);
+                        // Only fetch config name→ID mappings if test cases exist for this prompt
+                        const promptTestsDir = getTestsDir(configDir, "prompt", key);
+                        if (!options.dryRun && existsSync(promptTestsDir)) {
+                            const fullPrompt = await client.getPrompt(resolvedAppId, existingId);
+                            if (fullPrompt?.configs) {
+                                for (const config of fullPrompt.configs) {
+                                    promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                }
+                            }
+                        }
+                        continue;
+                    }
+                    if (existingId) {
+                        // Update existing prompt
+                        changes.push({ type: "prompt", action: "update", key });
+                        promptKeyToId.set(key, existingId);
+                        if (!options.dryRun) {
+                            const expectedModifiedAt = options.force
+                                ? undefined
+                                : syncState?.entities?.prompts?.[key]?.modifiedAt;
+                            try {
+                                const updated = await client.updatePrompt(resolvedAppId, existingId, {
+                                    displayName: prompt.displayName,
+                                    description: prompt.description,
+                                    inputSchema: prompt.inputSchema,
+                                    status: prompt.status,
+                                }, expectedModifiedAt);
+                                info(`  Updated prompt: ${key}`);
+                                // Update sync state with new modifiedAt
+                                if (syncState?.entities?.prompts?.[key] && updated?.modifiedAt) {
+                                    syncState.entities.prompts[key].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.prompts[key].contentHash = computeFileHash(filePath);
+                                }
+                                // Fetch full prompt to get config name→ID mappings
+                                // (updatePrompt response doesn't include configs)
+                                const fullPrompt = await client.getPrompt(resolvedAppId, existingId);
+                                if (fullPrompt?.configs) {
+                                    for (const config of fullPrompt.configs) {
+                                        promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                    }
+                                }
+                                // Update existing prompt configs with TOML values
+                                if (fullPrompt?.configs && configs.length > 0) {
+                                    for (const tomlConfig of configs) {
+                                        const configName = tomlConfig.name;
+                                        if (!configName)
+                                            continue;
+                                        const serverConfig = fullPrompt.configs.find((c) => c.configName === configName);
+                                        if (serverConfig) {
+                                            // Update existing config
+                                            await client.updatePromptConfig(resolvedAppId, existingId, serverConfig.configId, {
+                                                description: tomlConfig.description,
+                                                provider: tomlConfig.provider,
+                                                model: tomlConfig.model,
+                                                systemPrompt: tomlConfig.systemPrompt,
+                                                userPromptTemplate: tomlConfig.userPromptTemplate,
+                                                temperature: tomlConfig.temperature,
+                                                maxTokens: tomlConfig.maxTokens,
+                                                outputFormat: tomlConfig.outputFormat,
+                                            });
+                                        }
+                                        else {
+                                            // Create new config that doesn't exist on server yet
+                                            const newConfig = await client.createPromptConfig(resolvedAppId, existingId, {
+                                                configName,
+                                                description: tomlConfig.description,
+                                                provider: tomlConfig.provider || "openrouter",
+                                                model: tomlConfig.model || "google/gemini-2.0-flash-001",
+                                                systemPrompt: tomlConfig.systemPrompt,
+                                                userPromptTemplate: tomlConfig.userPromptTemplate,
+                                                temperature: tomlConfig.temperature,
+                                                maxTokens: tomlConfig.maxTokens,
+                                                outputFormat: tomlConfig.outputFormat,
+                                            });
+                                            if (newConfig?.configId) {
+                                                promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
+                                            }
+                                        }
+                                    }
+                                    info(`    Synced ${configs.length} config(s) for prompt: ${key}`);
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError) {
+                                    conflicts.push({
+                                        type: "prompt",
+                                        key,
+                                        serverModifiedAt: err.serverModifiedAt,
+                                        localModifiedAt: expectedModifiedAt || "unknown",
+                                    });
+                                }
+                                else {
+                                    throw wrapEntityError(err, "update", "prompt", key);
                                 }
                             }
                         }
@@ -795,29 +2017,70 @@ Directory Structure:
                         const firstConfig = configs[0] || {};
                         changes.push({ type: "prompt", action: "create", key });
                         if (!options.dryRun) {
-                            const created = await client.createPrompt(resolvedAppId, {
-                                promptKey: key,
-                                displayName: prompt.displayName || key,
-                                description: prompt.description,
-                                provider: firstConfig.provider || "openrouter",
-                                model: firstConfig.model || "google/gemini-2.0-flash-001",
-                                systemPrompt: firstConfig.systemPrompt,
-                                userPromptTemplate: firstConfig.userPromptTemplate || "{{ input }}",
-                                temperature: firstConfig.temperature,
-                                maxTokens: firstConfig.maxTokens,
-                                outputFormat: firstConfig.outputFormat,
-                                inputSchema: prompt.inputSchema,
-                            });
-                            info(`  Created prompt: ${key}`);
-                            // Add new entity to sync state
-                            if (syncState && created?.promptId && created?.modifiedAt) {
-                                if (!syncState.entities.prompts) {
-                                    syncState.entities.prompts = {};
-                                }
-                                syncState.entities.prompts[key] = {
-                                    id: created.promptId,
-                                    modifiedAt: created.modifiedAt,
-                                };
+                            try {
+                                const created = await client.createPrompt(resolvedAppId, {
+                                    promptKey: key,
+                                    displayName: prompt.displayName || key,
+                                    description: prompt.description,
+                                    provider: firstConfig.provider || "openrouter",
+                                    model: firstConfig.model || "google/gemini-2.0-flash-001",
+                                    systemPrompt: firstConfig.systemPrompt,
+                                    userPromptTemplate: firstConfig.userPromptTemplate || "{{ input }}",
+                                    temperature: firstConfig.temperature,
+                                    maxTokens: firstConfig.maxTokens,
+                                    outputFormat: firstConfig.outputFormat,
+                                    inputSchema: prompt.inputSchema,
+                                });
+                                info(`  Created prompt: ${key}`);
+                                // Add new entity to sync state
+                                if (syncState && created?.promptId && created?.modifiedAt) {
+                                    if (!syncState.entities.prompts) {
+                                        syncState.entities.prompts = {};
+                                    }
+                                    syncState.entities.prompts[key] = {
+                                        id: created.promptId,
+                                        modifiedAt: created.modifiedAt,
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                                // Track prompt key→ID and config name→ID
+                                if (created?.promptId) {
+                                    promptKeyToId.set(key, created.promptId);
+                                }
+                                if (created?.configs) {
+                                    for (const config of created.configs) {
+                                        promptConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                    }
+                                }
+                                // Create additional configs (configs[1..n]) that weren't included in the initial create
+                                if (created?.promptId && configs.length > 1) {
+                                    for (let i = 1; i < configs.length; i++) {
+                                        const extraConfig = configs[i];
+                                        const extraCreated = await client.createPromptConfig(resolvedAppId, created.promptId, {
+                                            configName: extraConfig.name || `config-${i + 1}`,
+                                            description: extraConfig.description,
+                                            provider: extraConfig.provider || firstConfig.provider || "openrouter",
+                                            model: extraConfig.model || firstConfig.model || "google/gemini-2.0-flash-001",
+                                            systemPrompt: extraConfig.systemPrompt,
+                                            userPromptTemplate: extraConfig.userPromptTemplate,
+                                            temperature: extraConfig.temperature,
+                                            maxTokens: extraConfig.maxTokens,
+                                            outputFormat: extraConfig.outputFormat,
+                                        });
+                                        if (extraCreated?.configId) {
+                                            const configName = extraConfig.name || `config-${i + 1}`;
+                                            promptConfigNameToId.set(`${key}#${configName}`, extraCreated.configId);
+                                        }
+                                        // Activate this config if it was the active one
+                                        if (extraConfig.isActive && extraCreated?.configId) {
+                                            await client.activatePromptConfig(resolvedAppId, created.promptId, extraCreated.configId);
+                                        }
+                                    }
+                                    info(`    Created ${configs.length - 1} additional config(s) for prompt: ${key}`);
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "prompt", key);
                             }
                         }
                     }
@@ -830,11 +2093,40 @@ Directory Structure:
                 for (const file of files) {
                     const filePath = join(workflowsDir, file);
                     const tomlData = parseTomlFile(filePath);
+                    // Issue #685: reject misnested headers (e.g.
+                    // [steps.<id>.request]) before pushing. The runtime silently
+                    // ignores fields outside the allowlist, so this is the only
+                    // place to catch the footgun. Validation happens BEFORE the
+                    // skip-if-unchanged check so a previously-pushed-but-broken
+                    // file gets a clear diagnostic on every push attempt.
+                    const tomlErrors = validateWorkflowToml(tomlData);
+                    if (tomlErrors.length > 0) {
+                        error(formatWorkflowTomlErrors(filePath, tomlErrors));
+                        process.exit(1);
+                    }
                     const workflow = tomlData.workflow || {};
                     const key = workflow.key || basename(file, ".toml");
                     const steps = tomlData.steps || [];
                     const existingId = syncState?.entities?.workflows?.[key]?.id;
                     const existingActiveConfigId = syncState?.entities?.workflows?.[key]?.activeConfigId;
+                    // Skip if file hasn't changed since last sync. Use the expanded
+                    // content hash (post fragment splice) so that edits to included
+                    // `workflow-fragments/*.toml` files invalidate the push-skip cache
+                    // for any workflow that references them. See `computeExpandedContentHash`.
+                    if (!options.force && existingId && !shouldPushExpandedFile(tomlData, syncState?.entities?.workflows?.[key]?.contentHash)) {
+                        skippedCount++;
+                        // Only fetch config name→ID mappings if test cases exist for this workflow
+                        const workflowTestsDir = getTestsDir(configDir, "workflow", key);
+                        if (!options.dryRun && existsSync(workflowTestsDir)) {
+                            const fullWorkflow = await client.getWorkflow(resolvedAppId, existingId);
+                            if (fullWorkflow?.configs) {
+                                for (const config of fullWorkflow.configs) {
+                                    workflowConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                }
+                            }
+                        }
+                        continue;
+                    }
                     if (existingId) {
                         // Update existing workflow
                         changes.push({ type: "workflow", action: "update", key });
@@ -848,13 +2140,17 @@ Directory Structure:
                                     name: workflow.name,
                                     description: workflow.description,
                                     status: workflow.status,
+                                    accessRule: workflow.accessRule !== undefined ? (workflow.accessRule || null) : undefined,
                                     perUserMaxRunning: workflow.perUserMaxRunning,
                                     perUserMaxQueued: workflow.perUserMaxQueued,
                                     dequeueOrder: workflow.dequeueOrder,
-                                    inputSchema: workflow.inputSchema ? JSON.parse(workflow.inputSchema) : null,
-                                    outputSchema: workflow.outputSchema ? JSON.parse(workflow.outputSchema) : null,
+                                    inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
+                                    outputSchema: workflow.outputSchema ? safeJsonParse(workflow.outputSchema) : null,
                                 }, expectedModifiedAt);
-                                // Update active configuration steps (or draft for legacy)
+                                // Update active configuration steps (or draft for legacy).
+                                // Issue #687: name the slot we touched so the dev-loop
+                                // user can confirm before previewing.
+                                let updateSlotLabel = "active config";
                                 if (existingActiveConfigId) {
                                     await client.updateWorkflowConfig(resolvedAppId, existingId, existingActiveConfigId, {
                                         steps,
@@ -864,13 +2160,24 @@ Directory Structure:
                                     // Fallback to draft update for legacy workflows
                                     await client.updateWorkflowDraft(resolvedAppId, existingId, {
                                         steps,
-                                        inputSchema: workflow.inputSchema ? JSON.parse(workflow.inputSchema) : null,
+                                        inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : null,
                                     });
+                                    updateSlotLabel = "draft (legacy)";
                                 }
-                                info(`  Updated workflow: ${key}`);
-                                // Update sync state with new modifiedAt
+                                info(`  Updated workflow: ${key} (${updateSlotLabel})`);
+                                // Update sync state with new modifiedAt. Store the *expanded*
+                                // content hash so future fragment-only edits are detected.
                                 if (syncState?.entities?.workflows?.[key] && updated?.workflow?.modifiedAt) {
                                     syncState.entities.workflows[key].modifiedAt = updated.workflow.modifiedAt;
+                                    syncState.entities.workflows[key].contentHash = computeExpandedContentHash(tomlData);
+                                }
+                                // Fetch full workflow to get config name→ID mappings
+                                // (updateWorkflow response doesn't include configs)
+                                const fullWorkflow = await client.getWorkflow(resolvedAppId, existingId);
+                                if (fullWorkflow?.configs) {
+                                    for (const config of fullWorkflow.configs) {
+                                        workflowConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                    }
                                 }
                             }
                             catch (err) {
@@ -883,7 +2190,7 @@ Directory Structure:
                                     });
                                 }
                                 else {
-                                    throw err;
+                                    throw wrapEntityError(err, "update", "workflow", key);
                                 }
                             }
                         }
@@ -892,34 +2199,589 @@ Directory Structure:
                         // Create new workflow (automatically creates default config)
                         changes.push({ type: "workflow", action: "create", key });
                         if (!options.dryRun) {
-                            const created = await client.createWorkflow(resolvedAppId, {
-                                workflowKey: key,
-                                name: workflow.name || key,
-                                description: workflow.description,
-                                steps,
-                                inputSchema: workflow.inputSchema ? JSON.parse(workflow.inputSchema) : undefined,
-                                outputSchema: workflow.outputSchema ? JSON.parse(workflow.outputSchema) : undefined,
-                                perUserMaxRunning: workflow.perUserMaxRunning,
-                                perUserMaxQueued: workflow.perUserMaxQueued,
-                                dequeueOrder: workflow.dequeueOrder,
-                            });
-                            info(`  Created workflow: ${key}`);
-                            // Add new entity to sync state (including activeConfigId)
-                            if (syncState && created?.workflow?.workflowId && created?.workflow?.modifiedAt) {
-                                if (!syncState.entities.workflows) {
-                                    syncState.entities.workflows = {};
-                                }
-                                syncState.entities.workflows[key] = {
-                                    id: created.workflow.workflowId,
-                                    modifiedAt: created.workflow.modifiedAt,
-                                    activeConfigId: created.workflow.activeConfigId,
+                            try {
+                                const created = await client.createWorkflow(resolvedAppId, {
+                                    workflowKey: key,
+                                    name: workflow.name || key,
+                                    description: workflow.description,
+                                    steps,
+                                    inputSchema: workflow.inputSchema ? safeJsonParse(workflow.inputSchema) : undefined,
+                                    outputSchema: workflow.outputSchema ? safeJsonParse(workflow.outputSchema) : undefined,
+                                    accessRule: workflow.accessRule || undefined,
+                                    perUserMaxRunning: workflow.perUserMaxRunning,
+                                    perUserMaxQueued: workflow.perUserMaxQueued,
+                                    dequeueOrder: workflow.dequeueOrder,
+                                });
+                                info(`  Created workflow: ${key}`);
+                                // Add new entity to sync state (including activeConfigId)
+                                if (syncState && created?.workflow?.workflowId && created?.workflow?.modifiedAt) {
+                                    if (!syncState.entities.workflows) {
+                                        syncState.entities.workflows = {};
+                                    }
+                                    syncState.entities.workflows[key] = {
+                                        id: created.workflow.workflowId,
+                                        modifiedAt: created.workflow.modifiedAt,
+                                        activeConfigId: created.workflow.activeConfigId,
+                                        contentHash: computeExpandedContentHash(tomlData),
+                                    };
+                                }
+                                // Track config name→ID mappings
+                                if (created?.configs) {
+                                    for (const config of created.configs) {
+                                        workflowConfigNameToId.set(`${key}#${config.configName}`, config.configId);
+                                    }
+                                }
+                                const workflowId = created?.workflow?.workflowId;
+                                const tomlConfigs = tomlData.configs || [];
+                                // Create additional workflow configs (configs[1..n]) beyond the default
+                                if (workflowId && tomlConfigs.length > 1) {
+                                    for (let i = 1; i < tomlConfigs.length; i++) {
+                                        const extraConfig = tomlConfigs[i];
+                                        const extraCreated = await client.createWorkflowConfig(resolvedAppId, workflowId, {
+                                            configName: extraConfig.name || `config-${i + 1}`,
+                                            description: extraConfig.description,
+                                            steps,
+                                        });
+                                        if (extraCreated?.configId) {
+                                            const configName = extraConfig.name || `config-${i + 1}`;
+                                            workflowConfigNameToId.set(`${key}#${configName}`, extraCreated.configId);
+                                        }
+                                    }
+                                    info(`    Created ${tomlConfigs.length - 1} additional config(s) for workflow: ${key}`);
+                                }
+                                // Activate the correct config based on activeConfigName from TOML
+                                if (workflowId && workflow.activeConfigName) {
+                                    const activeConfigId = workflowConfigNameToId.get(`${key}#${workflow.activeConfigName}`);
+                                    if (activeConfigId && activeConfigId !== created?.workflow?.activeConfigId) {
+                                        await client.activateWorkflowConfig(resolvedAppId, workflowId, activeConfigId);
+                                        info(`    Activated config "${workflow.activeConfigName}" for workflow: ${key}`);
+                                    }
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "workflow", key);
+                            }
+                        }
+                    }
+                }
+            }
+            // Process database types
+            const dbTypesDir = join(configDir, "database-types");
+            if (existsSync(dbTypesDir)) {
+                const files = readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(dbTypesDir, file);
+                    const rawToml = readFileSync(filePath, "utf-8");
+                    const tomlData = parseTomlFile(filePath);
+                    const { typeConfig, operations } = parseDatabaseTypeToml(tomlData);
+                    const dbType = typeConfig.databaseType || basename(file, ".toml");
+                    // Resolve ruleSetName → ruleSetId if using key-based reference
+                    resolveRuleSetReference(typeConfig, ruleSetNameToId, `database type ${dbType}`);
+                    // $params validator (issue #752): every `$params.X` reference
+                    // inside `definition` must correspond to a declared param in
+                    // `[[operations.params]]`. Catches typos like `$params.proectId`
+                    // at push time with the TOML file:line of the offending op block.
+                    const validation = validateOperations({
+                        filePath,
+                        rawToml,
+                        operations,
+                    });
+                    for (const w of validation.warnings) {
+                        warn(`  ${formatIssue(w)}`);
+                    }
+                    if (validation.errors.length > 0) {
+                        for (const e of validation.errors) {
+                            error(`  ${formatIssue(e)}`);
+                        }
+                        error(`Aborting push: ${validation.errors.length} unresolved $params reference(s) in ${file}.`);
+                        process.exit(1);
+                    }
+                    const existingEntry = syncState?.entities?.databaseTypes?.[dbType];
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    if (existingEntry) {
+                        // Update existing type config — only if there are type-level fields to update.
+                        // Operations are handled separately below, so skipping the PATCH here when
+                        // updateData is empty avoids sending an empty body (which the server rejects
+                        // with HTTP 400).
+                        if (!options.dryRun) {
+                            const expectedModifiedAt = options.force
+                                ? undefined
+                                : existingEntry.modifiedAt;
+                            try {
+                                const updateData = {};
+                                if ("ruleSetId" in typeConfig)
+                                    updateData.ruleSetId = typeConfig.ruleSetId || null;
+                                if ("triggers" in typeConfig)
+                                    updateData.triggers = typeConfig.triggers || null;
+                                if ("metadataAccess" in typeConfig)
+                                    updateData.metadataAccess = typeConfig.metadataAccess || null;
+                                if ("defaultAccess" in typeConfig)
+                                    updateData.defaultAccess = typeConfig.defaultAccess || null;
+                                if ("autoPopulatedFields" in typeConfig) {
+                                    updateData.autoPopulatedFields =
+                                        typeConfig.autoPopulatedFields || null;
+                                }
+                                // Issue #666: forward `schema` when the local TOML declares
+                                // one (a set/update), OR when the server had one at last
+                                // sync and the local file no longer does (a deletion —
+                                // `schema: null` clears it server-side; codex review gap on
+                                // PR #766). When the type never had a schema and still
+                                // doesn't, omit it so an operations-only edit doesn't
+                                // register as an empty type-level update (issue #369).
+                                const localHasSchema = typeof typeConfig.schema === "string" &&
+                                    typeConfig.schema.trim().length > 0;
+                                if (localHasSchema) {
+                                    updateData.schema = typeConfig.schema;
+                                }
+                                else if (existingEntry.hasSchema) {
+                                    updateData.schema = null;
+                                }
+                                if (Object.keys(updateData).length > 0) {
+                                    changes.push({ type: "database-type", action: "update", key: dbType });
+                                    const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {
+                                        dryRun: !!options.dryRun,
+                                        acceptWarnings: !!options.acceptWarnings,
+                                    });
+                                    info(`  Updated database type: ${dbType}`);
+                                    if (syncState?.entities?.databaseTypes?.[dbType] && updated?.modifiedAt) {
+                                        syncState.entities.databaseTypes[dbType].modifiedAt = updated.modifiedAt;
+                                        syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                                        syncState.entities.databaseTypes[dbType].hasSchema =
+                                            "schema" in updateData
+                                                ? updateData.schema !== null
+                                                : syncState.entities.databaseTypes[dbType].hasSchema;
+                                    }
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError) {
+                                    conflicts.push({
+                                        type: "database-type",
+                                        key: dbType,
+                                        serverModifiedAt: err.serverModifiedAt,
+                                        localModifiedAt: expectedModifiedAt || "unknown",
+                                    });
+                                }
+                                else if (err instanceof SchemaBreaksOpsError) {
+                                    schemaErrors.schemaBreaks.push({
+                                        type: "database-type",
+                                        key: dbType,
+                                        operations: err.operations,
+                                        message: err.message,
+                                    });
+                                }
+                                else if (err instanceof SchemaHasUncheckableOpsError) {
+                                    schemaErrors.uncheckableOps.push({
+                                        type: "database-type",
+                                        key: dbType,
+                                        operations: err.operations,
+                                        message: err.message,
+                                    });
+                                }
+                                else if (err instanceof TomlParseError) {
+                                    schemaErrors.tomlParse.push({
+                                        type: "database-type",
+                                        key: dbType,
+                                        line: err.line,
+                                        column: err.column,
+                                        message: err.message,
+                                    });
+                                }
+                                else if (err instanceof OpsExistError) {
+                                    schemaErrors.opsExist.push({
+                                        type: "database-type",
+                                        key: dbType,
+                                        opCount: err.opCount,
+                                        message: err.message,
+                                    });
+                                }
+                                else {
+                                    throw wrapEntityError(err, "update", "database type", dbType);
+                                }
+                            }
+                        }
+                        else {
+                            // In dry-run mode, still report the change iff we would actually PATCH.
+                            const wouldUpdate = "ruleSetId" in typeConfig ||
+                                "triggers" in typeConfig ||
+                                "metadataAccess" in typeConfig ||
+                                "defaultAccess" in typeConfig ||
+                                "autoPopulatedFields" in typeConfig ||
+                                "schema" in typeConfig;
+                            if (wouldUpdate) {
+                                changes.push({ type: "database-type", action: "update", key: dbType });
+                            }
+                        }
+                    }
+                    else {
+                        // Create new type config
+                        changes.push({ type: "database-type", action: "create", key: dbType });
+                        if (!options.dryRun) {
+                            const createData = {
+                                databaseType: dbType,
+                            };
+                            if (typeConfig.ruleSetId)
+                                createData.ruleSetId = typeConfig.ruleSetId;
+                            if (typeConfig.triggers)
+                                createData.triggers = typeConfig.triggers;
+                            if (typeConfig.metadataAccess)
+                                createData.metadataAccess = typeConfig.metadataAccess;
+                            if (typeConfig.defaultAccess)
+                                createData.defaultAccess = typeConfig.defaultAccess;
+                            if (typeConfig.autoPopulatedFields)
+                                createData.autoPopulatedFields = typeConfig.autoPopulatedFields;
+                            // Issue #666 addendum A2: forward `schema` on POST so a
+                            // single sync push can land both the type + its schema in
+                            // one round-trip (instead of POST → PATCH). The op-edit gate
+                            // itself no longer requires a schema on a fresh type, but
+                            // landing the schema up front keeps subsequent op-pushes
+                            // validating against the intended shape.
+                            if (typeConfig.schema)
+                                createData.schema = typeConfig.schema;
+                            try {
+                                const created = await client.createDatabaseTypeConfig(resolvedAppId, createData);
+                                info(`  Created database type: ${dbType}`);
+                                if (syncState) {
+                                    if (!syncState.entities.databaseTypes) {
+                                        syncState.entities.databaseTypes = {};
+                                    }
+                                    syncState.entities.databaseTypes[dbType] = {
+                                        databaseType: dbType,
+                                        modifiedAt: created?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                        hasSchema: !!createData.schema,
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "database type", dbType);
+                            }
+                        }
+                    }
+                    // Process operations for this type
+                    const existingOps = existingEntry?.operations || {};
+                    const tomlOpNames = new Set(operations.map((op) => op.name));
+                    for (const op of operations) {
+                        const existingOp = existingOps[op.name];
+                        if (existingOp) {
+                            // Update existing operation
+                            changes.push({ type: "operation", action: "update", key: `${dbType}/${op.name}` });
+                            if (!options.dryRun) {
+                                const expectedOpModifiedAt = options.force
+                                    ? undefined
+                                    : existingOp.modifiedAt;
+                                try {
+                                    const updated = await client.updateDatabaseTypeOperation(resolvedAppId, dbType, op.name, {
+                                        // Include `type` so the server can detect/apply
+                                        // type-in-place changes (issue #692). When the type
+                                        // matches the stored value, this is a no-op.
+                                        type: op.type,
+                                        modelName: op.modelName,
+                                        access: op.access,
+                                        definition: op.definition,
+                                        params: op.params,
+                                    }, expectedOpModifiedAt);
+                                    info(`  Updated operation: ${dbType}/${op.name}`);
+                                    if (syncState?.entities?.databaseTypes?.[dbType]?.operations?.[op.name] && updated?.modifiedAt) {
+                                        syncState.entities.databaseTypes[dbType].operations[op.name].modifiedAt = updated.modifiedAt;
+                                    }
+                                }
+                                catch (err) {
+                                    if (err instanceof ConflictError) {
+                                        conflicts.push({
+                                            type: "operation",
+                                            key: `${dbType}/${op.name}`,
+                                            serverModifiedAt: err.serverModifiedAt,
+                                            localModifiedAt: expectedOpModifiedAt || "unknown",
+                                        });
+                                    }
+                                    else if (err instanceof SchemaRequiredError) {
+                                        schemaErrors.schemaRequired.push({
+                                            type: "operation",
+                                            key: `${dbType}/${op.name}`,
+                                            message: err.message,
+                                        });
+                                    }
+                                    else if (err instanceof OperationRefError) {
+                                        schemaErrors.opRefs.push({
+                                            type: "operation",
+                                            key: `${dbType}/${op.name}`,
+                                            refs: err.refs,
+                                            message: err.message,
+                                        });
+                                    }
+                                    else {
+                                        throw wrapEntityError(err, "update", "operation", `${dbType}/${op.name}`);
+                                    }
+                                }
+                            }
+                        }
+                        else {
+                            // Create new operation
+                            changes.push({ type: "operation", action: "create", key: `${dbType}/${op.name}` });
+                            if (!options.dryRun) {
+                                try {
+                                    const created = await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
+                                        name: op.name,
+                                        type: op.type,
+                                        modelName: op.modelName,
+                                        access: op.access,
+                                        definition: op.definition,
+                                        params: op.params,
+                                    });
+                                    info(`  Created operation: ${dbType}/${op.name}`);
+                                    if (syncState?.entities?.databaseTypes?.[dbType]) {
+                                        if (!syncState.entities.databaseTypes[dbType].operations) {
+                                            syncState.entities.databaseTypes[dbType].operations = {};
+                                        }
+                                        syncState.entities.databaseTypes[dbType].operations[op.name] = {
+                                            modifiedAt: created?.modifiedAt || new Date().toISOString(),
+                                        };
+                                    }
+                                }
+                                catch (err) {
+                                    if (err instanceof SchemaRequiredError) {
+                                        schemaErrors.schemaRequired.push({
+                                            type: "operation",
+                                            key: `${dbType}/${op.name}`,
+                                            message: err.message,
+                                        });
+                                    }
+                                    else if (err instanceof OperationRefError) {
+                                        schemaErrors.opRefs.push({
+                                            type: "operation",
+                                            key: `${dbType}/${op.name}`,
+                                            refs: err.refs,
+                                            message: err.message,
+                                        });
+                                    }
+                                    else {
+                                        throw wrapEntityError(err, "create", "operation", `${dbType}/${op.name}`);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    // Delete operations that were removed from TOML
+                    for (const existingOpName of Object.keys(existingOps)) {
+                        if (!tomlOpNames.has(existingOpName)) {
+                            changes.push({ type: "operation", action: "delete", key: `${dbType}/${existingOpName}` });
+                            if (!options.dryRun) {
+                                try {
+                                    await client.deleteDatabaseTypeOperation(resolvedAppId, dbType, existingOpName);
+                                    info(`  Deleted operation: ${dbType}/${existingOpName}`);
+                                    if (syncState?.entities?.databaseTypes?.[dbType]?.operations) {
+                                        delete syncState.entities.databaseTypes[dbType].operations[existingOpName];
+                                    }
+                                }
+                                catch (err) {
+                                    throw wrapEntityError(err, "delete", "operation", `${dbType}/${existingOpName}`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Process group type configs
+            const groupTypeConfigsDir = join(configDir, "group-type-configs");
+            if (existsSync(groupTypeConfigsDir)) {
+                const files = readdirSync(groupTypeConfigsDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(groupTypeConfigsDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const configData = parseGroupTypeConfigToml(tomlData);
+                    const groupType = configData.groupType || basename(file, ".toml");
+                    // Resolve ruleSetName → ruleSetId if using key-based reference
+                    resolveRuleSetReference(configData, ruleSetNameToId, `group type ${groupType}`);
+                    const existingEntry = syncState?.entities?.groupTypeConfigs?.[groupType];
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    if (existingEntry) {
+                        // Update existing group type config
+                        changes.push({ type: "group-type-config", action: "update", key: groupType });
+                        if (!options.dryRun) {
+                            const expectedModifiedAt = options.force
+                                ? undefined
+                                : existingEntry.modifiedAt;
+                            try {
+                                const updated = await client.updateGroupTypeConfig(resolvedAppId, groupType, {
+                                    ruleSetId: configData.ruleSetId,
+                                    autoAddCreator: configData.autoAddCreator,
+                                }, expectedModifiedAt);
+                                info(`  Updated group type config: ${groupType}`);
+                                if (syncState?.entities?.groupTypeConfigs?.[groupType] && updated?.modifiedAt) {
+                                    syncState.entities.groupTypeConfigs[groupType].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.groupTypeConfigs[groupType].contentHash = computeFileHash(filePath);
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError) {
+                                    conflicts.push({
+                                        type: "group-type-config",
+                                        key: groupType,
+                                        serverModifiedAt: err.serverModifiedAt,
+                                        localModifiedAt: expectedModifiedAt || "unknown",
+                                    });
+                                }
+                                else {
+                                    throw wrapEntityError(err, "update", "group type config", groupType);
+                                }
+                            }
+                        }
+                    }
+                    else {
+                        // Create new group type config
+                        changes.push({ type: "group-type-config", action: "create", key: groupType });
+                        if (!options.dryRun) {
+                            try {
+                                const created = await client.createGroupTypeConfig(resolvedAppId, {
+                                    groupType,
+                                    ruleSetId: configData.ruleSetId || undefined,
+                                    autoAddCreator: configData.autoAddCreator,
+                                });
+                                info(`  Created group type config: ${groupType}`);
+                                if (syncState) {
+                                    if (!syncState.entities.groupTypeConfigs) {
+                                        syncState.entities.groupTypeConfigs = {};
+                                    }
+                                    syncState.entities.groupTypeConfigs[groupType] = {
+                                        modifiedAt: created?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "group type config", groupType);
+                            }
+                        }
+                    }
+                }
+            }
+            // Process collection type configs
+            const collectionTypeConfigsDir = join(configDir, "collection-type-configs");
+            if (existsSync(collectionTypeConfigsDir)) {
+                const files = readdirSync(collectionTypeConfigsDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(collectionTypeConfigsDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const configData = parseCollectionTypeConfigToml(tomlData);
+                    const collectionType = configData.collectionType || basename(file, ".toml");
+                    // Resolve ruleSetName → ruleSetId if using key-based reference
+                    resolveRuleSetReference(configData, ruleSetNameToId, `collection type ${collectionType}`);
+                    const existingEntry = syncState?.entities?.collectionTypeConfigs?.[collectionType];
+                    // Skip if file hasn't changed since last sync
+                    if (!options.force && existingEntry && !shouldPushFile(filePath, existingEntry.contentHash)) {
+                        skippedCount++;
+                        continue;
+                    }
+                    if (existingEntry) {
+                        // Update existing collection type config
+                        changes.push({ type: "collection-type-config", action: "update", key: collectionType });
+                        if (!options.dryRun) {
+                            const expectedModifiedAt = options.force
+                                ? undefined
+                                : existingEntry.modifiedAt;
+                            try {
+                                const updated = await client.updateCollectionTypeConfig(resolvedAppId, collectionType, {
+                                    ruleSetId: configData.ruleSetId ?? null,
+                                }, expectedModifiedAt);
+                                info(`  Updated collection type config: ${collectionType}`);
+                                if (syncState?.entities?.collectionTypeConfigs?.[collectionType] && updated?.modifiedAt) {
+                                    syncState.entities.collectionTypeConfigs[collectionType].modifiedAt = updated.modifiedAt;
+                                    syncState.entities.collectionTypeConfigs[collectionType].contentHash = computeFileHash(filePath);
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof ConflictError) {
+                                    conflicts.push({
+                                        type: "collection-type-config",
+                                        key: collectionType,
+                                        serverModifiedAt: err.serverModifiedAt,
+                                        localModifiedAt: expectedModifiedAt || "unknown",
+                                    });
+                                }
+                                else {
+                                    throw wrapEntityError(err, "update", "collection type config", collectionType);
+                                }
+                            }
+                        }
+                    }
+                    else {
+                        // Create new collection type config
+                        changes.push({ type: "collection-type-config", action: "create", key: collectionType });
+                        if (!options.dryRun) {
+                            try {
+                                const created = await client.createCollectionTypeConfig(resolvedAppId, {
+                                    collectionType,
+                                    ruleSetId: configData.ruleSetId || undefined,
+                                });
+                                info(`  Created collection type config: ${collectionType}`);
+                                if (syncState) {
+                                    if (!syncState.entities.collectionTypeConfigs) {
+                                        syncState.entities.collectionTypeConfigs = {};
+                                    }
+                                    syncState.entities.collectionTypeConfigs[collectionType] = {
+                                        modifiedAt: created?.modifiedAt || new Date().toISOString(),
+                                        contentHash: computeFileHash(filePath),
+                                    };
+                                }
+                            }
+                            catch (err) {
+                                throw wrapEntityError(err, "create", "collection type config", collectionType);
+                            }
+                        }
+                    }
+                }
+            }
+            // Process email templates
+            const emailTemplatesDir = join(configDir, "email-templates");
+            if (existsSync(emailTemplatesDir)) {
+                const files = readdirSync(emailTemplatesDir).filter((f) => f.endsWith(".toml"));
+                for (const file of files) {
+                    const filePath = join(emailTemplatesDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const template = tomlData.template || {};
+                    const emailType = template.emailType || basename(file, ".toml");
+                    const payload = {
+                        subject: template.subject || "",
+                        htmlBody: template.htmlBody || "",
+                        textBody: template.textBody || "",
+                    };
+                    changes.push({ type: "email-template", action: "update", key: emailType });
+                    if (!options.dryRun) {
+                        try {
+                            const result = await client.upsertEmailTemplate(resolvedAppId, emailType, payload);
+                            info(`  Updated email template: ${emailType}`);
+                            // Update sync state
+                            if (syncState) {
+                                if (!syncState.entities.emailTemplates) {
+                                    syncState.entities.emailTemplates = {};
+                                }
+                                syncState.entities.emailTemplates[emailType] = {
+                                    id: emailType,
+                                    modifiedAt: result?.modifiedAt || new Date().toISOString(),
                                 };
                             }
                         }
+                        catch (err) {
+                            warn(`  Failed to update email template ${emailType}: ${err.message}`);
+                        }
                     }
                 }
             }
             // Push test cases for prompts and workflows
+            const pushMaps = {
+                promptKeyToId,
+                promptConfigNameToId,
+                workflowConfigNameToId,
+            };
             const promptsDir2 = join(configDir, "prompts");
             if (existsSync(promptsDir2)) {
                 for (const file of readdirSync(promptsDir2).filter((f) => f.endsWith(".toml"))) {
@@ -927,7 +2789,7 @@ Directory Structure:
                     const promptKey = tomlData.prompt?.key || basename(file, ".toml");
                     const blockId = syncState?.entities?.prompts?.[promptKey]?.id;
                     if (blockId) {
-                        await pushTestCasesForBlock(client, resolvedAppId, "prompt", blockId, promptKey, configDir, syncState, options.dryRun, changes);
+                        skippedCount += await pushTestCasesForBlock(client, resolvedAppId, "prompt", blockId, promptKey, configDir, syncState, options.dryRun, changes, pushMaps, { force: options.force });
                     }
                 }
             }
@@ -938,7 +2800,7 @@ Directory Structure:
                     const workflowKey = tomlData.workflow?.key || basename(file, ".toml");
                     const blockId = syncState?.entities?.workflows?.[workflowKey]?.id;
                     if (blockId) {
-                        await pushTestCasesForBlock(client, resolvedAppId, "workflow", blockId, workflowKey, configDir, syncState, options.dryRun, changes);
+                        skippedCount += await pushTestCasesForBlock(client, resolvedAppId, "workflow", blockId, workflowKey, configDir, syncState, options.dryRun, changes, pushMaps, { force: options.force });
                     }
                 }
             }
@@ -953,33 +2815,118 @@ Directory Structure:
                     console.log(`  ${color(change.action)} ${change.type}: ${change.key}`);
                 }
             }
-            else if (conflicts.length > 0) {
+            else if (conflicts.length > 0 ||
+                schemaErrors.schemaRequired.length > 0 ||
+                schemaErrors.opRefs.length > 0 ||
+                schemaErrors.schemaBreaks.length > 0 ||
+                schemaErrors.uncheckableOps.length > 0 ||
+                schemaErrors.tomlParse.length > 0 ||
+                schemaErrors.opsExist.length > 0) {
                 // Handle conflicts
-                console.log();
-                warn(`${conflicts.length} conflict(s) detected:`);
-                console.log();
-                for (const conflict of conflicts) {
-                    console.log(`  ${chalk.red("CONFLICT")} ${conflict.type}: ${chalk.bold(conflict.key)}`);
-                    console.log(`    Local last sync: ${chalk.dim(conflict.localModifiedAt)}`);
-                    console.log(`    Server modified: ${chalk.yellow(conflict.serverModifiedAt)}`);
+                if (conflicts.length > 0) {
+                    console.log();
+                    warn(`${conflicts.length} conflict(s) detected:`);
+                    console.log();
+                    for (const conflict of conflicts) {
+                        console.log(`  ${chalk.red("CONFLICT")} ${conflict.type}: ${chalk.bold(conflict.key)}`);
+                        console.log(`    Local last sync: ${chalk.dim(conflict.localModifiedAt)}`);
+                        console.log(`    Server modified: ${chalk.yellow(conflict.serverModifiedAt)}`);
+                    }
+                    console.log();
+                    warn("These entities were modified on the server since your last pull.");
+                    info("Options:");
+                    console.log(`  1. Run ${chalk.cyan("primitive sync pull")} to get latest changes`);
+                    console.log(`  2. Run ${chalk.cyan("primitive sync push --force")} to overwrite server`);
+                    console.log();
+                }
+                // Report schema-feature errors (issue #666).
+                if (schemaErrors.schemaRequired.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.schemaRequired.length} operation push(es) blocked: type has no schema set.`);
+                    for (const e of schemaErrors.schemaRequired) {
+                        const type = e.key.split("/")[0];
+                        console.log(`  ${chalk.red("SCHEMA_REQUIRED")} ${e.key}`);
+                        console.log(`    Run ${chalk.cyan(`primitive databases schema generate ${type}`)} to scaffold one, then retry.`);
+                    }
+                    console.log();
+                }
+                if (schemaErrors.opRefs.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.opRefs.length} operation push(es) blocked: unresolved references.`);
+                    for (const e of schemaErrors.opRefs) {
+                        console.log(`  ${chalk.red("OPERATION_REFERENCES_UNDEFINED")} ${e.key}`);
+                        for (const ref of e.refs) {
+                            console.log(`    - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
+                        }
+                    }
+                    console.log();
+                }
+                if (schemaErrors.schemaBreaks.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.schemaBreaks.length} schema push(es) blocked: existing operations would break.`);
+                    for (const e of schemaErrors.schemaBreaks) {
+                        console.log(`  ${chalk.red("SCHEMA_BREAKS_OPERATIONS")} ${e.key}`);
+                        for (const op of e.operations) {
+                            console.log(`    ${chalk.bold(op.operation)}`);
+                            for (const ref of op.refs) {
+                                console.log(`      - ${chalk.yellow(ref.ref)} at ${chalk.dim(ref.location)}`);
+                            }
+                        }
+                    }
+                    console.log();
+                }
+                if (schemaErrors.uncheckableOps.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.uncheckableOps.length} schema push(es) blocked: operations with dynamic refs.`);
+                    for (const e of schemaErrors.uncheckableOps) {
+                        console.log(`  ${chalk.red("SCHEMA_HAS_UNCHECKABLE_OPS")} ${e.key}`);
+                        for (const op of e.operations) {
+                            console.log(`    ${chalk.bold(op.operation)}`);
+                            for (const loc of op.locations) {
+                                console.log(`      - ${chalk.dim(loc)}`);
+                            }
+                        }
+                    }
+                    info(`Re-run with ${chalk.cyan("--accept-warnings")} to commit anyway.`);
+                    console.log();
+                }
+                if (schemaErrors.tomlParse.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.tomlParse.length} TOML parse error(s):`);
+                    for (const e of schemaErrors.tomlParse) {
+                        const loc = e.line ? ` (line ${e.line}${e.column ? `, col ${e.column}` : ""})` : "";
+                        console.log(`  ${chalk.red("TOML_PARSE_ERROR")} ${e.key}${loc}`);
+                        console.log(`    ${e.message}`);
+                    }
+                    console.log();
+                }
+                if (schemaErrors.opsExist.length > 0) {
+                    console.log();
+                    warn(`${schemaErrors.opsExist.length} schema delete(s) blocked: operations still registered.`);
+                    for (const e of schemaErrors.opsExist) {
+                        console.log(`  ${chalk.red("OPS_EXIST")} ${e.key} — ${e.opCount} op(s)`);
+                        console.log(`    Delete or migrate the affected operations before clearing the schema.`);
+                    }
+                    console.log();
                 }
-                console.log();
-                warn("These entities were modified on the server since your last pull.");
-                info("Options:");
-                console.log(`  1. Run ${chalk.cyan("primitive sync pull")} to get latest changes`);
-                console.log(`  2. Run ${chalk.cyan("primitive sync push --force")} to overwrite server`);
-                console.log();
                 // Update sync state for non-conflicting changes
                 if (syncState) {
                     syncState.lastSyncedAt = new Date().toISOString();
                     saveSyncState(configDir, syncState);
                 }
-                const successCount = changes.length - conflicts.length;
+                const totalBlocked = conflicts.length +
+                    schemaErrors.schemaRequired.length +
+                    schemaErrors.opRefs.length +
+                    schemaErrors.schemaBreaks.length +
+                    schemaErrors.uncheckableOps.length +
+                    schemaErrors.tomlParse.length +
+                    schemaErrors.opsExist.length;
+                const successCount = changes.length - totalBlocked;
                 if (successCount > 0) {
-                    success(`Pushed ${successCount} change(s). ${conflicts.length} conflict(s) skipped.`);
+                    success(`Pushed ${successCount} change(s). ${totalBlocked} blocked.`);
                 }
                 else {
-                    error(`Push failed: ${conflicts.length} conflict(s). No changes applied.`);
+                    error(`Push failed: ${totalBlocked} blocked. No changes applied.`);
                 }
                 process.exit(1);
             }
@@ -989,11 +2936,30 @@ Directory Structure:
                     syncState.lastSyncedAt = new Date().toISOString();
                     saveSyncState(configDir, syncState);
                 }
-                success(`Pushed ${changes.length} changes.`);
+                const pushMsg = skippedCount > 0
+                    ? `Pushed ${changes.length} change(s), skipped ${skippedCount} unchanged file(s).`
+                    : `Pushed ${changes.length} changes.`;
+                success(pushMsg);
             }
         }
         catch (err) {
+            // Save sync state even on failure so partial progress is preserved
+            if (syncState) {
+                try {
+                    syncState.lastSyncedAt = new Date().toISOString();
+                    saveSyncState(configDir, syncState);
+                }
+                catch {
+                    // Don't mask the original error
+                }
+            }
             error(err.message);
+            // Print structured server-side validation details (issue #684).
+            if (err instanceof ApiError && Array.isArray(err.details) && err.details.length > 0) {
+                for (const detail of err.details) {
+                    console.error(`    - ${typeof detail === "string" ? detail : JSON.stringify(detail)}`);
+                }
+            }
             process.exit(1);
         }
     });
@@ -1003,10 +2969,16 @@ Directory Structure:
         .description("Show differences between local and remote configuration")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--dir <path>", "Config directory", "./config")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
-        const configDir = options.dir;
+        const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
+        if (isAutoResolvedSyncDir(options.dir)) {
+            info(`Using per-environment sync directory: ${configDir}`);
+            const legacyHint = checkLegacySyncMigration(configDir);
+            if (legacyHint)
+                warn(legacyHint);
+        }
         const client = new ApiClient();
         if (!existsSync(configDir)) {
             error(`Config directory not found: ${configDir}`);
@@ -1016,18 +2988,39 @@ Directory Structure:
         info(`Comparing local configuration with app ${resolvedAppId}...`);
         try {
             // Fetch remote state
-            const [integrationsResult, promptsResult, workflowsResult] = await Promise.all([
-                client.listIntegrations(resolvedAppId, { limit: 100 }),
-                client.listPrompts(resolvedAppId, { limit: 100 }),
-                client.listWorkflows(resolvedAppId, { limit: 100 }),
+            const [integrationItems, promptItems, workflowItems, emailTemplatesResult] = await Promise.all([
+                fetchAll((p) => client.listIntegrations(resolvedAppId, p)),
+                fetchAll((p) => client.listPrompts(resolvedAppId, p)),
+                fetchAll((p) => client.listWorkflows(resolvedAppId, p)),
+                client.listEmailTemplates(resolvedAppId).catch(() => ({ templates: [] })),
             ]);
-            const remoteIntegrations = new Set(integrationsResult.items.map((i) => i.integrationKey));
-            const remotePrompts = new Set(promptsResult.items.map((p) => p.promptKey));
-            const remoteWorkflows = new Set(workflowsResult.items.map((w) => w.workflowKey));
+            const webhookItems = await fetchAll((p) => client.listWebhooks(resolvedAppId, p));
+            let cronTriggerItemsDiff = [];
+            try {
+                const cronResult = await client.listCronTriggers(resolvedAppId);
+                cronTriggerItemsDiff = cronResult.items || [];
+            }
+            catch {
+                // Cron triggers may not be available on older servers
+            }
+            const blobBucketsDiffResult = await client.listBlobBuckets(resolvedAppId).catch(() => ({ items: [] }));
+            const remoteIntegrations = new Set(integrationItems.map((i) => i.integrationKey));
+            const remoteWebhooks = new Set(webhookItems.map((w) => w.webhookKey));
+            const remoteCronTriggers = new Set(cronTriggerItemsDiff.map((t) => t.triggerKey));
+            const remoteBlobBuckets = new Set((blobBucketsDiffResult.items || []).map((b) => b.bucketKey));
+            const remotePrompts = new Set(promptItems.map((p) => p.promptKey));
+            const remoteWorkflows = new Set(workflowItems.map((w) => w.workflowKey));
+            const remoteEmailTemplates = new Set((emailTemplatesResult.templates || [])
+                .filter((t) => t.hasOverride)
+                .map((t) => t.emailType));
             // Get local files
             const localIntegrations = new Set();
+            const localWebhooks = new Set();
+            const localCronTriggers = new Set();
+            const localBlobBuckets = new Set();
             const localPrompts = new Set();
             const localWorkflows = new Set();
+            const localEmailTemplates = new Set();
             const integrationsDir = join(configDir, "integrations");
             if (existsSync(integrationsDir)) {
                 for (const file of readdirSync(integrationsDir).filter((f) => f.endsWith(".toml"))) {
@@ -1036,6 +3029,30 @@ Directory Structure:
                     localIntegrations.add(key);
                 }
             }
+            const webhooksDirPath = join(configDir, "webhooks");
+            if (existsSync(webhooksDirPath)) {
+                for (const file of readdirSync(webhooksDirPath).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(webhooksDirPath, file));
+                    const key = tomlData.webhook?.key || basename(file, ".toml");
+                    localWebhooks.add(key);
+                }
+            }
+            const cronTriggersDirPath = join(configDir, "cron-triggers");
+            if (existsSync(cronTriggersDirPath)) {
+                for (const file of readdirSync(cronTriggersDirPath).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(cronTriggersDirPath, file));
+                    const key = tomlData.cronTrigger?.key || basename(file, ".toml");
+                    localCronTriggers.add(key);
+                }
+            }
+            const blobBucketsDiffDir = join(configDir, "blob-buckets");
+            if (existsSync(blobBucketsDiffDir)) {
+                for (const file of readdirSync(blobBucketsDiffDir).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(blobBucketsDiffDir, file));
+                    const key = tomlData.bucket?.key || basename(file, ".toml");
+                    localBlobBuckets.add(key);
+                }
+            }
             const promptsDir = join(configDir, "prompts");
             if (existsSync(promptsDir)) {
                 for (const file of readdirSync(promptsDir).filter((f) => f.endsWith(".toml"))) {
@@ -1052,6 +3069,14 @@ Directory Structure:
                     localWorkflows.add(key);
                 }
             }
+            const emailTemplatesDirPath = join(configDir, "email-templates");
+            if (existsSync(emailTemplatesDirPath)) {
+                for (const file of readdirSync(emailTemplatesDirPath).filter((f) => f.endsWith(".toml"))) {
+                    const tomlData = parseTomlFile(join(emailTemplatesDirPath, file));
+                    const emailType = tomlData.template?.emailType || basename(file, ".toml");
+                    localEmailTemplates.add(emailType);
+                }
+            }
             // Compare
             const differences = [];
             // Integrations
@@ -1068,6 +3093,48 @@ Directory Structure:
                     differences.push({ type: "integration", key, status: "remote only" });
                 }
             }
+            // Webhooks
+            for (const key of localWebhooks) {
+                if (!remoteWebhooks.has(key)) {
+                    differences.push({ type: "webhook", key, status: "local only" });
+                }
+                else {
+                    differences.push({ type: "webhook", key, status: "exists" });
+                }
+            }
+            for (const key of remoteWebhooks) {
+                if (!localWebhooks.has(key)) {
+                    differences.push({ type: "webhook", key, status: "remote only" });
+                }
+            }
+            // Cron Triggers
+            for (const key of localCronTriggers) {
+                if (!remoteCronTriggers.has(key)) {
+                    differences.push({ type: "cron-trigger", key, status: "local only" });
+                }
+                else {
+                    differences.push({ type: "cron-trigger", key, status: "exists" });
+                }
+            }
+            for (const key of remoteCronTriggers) {
+                if (!localCronTriggers.has(key)) {
+                    differences.push({ type: "cron-trigger", key, status: "remote only" });
+                }
+            }
+            // Blob Buckets
+            for (const key of localBlobBuckets) {
+                if (!remoteBlobBuckets.has(key)) {
+                    differences.push({ type: "blob-bucket", key, status: "local only" });
+                }
+                else {
+                    differences.push({ type: "blob-bucket", key, status: "exists" });
+                }
+            }
+            for (const key of remoteBlobBuckets) {
+                if (!localBlobBuckets.has(key)) {
+                    differences.push({ type: "blob-bucket", key, status: "remote only" });
+                }
+            }
             // Prompts
             for (const key of localPrompts) {
                 if (!remotePrompts.has(key)) {
@@ -1096,6 +3163,20 @@ Directory Structure:
                     differences.push({ type: "workflow", key, status: "remote only" });
                 }
             }
+            // Email Templates
+            for (const key of localEmailTemplates) {
+                if (!remoteEmailTemplates.has(key)) {
+                    differences.push({ type: "email-template", key, status: "local only" });
+                }
+                else {
+                    differences.push({ type: "email-template", key, status: "exists" });
+                }
+            }
+            for (const key of remoteEmailTemplates) {
+                if (!localEmailTemplates.has(key)) {
+                    differences.push({ type: "email-template", key, status: "remote only" });
+                }
+            }
             // Compare test cases for synced prompts and workflows
             const testCaseDiffs = [];
             // Helper to compare test cases for a block
@@ -1133,12 +3214,12 @@ Directory Structure:
                 }
             };
             // Compare test cases for synced blocks
-            for (const p of promptsResult.items) {
+            for (const p of promptItems) {
                 if (localPrompts.has(p.promptKey)) {
                     await compareTestCases("prompt", p.promptId, p.promptKey);
                 }
             }
-            for (const w of workflowsResult.items) {
+            for (const w of workflowItems) {
                 if (localWorkflows.has(w.workflowKey)) {
                     await compareTestCases("workflow", w.workflowId, w.workflowKey);
                 }
@@ -1199,5 +3280,105 @@ Directory Structure:
             process.exit(1);
         }
     });
+    // Migrate-toml (issue #752): bulk-rewrite database-type TOML files from
+    // the legacy JSON-string form for `definition`/`params` to the native
+    // nested-table form. Idempotent: ops already in native form are left as
+    // is; ops that are un-TOMLable (mixed-type arrays, null values) fall
+    // back to JSON-string per field with a log message.
+    sync
+        .command("migrate-toml")
+        .description("Rewrite database-type TOML files to native [operations.definition] / [[operations.params]] form")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
+        .option("--dry-run", "Show what would change without writing files")
+        .action(async (appId, options) => {
+        // Resolve appId so we land in the per-env sync dir even when the user
+        // didn't pass `--dir`. The app ID itself isn't used for any API calls
+        // — `migrate-toml` is a purely local rewrite.
+        const resolvedAppId = resolveAppId(appId, options);
+        const configDir = resolveSyncDir({ appId: resolvedAppId, userDir: options.dir });
+        if (isAutoResolvedSyncDir(options.dir)) {
+            info(`Using per-environment sync directory: ${configDir}`);
+        }
+        if (!existsSync(configDir)) {
+            error(`Config directory not found: ${configDir}`);
+            process.exit(1);
+        }
+        const dbTypesDir = join(configDir, "database-types");
+        if (!existsSync(dbTypesDir)) {
+            info("No database-types/ directory found; nothing to migrate.");
+            return;
+        }
+        const files = readdirSync(dbTypesDir).filter((f) => f.endsWith(".toml"));
+        if (files.length === 0) {
+            info("No database-type TOML files found; nothing to migrate.");
+            return;
+        }
+        // Hydrate ruleSetIdToName from local sync state so files that
+        // reference a rule set via the legacy `ruleSetId = "01..."` form
+        // round-trip with the correct `ruleSetName`. Without this, any user
+        // who runs migrate-toml against a file with a rule-set assignment
+        // would silently lose that reference (review feedback r3246633010).
+        //
+        // Files that use the modern key-based `ruleSetName = "..."` form
+        // don't need the map at all — `parseDatabaseTypeToml` stores the
+        // value in `typeConfig._ruleSetName` and the serializer now prefers
+        // that. The map is only load-bearing for the legacy ID-based form.
+        const ruleSetIdToName = new Map();
+        const migrateSyncState = loadSyncState(configDir);
+        if (migrateSyncState?.entities?.ruleSets) {
+            for (const [fileKey, entry] of Object.entries(migrateSyncState.entities.ruleSets)) {
+                if (entry && typeof entry === "object" && "id" in entry && entry.id) {
+                    // fileKey is the sanitized rule-set name (see sync pull at
+                    // sync.ts:1385). It's the same shape the server returned and
+                    // matches what a TOML file's ruleSetName field would carry.
+                    ruleSetIdToName.set(entry.id, fileKey);
+                }
+            }
+        }
+        let migratedCount = 0;
+        let unchangedCount = 0;
+        for (const file of files) {
+            const filePath = join(dbTypesDir, file);
+            const rawBefore = readFileSync(filePath, "utf-8");
+            const tomlData = parseTomlFile(filePath);
+            const { typeConfig, operations } = parseDatabaseTypeToml(tomlData);
+            // Force-native: ignore existing hints so every TOMLable field
+            // ends up in nested-table form.
+            const rewritten = serializeDatabaseType(typeConfig, operations, ruleSetIdToName, {
+                defaultForm: "native",
+                logger: (msg) => info(`  ${msg}`),
+            });
+            if (rewritten === rawBefore) {
+                unchangedCount++;
+                continue;
+            }
+            if (options.dryRun) {
+                info(`Would migrate database-types/${file}`);
+            }
+            else {
+                writeFileSync(filePath, rewritten);
+                info(`Migrated database-types/${file}`);
+                // Update content hash in sync state if we have an entry for it.
+                const syncState = loadSyncState(configDir);
+                const dbType = typeConfig.databaseType || basename(file, ".toml");
+                if (syncState?.entities?.databaseTypes?.[dbType]) {
+                    syncState.entities.databaseTypes[dbType].contentHash = computeFileHash(filePath);
+                    saveSyncState(configDir, syncState);
+                }
+            }
+            migratedCount++;
+        }
+        divider();
+        keyValue("Migrated", migratedCount);
+        keyValue("Already native (unchanged)", unchangedCount);
+        if (options.dryRun) {
+            info("Dry-run only — no files were modified.");
+        }
+        else if (migratedCount > 0) {
+            success(`Rewrote ${migratedCount} TOML file(s) to native form.`);
+        }
+    });
 }
 //# sourceMappingURL=sync.js.map