primitive-admin 1.1.0-alpha.64 → 1.1.0-alpha.66

package/dist/src/commands/sync.d.ts

@@ -84,15 +84,15 @@ export declare function resolveActiveWorkflowConfig(workflow: any, configs: any[
  *      server's accepted-value canonicalization
  *      (`src/workflows/config/workflow-field-handlers.ts`). A value the server
  *      would REJECT is left alone: push fails loudly for those, so there is
- *      nothing to preview. #2743 — without this, `status = "ACTIVE"` or
+ *      nothing to preview. #2743 — without this, `dequeueOrder = "LIFO"` or
  *      `perUserMaxRunning = 4.9` pushes fine and then reports Modified forever.
  *   4. Fill the model defaults (`WORKFLOW_MODEL_DEFAULTS`) for what the file
  *      omits. `perAppMax*` / `queueTtlSeconds` joined that list in #1177: once
  *      the pull serializer emitted them (a GET always returns them, they carry
  *      a non-null model default), an unchanged workflow hashed unequal to a
  *      local TOML that omits them — a false `modified` that made `config pull`
- *      rewrite the file just to inject defaults. `status` joined it in #2743,
- *      when push began sending `draft` for an omitted status.
+ *      rewrite the file just to inject defaults. (`status` was on this list
+ *      until #2803 took availability off the config wire entirely.)
  *   5. Fill `activeConfigName` with the name the server itself creates
  *      (`default`), so a hand-authored file that never named a config compares
  *      equal to the workflow that pushing it produces (#2743). This is the
@@ -482,23 +482,70 @@ export declare function workflowActiveConfigNameUnresolvable(configDir: string,
  * repeats forever because no push changes it. But the repo does not describe
  * which configuration is live, and only `config pull` records it, so the fact is
  * carried as a hint on the Synced row — the same way an operational disable is
- * (`operationalDisableHint`). The server-created `default` is the shape a
+ * (`outOfServiceHint`). The server-created `default` is the shape a
  * hand-authored file already means, so it is silent.
  *
  * Pure and non-throwing, like every other diff predicate. Returns the existing
  * hint untouched when there is nothing to add.
  */
 export declare function unmanagedActiveConfigHint(localParsed: any, workflow: any, configs: any[], existingHint?: string): string | undefined;
+/**
+ * Drop the archived rows from a pull listing (#2803).
+ *
+ * A tombstone is retired, not configuration. Exporting one wrote a file the
+ * repo then claimed to describe — and, once `status` left the TOML surface, a
+ * file whose very next push would fail on the `status` line it carried.
+ * `config push --prune` is the path that reclaims an archived row; pull's job
+ * is to describe what is configured.
+ */
+export declare function skipArchivedForPull<T extends {
+    status?: unknown;
+}>(items: T[]): T[];
+/**
+ * The sync-state entries a pull keeps for the archived rows it did NOT export
+ * (#2803).
+ *
+ * Pull removes a tombstone's file, and prune candidates come only from prior
+ * sync state — so dropping the state entry with the file would strand the row:
+ * no file to delete, no managed key to prune, and (for webhooks and cron
+ * triggers) a cap slot and a reserved key nothing could ever reclaim, which is
+ * the exact failure #2232 fixed. So the pull records the tombstone instead: no
+ * file, but a managed entry carrying the archived row's CURRENT `modifiedAt`,
+ * so the next opt-in, confirmed `config push --prune` point-reads it, finds it
+ * unchanged, and hard-deletes it — the reclamation path the model promises.
+ *
+ * Only keys the config tree already managed are recorded. A row archived
+ * server-side that this repo never described is not this repo's to delete.
+ *
+ * Pure, so it is unit-testable without a live server.
+ */
+export declare function archivedTombstoneEntries(items: any[], select: {
+    keyOf: (item: any) => string;
+    idOf: (item: any) => string;
+}, managedKeys: Iterable<string>): Record<string, {
+    id: string;
+    modifiedAt: string;
+}>;
 /**
  * The `config diff` annotation for an object an operator took out of service
- * (issue #2645, criterion 9).
+ * (issue #2645, criterion 9; #2803).
  *
- * `operationallyDisabled` is deliberately not a TOML key, so a disabled object
- * is NOT drift — the committed configuration still describes it exactly. Saying
- * so out loud is the point: the reason the toggle exists is that an out-of-band
- * write used to make `config diff` report a difference nobody intentionally
- * created (#1976). Reporting it as a hint on an otherwise-`Synced` row is what
- * keeps that promise visible instead of merely true.
+ * Availability is deliberately not a TOML key, so an object that is out of
+ * service is NOT drift — the committed configuration still describes it
+ * exactly. Saying so out loud is the point: the reason the control exists is
+ * that an out-of-band write used to make `config diff` report a difference
+ * nobody intentionally created (#1976). Reporting it as a hint on an
+ * otherwise-`Synced` row is what keeps that promise visible instead of merely
+ * true.
+ *
+ * Reads either spelling: the canonical `status: "inactive"` for a type that has
+ * cut over to #2803's single control, and the superseded
+ * `operationallyDisabled` boolean for one that has not yet.
+ *
+ * An ARCHIVED row gets its own annotation. `config pull` no longer exports
+ * tombstones, so without one an archived webhook or integration whose file is
+ * still in the tree read as plain `Synced` — the one status where "the server
+ * has exactly what the file says" is most misleading.
  *
  * When the row already carries a hint — a real content difference — the toggle
  * is APPENDED rather than substituted: the drift is the part that needs acting
@@ -506,7 +553,7 @@ export declare function unmanagedActiveConfigHint(localParsed: any, workflow: an
  *
  * Pure, so it is unit-testable without a live server.
  */
-export declare function operationalDisableHint(remote: any, existingHint?: string): string | undefined;
+export declare function outOfServiceHint(remote: any, existingHint?: string): string | undefined;
 /**
  * Serialize an integration DETAIL response to its `integrations/<key>.toml`.
  *
@@ -694,6 +741,16 @@ export declare function rewriteWorkflowSchemasToNative(rawToml: string, workflow
     content: string;
     changed: boolean;
 };
+/**
+ * #2644 — `config push` rejects any key the vendored definition does not
+ * recognize, so a mistyped or newer-server key fails locally instead of being
+ * silently dropped on the way to the server (design gate, 2026-08-12). Returns
+ * the error message, or null when every key is known.
+ *
+ * Works for any migrated type, single or repeated: a repeated table's entries
+ * are checked one by one and the unknown keys reported together, so a typo in
+ * the third `[[configs]]` block is as loud as one in the first.
+ */
 export declare function configUnknownKeyError(filePath: string, tomlData: any, table: ConfigTable): string | null;
 /**
  * #2644 — the document-level half of the same rejection: a top-level table the
@@ -727,6 +784,32 @@ export declare function unknownKeyPreflightTargets(): Array<{
     surface: ConfigObjectSurface;
     tables: ConfigTable[];
 }>;
+/** One config file the TOML preflight rejects, and the row it belongs to. */
+export interface ConfigFileValidationError {
+    /** The `config diff` row type, e.g. `prompt`. */
+    type: string;
+    /** The row key the local file pairs on. */
+    key: string;
+    filePath: string;
+    /** The messages, verbatim — the same text `config push` aborts with. */
+    messages: string[];
+}
+/**
+ * Every per-entity config file whose TOML `config push` would refuse (#2880
+ * criterion 1, symmetry).
+ *
+ * One collector, two commands. Push aborts on the messages before issuing a
+ * request; `config diff` renders them as their own rows, because the failure
+ * this closes is a file diff calls Synced and push then rejects — the state the
+ * issue's reporter hit after #2803 retired `[prompt].status`, where a local key
+ * with no server counterpart is invisible to a comparison and fatal to a push.
+ *
+ * Three checks, all definition-driven: the document's table shape, keys no
+ * definition declares (retired keys among them), and — since #2880 — values
+ * whose spelling is not the declared type. A file that does not parse is left
+ * to the per-type loop that reads it, which names the parse error itself.
+ */
+export declare function collectConfigFileValidationErrors(configDir: string): ConfigFileValidationError[];
 /**
  * Every `<key>.tests/*.toml` sidecar under a config directory.
  *
@@ -1051,12 +1134,47 @@ export interface ConfigDiffMaps {
 export interface ConfigDiffSpec {
     label: string;
     table: ConfigTable;
-    /** TOML doc -> the wire-shaped entity (the same parse `config push` uses). */
-    parse(doc: any): any;
+    /**
+     * TOML doc -> the wire-shaped entity (the same parse `config push` uses).
+     *
+     * `extra` is the per-type context the projection needs and the document does
+     * not carry (#2880): a test case's id→name lookups, through which the two
+     * spellings of a reference meet. Mirrors `serialize`, which has taken one
+     * since the database types joined.
+     */
+    parse(doc: any, extra?: any): any;
     /** Server entity -> the TOML `config pull` would write. */
     serialize(record: any, maps: ConfigDiffMaps, extra?: any): string;
     /** Structural values to hash beside the definition's fields. */
-    extras?(entity: any, doc: any): Record<string, any>;
+    extras?(entity: any, doc: any, extra?: any): Record<string, any>;
+    /**
+     * Rewrite the parsed entity the way the SERVER rewrites an accepted one
+     * (#2880 DSO-003).
+     *
+     * Some handlers canonicalize on the way in — an integration's base URL gains
+     * a trailing slash, its methods are upper-cased — so the state the server
+     * returns is not the text the file holds. Comparing them raw makes an
+     * authored-but-noncanonical value `local-edited` on every run and push
+     * re-apply the same update forever; restamping the baseline cannot fix it,
+     * because the local side never moves. Applied to both sides (the remote
+     * reaches it through the same projection), so it must be idempotent.
+     */
+    canonicalize?(entity: any): void;
+    /**
+     * The projected keys THIS FILE does not manage (#2880 criterion 3).
+     *
+     * A handful of fields are present-only by design: push sends them when the
+     * file spells them and leaves the server's value alone when it does not,
+     * because "absent" here means "not authored here" rather than "cleared" — a
+     * webhook with no `[verification]` section at all, whose signing material a
+     * push must not revoke as a side effect. Comparing such a field against a
+     * server that holds one reports a difference push will never act on: the
+     * update omits the key, the server keeps its value, and the row comes back
+     * Modified on every run. So the local side inherits the remote value for
+     * exactly the keys the file leaves unmanaged, and the two commands agree
+     * that there is nothing to do.
+     */
+    unmanaged?(doc: any): string[];
     /** Whether the entity carries a rule-set reference needing resolution. */
     ruleSetRef?: boolean;
     /** How the type names itself in the rule-set resolution message. */
@@ -1064,9 +1182,10 @@ export interface ConfigDiffSpec {
 }
 /**
  * Every type the shared comparator serves — the types `config diff` compares
- * field-for-field, and that `config push` gates on the same projection wherever
- * it has adopted the shared gate (#2731 B1/B2; webhooks joined the comparator
- * in #2757 while push keeps its own byte-hash gate).
+ * field-for-field, and that `config push` gates on the same projection
+ * (#2731 B1/B2; webhooks joined the comparator in #2757 and their push joined
+ * the same gate in #2880, so no registered type answers "changed?" from the
+ * file's bytes any more).
  *
  * Published so the round-trip acceptance bar (#2731 B9) can require a fixture
  * per type instead of listing them a second time by hand: converting a type is
@@ -1081,11 +1200,41 @@ export declare function configDiffSpec(label: string): ConfigDiffSpec;
  * a push that needs to SAY what differs and a diff that only needs to know THAT
  * something differs read the same projection.
  */
-export declare function projectLocalConfig(spec: ConfigDiffSpec, parsedToml: any, maps: ConfigDiffMaps): Record<string, any>;
+export declare function projectLocalConfig(spec: ConfigDiffSpec, parsedToml: any, maps: ConfigDiffMaps, extra?: any): Record<string, any>;
 /** The same projection for a SERVER entity — see `hashRemoteConfigForDiff`. */
 export declare function projectRemoteConfig(spec: ConfigDiffSpec, record: any, maps: ConfigDiffMaps, extra?: any): Record<string, any>;
+/**
+ * BOTH sides of one comparison, with the file's unmanaged keys reconciled
+ * (#2880) — the one place `spec.unmanaged` is honored, so `config diff` and
+ * `config push` cannot read the same file differently.
+ */
+export declare function projectConfigPair(spec: ConfigDiffSpec, localParsed: any, remoteRecord: any, maps: ConfigDiffMaps, extra?: any, localExtra?: any): {
+    local: Record<string, any>;
+    remote: Record<string, any>;
+};
+/**
+ * One `config diff` row's content verdict for a registered type (#2880).
+ *
+ * The three outcomes the per-type blocks were each spelling out by hand:
+ * equal (`exists`), different (`modified`, framed as a preview of
+ * `config pull`), and "could not tell" — a missing record or a comparison that
+ * threw, which degrades THIS row and never the whole diff. Written once so a
+ * type joining the comparator cannot accidentally report a fourth thing.
+ *
+ * The two `extra` arguments are the same split `decidePushForConfig` makes:
+ * `extra` carries what only the SERVER side has (a database type's operation
+ * rows), while `localExtra` is context BOTH sides read a value through — a test
+ * case's id→name lookups. Giving the local side nothing was a silent
+ * mistranslation: a sidecar pinned by a resolvable `configId` projected the id
+ * while the server's projection resolved it to the name, so an untouched file
+ * reported Modified in diff and drifted in push.
+ */
+export declare function compareLocalToRemote(spec: ConfigDiffSpec, localParsed: any, remoteRecord: any, maps?: ConfigDiffMaps, extra?: any, localExtra?: any): {
+    status: string;
+    hint?: string;
+};
 /** Hash a LOCAL config file's definition-projected field set (#2644). */
-export declare function hashLocalConfigForDiff(spec: ConfigDiffSpec, parsedToml: any, maps: ConfigDiffMaps): string;
+export declare function hashLocalConfigForDiff(spec: ConfigDiffSpec, parsedToml: any, maps: ConfigDiffMaps, extra?: any): string;
 /**
  * Hash a SERVER entity the same way, by serializing it into the file `sync
  * pull` would write and hashing that — so the two sides are normalized
@@ -1105,10 +1254,13 @@ export interface PushFieldDiff {
 /**
  * What `config push` should do with one converted-type file, and why.
  *
- * `create`/`skip`/`update` are the applying outcomes; `drift`, `conflict` and
- * `immutable` are the three ways push declines to apply and says so.
+ * `create`/`skip`/`update` are the applying outcomes; `drift`, `conflict`,
+ * `immutable` and `live-unavailable` are the four ways push declines to apply
+ * and says so.
  */
 export type PushGateOutcome = {
+    action: "live-unavailable";
+} | {
     action: "create";
 } | {
     action: "skip";
@@ -1116,7 +1268,7 @@ export type PushGateOutcome = {
     remoteHash: string;
 } | {
     action: "update";
-    direction: "local-edited" | "forced";
+    direction: "local-edited" | "forced" | "adopt-untracked";
     localHash: string;
     remoteHash?: string;
     expectedModifiedAt?: string;
@@ -1162,7 +1314,47 @@ export interface PushBaselineEntry {
  *
  * Declining is a first-class outcome here. `drift`, `conflict` and `immutable`
  * each carry the field diff their report prints, and nothing is applied.
- */
+ *
+ * `adoptsUntrackedByKey` is the one exception a type can ask for, and it is
+ * documented on the field: an object the manifest has never recorded is the
+ * adopt its create path would have performed via a 409 (#1006/#2909), not a
+ * difference to refuse.
+ */
+/**
+ * What the DEGRADED gate does with one file — the path a converted type takes
+ * when its live read failed (#2880 criterion 7).
+ *
+ * Falling back to the manifest's byte hash is right while there is one to fall
+ * back to. Without one, `shouldPushFile(file, undefined)` answers "push it",
+ * so a fresh checkout or a lost manifest turned "we could not read the server"
+ * into "overwrite the server", unconditionally and silently — the one shape of
+ * blind write this issue's direction attribution exists to prevent. So a
+ * baseline-less update DECLINES: the resource is not written and the operator
+ * is told which of `config pull` / `--force` clears it.
+ *
+ * A file the manifest does not name is declined for the same reason, and this
+ * is the part that is easy to get wrong: an unrecorded file looks like a
+ * create, but only LIVE STATE can say the server has nothing under that key —
+ * and live state is exactly what this path could not read. The create that
+ * follows is adopted by key on the 409 and re-issued as an update, so
+ * "there is no recorded entity to overwrite" would have been a blind overwrite
+ * of a resource this run never compared. Every section's degraded gate is
+ * reached only when the live read failed, so there is no case here where
+ * absence was proved.
+ */
+export type DegradedPushDecision = {
+    action: "skip";
+} | {
+    action: "send";
+} | {
+    action: "decline";
+    reason: "no-baseline";
+};
+export declare function decideDegradedPush(input: {
+    force?: boolean;
+    storedContentHash?: string;
+    currentFileHash?: string;
+}): DegradedPushDecision;
 export declare function decidePushForConfig(input: {
     spec: ConfigDiffSpec;
     maps: ConfigDiffMaps;
@@ -1177,7 +1369,30 @@ export declare function decidePushForConfig(input: {
     entry?: PushBaselineEntry | null;
     /** Byte hash of the local file — the legacy direction signal. */
     localFileHash?: string;
+    /**
+     * Per-type context for the LOCAL projection (#2880) — a test case's id→name
+     * lookups. Separate from `live.extra`, which carries remote-only rows (a
+     * database type's operations) the local parse must never see.
+     */
+    localExtra?: any;
     force?: boolean;
+    /**
+     * Whether this type's push path ADOPTS an existing object by key (#2909).
+     *
+     * Opt-in, and it changes exactly one outcome: a live entity the manifest has
+     * no row for at all. Prompts (#1006), and the other types whose create path
+     * recovers a 409 through `adoptByKeyOnCreate409`, treat that as the adopt it
+     * has always been — an object pushed from another slot, created out of band,
+     * or orphaned by a push that aborted before recording it, which the local
+     * file is the declared intent for. Without this the gate reads that same
+     * shape as a difference it cannot attribute, refuses, and the create the
+     * adopt guard recovers from is never even sent (the #2909 regression).
+     *
+     * The types #2731 converted leave it off: for them a never-synced file
+     * differing from a same-named live entity IS the conflict they report, and
+     * that contract is unchanged.
+     */
+    adoptsUntrackedByKey?: boolean;
 }): PushGateOutcome;
 /**
  * The identity a file may leave to its name, written back into the parsed
@@ -1761,6 +1976,23 @@ export declare function pushTestCasesForBlock(params: {
     }>;
     /** Where a rejected create/update/upload goes — it fails the push (#2731 B2). */
     failures: ApplyFailure[];
+    /**
+     * What push DECLINED to apply (#2880): server drift, a conflict, a live read
+     * that failed with no baseline. Reported exactly as every other converted
+     * type reports it — the caller passes its `recordDeclined`.
+     */
+    declined?: (type: string, key: string, outcome: Extract<PushGateOutcome, {
+        action: "drift" | "conflict" | "immutable" | "live-unavailable";
+    }>, storedModifiedAt?: string) => void;
+    /** The id→name lookups the comparison reads a reference through (#2880). */
+    lookupMaps?: TestCaseLookupMaps;
+    /**
+     * Re-derive `lookupMaps` from the caller's name→id maps (#2880). Called after
+     * this case's references are resolved and before it is compared: resolution
+     * is what LOADS a block's configs, so the comparison would otherwise read a
+     * reference the same push just learned how to read.
+     */
+    refreshLookupMaps?: () => void;
     resolutionMaps?: PushResolutionMaps;
     options?: {
         force?: boolean;
@@ -1769,25 +2001,53 @@ export declare function pushTestCasesForBlock(params: {
     skipped: number;
 }>;
 /**
- * Classify one block's sidecar against the server's test-case names (#2769).
+ * Which live test case each sidecar manages (#2880 behavior 16).
  *
- * Remote slugs are derived exactly the way pull writes them — same slugify,
- * same collision suffixes, same order — because a `<slug>-2.toml` on disk IS
- * the second colliding name and must not read as an unpushed local file.
+ * The manifest id comes FIRST. A test case's slug is derived from its name, so
+ * matching on the slug alone made a rename — in either direction — read as a
+ * new local file plus a removable remote case: diff showed two rows for one
+ * case, and push created a duplicate. `entities.testCases[stateKey].id` is
+ * stable across every rename, so it is the identity, and the slug is only how
+ * a sidecar the manifest has never seen is ADOPTED.
+ *
+ * Adoption derives its slugs exactly the way pull writes them — same slugify,
+ * same collision suffixes, same listing order — so a `<slug>-2.toml` on disk IS
+ * the second colliding name and is paired with it.
+ *
+ * One function for both commands, because a diff row and a push decision that
+ * pair differently are two answers to the same question.
  */
-export declare function classifyTestCaseSidecarDiff(params: {
-    remoteNames: string[];
+export declare function pairTestCases(input: {
+    blockType: string;
+    blockKey: string;
     localSlugs: string[];
-}): Array<{
-    slug: string;
-    status: string;
-}>;
+    liveCases: any[];
+    managed: Record<string, {
+        id?: string;
+    }> | undefined;
+}): {
+    bySlug: Map<string, any>;
+    localOnly: string[];
+    remoteOnly: any[];
+};
 /**
  * `config diff` for one block's test-case sidecar (#2769). A failed listing is
  * an OUTCOME the caller reports as "not compared" — the old helper returned
  * silently, so a block whose tests could not be fetched simply disappeared from
  * a report that still read as exhaustive.
  */
+export interface TestCaseDiffRow {
+    blockType: string;
+    blockKey: string;
+    slug: string;
+    status: string;
+    /** What a validation error or a degraded comparison has to say. */
+    hint?: string;
+    /** Attachments push would upload from this sidecar (#2880 behavior 19). */
+    attachmentUploads?: string[];
+    /** Managed attachments `push --prune` would delete (never a plain push). */
+    attachmentDeletions?: string[];
+}
 export declare function compareTestCasesForBlock(params: {
     client: ApiClient;
     appId: string;
@@ -1795,14 +2055,12 @@ export declare function compareTestCasesForBlock(params: {
     blockId: string;
     blockKey: string;
     configDir: string;
+    /** The manifest — identity, and the attachment hashes the plan reads. */
+    syncState?: SyncState | null;
+    lookupMaps?: TestCaseLookupMaps;
 }): Promise<{
     ok: true;
-    rows: Array<{
-        blockType: string;
-        blockKey: string;
-        slug: string;
-        status: string;
-    }>;
+    rows: TestCaseDiffRow[];
 } | {
     ok: false;
 }>;
@@ -1814,6 +2072,17 @@ export declare function compareTestCasesForBlock(params: {
  * on the way to it, pushing a test case that tested something else.
  */
 export declare function testCaseSidecarErrors(filePath: string, tomlData: any): string[];
+/**
+ * EVERY reason `config push` refuses one test-case sidecar (#2880 criterion 1).
+ *
+ * The four checks the push preflight ran inline: the document's shape, the keys
+ * the definition recognizes, the declared type of each value, and the sidecar's
+ * own authoring rules (#2769). Collected in one place because `config diff`
+ * runs the identical list — it used to run only the last of the four, so a
+ * sidecar with an unknown key or a mistyped ordinary field was reported Synced
+ * by the command whose whole promise is that a Synced file pushes.
+ */
+export declare function testCaseSidecarPreflightErrors(filePath: string, tomlData: any): string[];
 /** A managed test case whose authored file is gone (#2769). */
 export interface TestCaseDeletionCandidate {
     stateKey: string;