primitive-admin 1.1.0-alpha.72 → 1.1.0-alpha.74

package/dist/src/commands/sync.js

@@ -29,9 +29,13 @@ import { buildWorkflowPayloadFromToml, parseWorkflowExpressionsToml, } from "../
 // payload builder so the diff normalizer and the wire cannot disagree.
 import { WORKFLOW_MODEL_DEFAULTS } from "../lib/workflow-defaults.js";
 // #2644 — the one definition per configuration object, vendored from the server.
-import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
+import { BLOB_BUCKET_TABLE, COLLECTION_TYPE_CONFIG_TABLE, CRON_TRIGGER_TABLE, DATABASE_TYPE_TABLE, EMAIL_TEMPLATE_TABLE, GROUP_TYPE_CONFIG_TABLE, INTEGRATION_TABLE, METADATA_CATEGORY_CONFIG_TABLE, PROMPT_CONFIG_TABLE, PROMPT_TABLE, RULE_SET_TABLE, SERVER_FUNCTION_TABLE, TEST_CASE_SURFACE, TEST_CASE_TABLE, WEBHOOK_TABLE, WORKFLOW_TABLE, configDeclaredTypeErrors, fieldServerDefault, findMisshapenTables, findUnknownDocumentKeys, findUnknownServerKeys, findUnknownTomlKeys, misshapenTableMessage, retiredConfigKey, spellsDecimalNumber, unrecognizedPullKeysMessage, unrecognizedPushKeysMessage, unrecognizedPushTablesMessage, warnUnrecognizedServerKeys, } from "../lib/config-surface.js";
 import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, tomlOwned, } from "../lib/config-payload.js";
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
+// #3179 — the function's two halves: the header payloads and the envelope
+// `config push` sends, and the bytes `config pull` writes back.
+import { applyFunctionPull, buildFunctionConfigPush, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
+import { FunctionBuildError } from "../lib/function-bundle.js";
 import { detectLayout, migrateLegacyToV2 } from "../lib/block-layout.js";
 import { ABSENT_FROM_EXPORT, LOCAL_ONLY_ABSENT, LOCAL_ONLY_NEW, PUSH_PRUNE_SPECS, REMOTE_ONLY_UNMANAGED, REMOTE_ONLY_WILL_DELETE, SYNC_RESOURCE_TYPES, VALIDATION_ERROR, applyPrune, attachmentWritePath, attemptFetch, classifyLocalOnly, classifyPruneDeleteFailure, classifyRemoteOnly, collectPushPruneCandidates, decidePushPruneCandidate, formatPrunePlan, hasUncommittedChanges, isSafeAttachmentFilename, isSafeSyncFilename, planPrune, preserveUnwrittenEntries, removePrunedSidecar, ruleSetFileKey, } from "../lib/sync-resource-types.js";
 import { normalizeTestCaseKey, testCaseKeyError, } from "../lib/test-case-keys.js";
@@ -1594,6 +1598,32 @@ export function buildBlobBucketUpdatePayload(bucket) {
     }
     return updatePayload;
 }
+/**
+ * The `[[configs]] status` the server assigns when a file names none (#3201).
+ *
+ * Taken from the definition, not spelled again here: pull omits the key at
+ * this value and push sends this value for the omitted key, and those two
+ * statements have to be the same one or a pulled file would not describe the
+ * state it was pulled from.
+ */
+const PROMPT_CONFIG_DEFAULT_STATUS = fieldServerDefault(PROMPT_CONFIG_TABLE, "status");
+/**
+ * The status a freshly CREATED prompt config still owes the file, or null
+ * (#3201).
+ *
+ * `status` is update-only — `POST /prompts` and `POST /prompts/:id/configs`
+ * both assign `active` whatever the body says — so an authored
+ * `status = "archived"` was silently dropped on every create path: a pulled
+ * tree pushed from a clean clone into a fresh environment brought every
+ * retired config back into service. Read through the push payload builder, so
+ * a file that omits the key asks for the default and needs no request.
+ */
+export function createdConfigStatusPatch(tomlConfig) {
+    const { status } = buildPromptConfigPayload(tomlConfig, { mode: "update" });
+    return typeof status === "string" && status !== PROMPT_CONFIG_DEFAULT_STATUS
+        ? { status }
+        : null;
+}
 /**
  * Which `[[configs]]` entry a prompt file marks as live (issue #2645).
  *
@@ -1705,6 +1735,17 @@ export function serializePrompt(prompt, logger) {
         },
         configs: (prompt.configs || []).map((config) => ({
             ...projectRecordToToml(PROMPT_CONFIG_TABLE, config, {
+                // #3201 — the per-version key, written only when the config is
+                // RETIRED. `active` is what the create handler assigns and what an
+                // absent key means (the definition's `serverDefault`), so emitting it
+                // put a `status = "active"` line in every pulled prompt file: the one
+                // spelling the availability contract says a config file never carries
+                // (#2803), on the line `config create` scaffolds the `active = true`
+                // marker onto. A retired config still says so — that is what #2645 put
+                // the key in the file for.
+                status: (record) => record?.status === PROMPT_CONFIG_DEFAULT_STATUS
+                    ? undefined
+                    : record?.status,
                 // Stored as a string on the model and returned parsed; coerce
                 // defensively so an older server's string still writes as a number.
                 temperature: (record) => record.temperature != null ? Number(record.temperature) : undefined,
@@ -1852,6 +1893,13 @@ const SEEDED_CONFIG_DEFERRED = ["outputSchema", "description"];
  * `seededConfigName` is what the server called it — read from the create
  * response rather than assumed, so a handler that one day honors the name
  * produces no needless PATCH.
+ *
+ * #3201 — the entry's `status` is deferred the OTHER way and is deliberately
+ * not here. The create points the prompt's `activeConfigId` at this seeded
+ * config, so retiring it in this early patch would archive the config the
+ * prompt is serving from and leave it there until the marked entry is created
+ * and activated — a window a failed create or activation freezes. It is
+ * applied after activation instead (`createdConfigStatusPatch`).
  */
 export function seededOnlyPromptConfigFields(firstConfig, seededConfigName = "default") {
     const full = buildPromptConfigPayload(firstConfig || {}, { mode: "update" });
@@ -3335,6 +3383,28 @@ const CONFIG_DIFF_SPECS = {
         serialize: (record) => serializeEmailTemplate(record),
         describe: (entity) => `email template "${entity?.emailType}"`,
     },
+    // #3179 — server functions. The compared entity spans the header AND the
+    // three keys the immutable version carries (`entry`, `durable`, `limits`),
+    // because an author writes one file and a version is never authored
+    // separately: comparing only the header would report a changed entry point as
+    // Synced. The SOURCE bytes are a second axis the table cannot express — they
+    // are compared by `envelopeHash`, which is also what the server dedupes on.
+    "function": {
+        label: "function",
+        table: SERVER_FUNCTION_TABLE,
+        parse: (doc) => functionDiffEntity(doc),
+        // `extra` is the ACTIVE config version, which is where the remote side's
+        // entry/durable/limits live; the header row does not carry them.
+        serialize: (record, _maps, extra) => serializeFunction(record, extra),
+        // The version-carried keys are not fields of the header table, so they
+        // travel as extras — present on both sides or absent on both.
+        extras: (entity) => ({
+            entry: entity.entry ?? null,
+            durable: entity.durable === true,
+            limits: entity.limits ?? null,
+        }),
+        describe: (entity) => `function "${entity?.functionKey}"`,
+    },
     // #2757 — webhooks join the registry comparator for the same reason email
     // templates did: `config diff` reported existence only, so an edit that
     // rerouted a webhook to a different `workflowKey` read as Synced while push
@@ -4594,6 +4664,123 @@ selects = () => true) {
         : { ok: false };
     return { scriptEntities, count: written, presence, listOk: true, serverKeys };
 }
+/**
+ * Pull server-side `ServerFunction` rows into `functions/` (#3179).
+ *
+ * Two things make this different from every other type's pull:
+ *
+ *   1. **A function is more than its file.** The active config VERSION holds an
+ *      envelope with the authored TOML bytes and every source file, so the pull
+ *      writes `functions/<key>.toml` plus the TypeScript beside it, and records
+ *      the source paths so prune can remove the code with the function.
+ *   2. **Bytes, not a re-serialization.** The stored TOML is written verbatim,
+ *      so comments, key order and line endings survive the round trip (F-009).
+ *      A function that has never had code pushed has no stored bytes; that one
+ *      gets a canonical serialization of its header, which is still a pushable
+ *      file.
+ *
+ * A stored source path is never trusted: `planFunctionPull` refuses one that
+ * normalizes outside the tree, and the refusals are reported rather than
+ * swallowed.
+ */
+export async function pullFunctions(client, appId, configDir, logger = () => { }, selects = () => true) {
+    const functionsDir = join(configDir, "functions");
+    ensureDir(functionsDir);
+    const functionEntities = {};
+    let items = [];
+    try {
+        const result = await client.listFunctions(appId);
+        items = result.items || [];
+    }
+    catch {
+        return {
+            functionEntities,
+            count: 0,
+            presence: { ok: false },
+            listOk: false,
+            serverKeys: [],
+            items: [],
+        };
+    }
+    let detailsOk = true;
+    let written = 0;
+    for (const record of items) {
+        const key = record?.functionKey;
+        if (!key)
+            continue;
+        if (!selects(key))
+            continue;
+        // #2803 — a tombstone is not exported as a file. Its key stays reserved,
+        // and the archived-holder message is what says so on the next push.
+        if (String(record.status ?? "active") === "archived")
+            continue;
+        const filePath = join(functionsDir, `${key}.toml`);
+        let entity = {
+            id: record.functionId,
+            modifiedAt: record.modifiedAt || new Date().toISOString(),
+        };
+        if (!record.activeConfigId) {
+            // No code pushed yet: the header is all there is to write.
+            writeFileSync(filePath, serializeFunction(record));
+            entity.contentHash = computeFileHash(filePath);
+            entity.semanticHash = hashRemoteConfigForDiff(configDiffSpec("function"), record, { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() });
+            functionEntities[key] = entity;
+            written += 1;
+            logger(`  Wrote functions/${key}.toml (no version pushed yet)`);
+            continue;
+        }
+        let active;
+        let envelope;
+        try {
+            const configs = await client.listFunctionConfigs(appId, record.functionId);
+            active = (configs.items || []).find((c) => String(c.configId) === String(record.activeConfigId));
+            if (active) {
+                envelope = await client.getFunctionConfigEnvelope(appId, record.functionId, active.configId);
+            }
+        }
+        catch {
+            detailsOk = false;
+            logger(`  Skipped functions/${key}.toml (could not fetch its version)`);
+            continue;
+        }
+        if (!active || !envelope) {
+            detailsOk = false;
+            logger(`  Skipped functions/${key}.toml (active version not readable)`);
+            continue;
+        }
+        const plan = planFunctionPull({ configDir, functionKey: key, envelope });
+        for (const refusal of plan.refusals)
+            logger(`  ${refusal}`);
+        const applied = applyFunctionPull(plan);
+        for (const refusal of applied.refusals)
+            logger(`  ${refusal}`);
+        entity.contentHash = computeFileHash(filePath);
+        entity.semanticHash = hashRemoteConfigForDiff(configDiffSpec("function"), record, { ruleSetIdToName: new Map(), ruleSetNameToId: new Map() }, active);
+        entity.envelopeHash = envelope.envelopeHash ?? active.envelopeHash;
+        entity.activeConfigId = active.configId;
+        // Only the files that were really written: a path the write step refused
+        // is not one prune may later delete on this function's behalf.
+        entity.sources = applied.writtenSources;
+        functionEntities[key] = entity;
+        written += 1;
+        logger(`  Wrote functions/${key}.toml and ${applied.writtenSources.length} source file(s)`);
+    }
+    const serverKeys = items
+        .filter((f) => String(f?.status ?? "active") !== "archived")
+        .map((f) => f?.functionKey)
+        .filter(Boolean);
+    const presence = detailsOk
+        ? { ok: true, serverKeys }
+        : { ok: false };
+    return {
+        functionEntities,
+        count: written,
+        presence,
+        listOk: true,
+        serverKeys,
+        items,
+    };
+}
 /**
  * Every test case a block has, draining the cursor (#2769).
  *
@@ -6117,6 +6304,7 @@ export function registerConfigSyncCommands(sync) {
         ensureDir(join(configDir, "prompts"));
         ensureDir(join(configDir, "workflows"));
         ensureDir(join(configDir, "transforms")); // #892 slice 7 — Rhai scripts
+        ensureDir(join(configDir, "functions")); // #3179 — server functions
         ensureDir(join(configDir, "database-type-configs"));
         ensureDir(join(configDir, "rule-sets"));
         ensureDir(join(configDir, "group-type-configs"));
@@ -6380,6 +6568,7 @@ export function registerConfigSyncCommands(sync) {
             ensureDir(join(configDir, "prompts"));
             ensureDir(join(configDir, "workflows"));
             ensureDir(join(configDir, "transforms")); // #892 slice 7 — Rhai scripts
+            ensureDir(join(configDir, "functions")); // #3179 — server functions
             ensureDir(join(configDir, "database-type-configs"));
             ensureDir(join(configDir, "rule-sets"));
             ensureDir(join(configDir, "group-type-configs"));
@@ -6735,6 +6924,20 @@ export function registerConfigSyncCommands(sync) {
             if (pulledScriptsCount > 0) {
                 info(`  Pulled ${pulledScriptsCount} transform(s)`);
             }
+            // Pull server functions — #3179. Writes `functions/<key>.toml` from the
+            // AUTHORED bytes stored in the active version's envelope, plus every
+            // source file beside it, so the round trip is byte-identical.
+            const { functionEntities, count: pulledFunctionsCount, presence: functionPresence, listOk: functionListOk, serverKeys: functionServerKeys, items: functionTombstoneCandidates, } = await pullFunctions(client, resolvedAppId, configDir, info, (key) => {
+                if (!pullSelection)
+                    return true;
+                if (!selectionIncludesKey(pullSelection, "function", key))
+                    return false;
+                matchedSelectors.add(`function/${key}`);
+                return true;
+            });
+            if (pulledFunctionsCount > 0) {
+                info(`  Pulled ${pulledFunctionsCount} function(s)`);
+            }
             // Build lookup maps for test case serialization
             const configIdToName = new Map();
             const promptIdToKey = new Map();
@@ -7013,6 +7216,7 @@ export function registerConfigSyncCommands(sync) {
                     ? { ok: true, serverKeys: blobBucketItems.map((b) => b.bucketKey) }
                     : { ok: false },
                 scripts: scriptPresence,
+                functions: functionPresence,
                 emailTemplates: emailTemplatePresence,
                 databaseTypes: databaseTypeConfigsOutcome.ok && databaseTypeDetailsOk
                     ? { ok: true, serverKeys: databaseTypesWithOps.map((d) => d.typeConfig.databaseType) }
@@ -7079,11 +7283,36 @@ export function registerConfigSyncCommands(sync) {
                 for (const key of plan.unsafeKeys) {
                     warn(`  Skipped pruning ${resourceType.dir} entry "${key}" — its sync-state key does not map to a safe filename`);
                 }
+                // #3179 — the source files the SURVIVORS still own. Two functions can
+                // import the same module, and both record it; deleting it with one
+                // would leave the other unbuildable while its state called it
+                // current. Both the prior state and this pull's entities are read,
+                // because a function created server-side since the last pull owns its
+                // sources only in the fresh map.
+                const pruningKeys = new Set(plan.keys);
+                const retainedFiles = new Set();
+                const collectRetained = (entities) => {
+                    for (const [entityKey, entity] of Object.entries(entities ?? {})) {
+                        if (pruningKeys.has(entityKey))
+                            continue;
+                        for (const path of (entity?.sources ?? [])) {
+                            retainedFiles.add(path);
+                        }
+                    }
+                };
+                collectRetained(priorEntities[resourceType.stateSlot]);
+                if (resourceType.stateSlot === "functions") {
+                    collectRetained(functionEntities);
+                }
                 const result = await applyPrune({
                     configDir,
                     resourceType,
                     keys: plan.keys,
                     testCaseEntities,
+                    // #3179 — a function's TypeScript goes with it. Only the prior sync
+                    // state knows where those files are, so it is what names them.
+                    extraFilesForKey: (key) => priorEntities[resourceType.stateSlot]?.[key]?.sources ?? [],
+                    retainedFiles,
                     logger: info,
                 });
                 prunedCount += result.prunedKeys.length;
@@ -7099,12 +7328,14 @@ export function registerConfigSyncCommands(sync) {
             // the prior entry for that one key — see `preserveUnwrittenEntries`.
             const keepPrior = (ok, built, slot) => ok ? built : (priorEntities[slot] ?? built);
             preserveUnwrittenEntries(scriptEntities, priorEntities.scripts, scriptServerKeys);
+            preserveUnwrittenEntries(functionEntities, priorEntities.functions, functionServerKeys);
             preserveUnwrittenEntries(emailTemplateEntities, priorEntities.emailTemplates, emailTemplatesOutcome.ok
                 ? emailTemplateOverrides.map((t) => t.emailType)
                 : []);
             const finalCronTriggerEntities = keepPrior(cronTriggersOutcome.ok, cronTriggerEntities, "cronTriggers");
             const finalBlobBucketEntities = keepPrior(blobBucketsOutcome.ok, blobBucketEntities, "blobBuckets");
             const finalScriptEntities = keepPrior(scriptListOk, scriptEntities, "scripts");
+            const finalFunctionEntities = keepPrior(functionListOk, functionEntities, "functions");
             const finalEmailTemplateEntities = keepPrior(emailTemplatesOutcome.ok, emailTemplateEntities, "emailTemplates");
             const finalDatabaseTypeEntities = keepPrior(databaseTypeConfigsOutcome.ok, databaseTypeEntities, "databaseTypes");
             const finalRuleSetEntities = keepPrior(ruleSetsOutcome.ok, ruleSetEntities, "ruleSets");
@@ -7133,6 +7364,7 @@ export function registerConfigSyncCommands(sync) {
                 prompts: promptEntities,
                 workflows: workflowEntities,
                 scripts: finalScriptEntities,
+                functions: finalFunctionEntities,
                 emailTemplates: finalEmailTemplateEntities,
                 databaseTypes: finalDatabaseTypeEntities,
                 ruleSets: finalRuleSetEntities,
@@ -7203,6 +7435,17 @@ export function registerConfigSyncCommands(sync) {
                         idOf: (w) => w.workflowId,
                     }, Object.keys(priorEntities.workflows ?? {})),
                 ],
+                // #3179 — the sixth carrying type reaches the same place. An archived
+                // function keeps its key in the app's SINGLE key namespace, so a
+                // stranded tombstone blocks a workflow, a script or a webhook wanting
+                // that key too, not just another function.
+                [
+                    "functions",
+                    archivedTombstoneEntries(functionTombstoneCandidates, {
+                        keyOf: (f) => f.functionKey,
+                        idOf: (f) => f.functionId,
+                    }, Object.keys(priorEntities.functions ?? {})),
+                ],
             ]) {
                 const built = entitiesBySlot[slot];
                 const resourceType = SYNC_RESOURCE_TYPES.find((rt) => rt.stateSlot === slot);
@@ -7299,6 +7542,7 @@ export function registerConfigSyncCommands(sync) {
                     prompts: promptEntities,
                     workflows: workflowEntities,
                     scripts: Object.keys(finalScriptEntities).length > 0 ? finalScriptEntities : undefined,
+                    functions: Object.keys(finalFunctionEntities).length > 0 ? finalFunctionEntities : undefined,
                     emailTemplates: Object.keys(finalEmailTemplateEntities).length > 0 ? finalEmailTemplateEntities : undefined,
                     testCases: Object.keys(testCaseEntities).length > 0 ? testCaseEntities : undefined,
                     databaseTypes: Object.keys(finalDatabaseTypeEntities).length > 0 ? finalDatabaseTypeEntities : undefined,
@@ -7324,6 +7568,7 @@ export function registerConfigSyncCommands(sync) {
             keyValue("Prompts", prompts.length);
             keyValue("Workflows", workflows.length);
             keyValue("Transforms", pulledScriptsCount);
+            keyValue("Functions", pulledFunctionsCount);
             keyValue("Email Templates", emailTemplates.length);
             keyValue("Test Cases", totalTestCases);
             keyValue("Database Types", databaseTypesWithOps.length);
@@ -9939,6 +10184,18 @@ export function registerConfigSyncCommands(sync) {
                                         }
                                         if (newConfig?.configId) {
                                             promptConfigNameToId.set(`${key}#${configName}`, newConfig.configId);
+                                            // #3201 — the create assigned `active`; a file that
+                                            // retired this entry says so in the only mode the
+                                            // server accepts the key in.
+                                            const statusPatch = createdConfigStatusPatch(tomlConfig);
+                                            if (statusPatch) {
+                                                try {
+                                                    await client.updatePromptConfig(resolvedAppId, promptId, newConfig.configId, statusPatch);
+                                                }
+                                                catch (err) {
+                                                    throw wrapPromptConfigError(err, "update", key, configName);
+                                                }
+                                            }
                                         }
                                     }
                                 }
@@ -10249,6 +10506,19 @@ export function registerConfigSyncCommands(sync) {
                                         if (extraCreated?.configId) {
                                             const configName = extraName;
                                             promptConfigNameToId.set(`${key}#${configName}`, extraCreated.configId);
+                                            // #3201 — as on the update path: the create ignored
+                                            // the entry's `status`, so a retired one is applied
+                                            // here or the fresh environment runs a config the
+                                            // file retired.
+                                            const statusPatch = createdConfigStatusPatch(extraConfig);
+                                            if (statusPatch) {
+                                                try {
+                                                    await client.updatePromptConfig(resolvedAppId, created.promptId, extraCreated.configId, statusPatch);
+                                                }
+                                                catch (err) {
+                                                    throw wrapPromptConfigError(err, "update", key, configName);
+                                                }
+                                            }
                                         }
                                     }
                                     info(`    Created ${configs.length - 1} additional config(s) for prompt: ${key}`);
@@ -10280,6 +10550,25 @@ export function registerConfigSyncCommands(sync) {
                                         activated = true;
                                     }
                                 }
+                                // #3201 — the seeded config's own `status`, applied LAST for
+                                // the same reason activation runs after the extra creates:
+                                // the create points `activeConfigId` at this config, so a
+                                // file that retires it is asking for a state that only makes
+                                // sense once the entry it marks active exists and is live.
+                                // Retiring it earlier would leave the prompt serving from an
+                                // archived config for the length of the remaining calls, and
+                                // permanently if one of them failed.
+                                const seededStatusPatch = seededConfigId
+                                    ? createdConfigStatusPatch(firstConfig || {})
+                                    : null;
+                                if (created?.promptId && seededConfigId && seededStatusPatch) {
+                                    try {
+                                        await client.updatePromptConfig(resolvedAppId, created.promptId, seededConfigId, seededStatusPatch);
+                                    }
+                                    catch (err) {
+                                        throw wrapPromptConfigError(err, "update", key, firstConfigPatch?.configName || seededConfig?.configName);
+                                    }
+                                }
                                 // Stamp sync state ONLY after all create work (base prompt +
                                 // every extra config) succeeded. If an extra-config create
                                 // above threw, we never reach here, so the file hash is not
@@ -10576,6 +10865,261 @@ export function registerConfigSyncCommands(sync) {
                     }
                 }
             }
+            // Process server functions — #3179.
+            //
+            // A function pushes on TWO axes and they are deliberately independent:
+            //
+            //   - the HEADER (`[function]`'s gate, runAs, schemas, plus the three
+            //     version-carried keys, all compared through the shared gate), and
+            //   - the CODE — the authored TOML bytes, every source file and the
+            //     built bundle, sent as one immutable config VERSION.
+            //
+            // Independent because a comment-only edit to a source file leaves the
+            // header identical and must still make a version (F-003): gating the
+            // code push on the header comparison would silently discard it. The
+            // code axis compares `envelopeHash`, which is also what the SERVER
+            // dedupes on, so an unchanged push makes no version on either side's
+            // reckoning.
+            //
+            // The bundle is built FIRST, so a build error, a missing entry or an
+            // import that escapes the config tree aborts this function before
+            // anything is sent for it (behavior 12).
+            const functionsPushDir = join(configDir, "functions");
+            if (existsSync(functionsPushDir)) {
+                const files = selectFiles("function", functionsPushDir, readdirSync(functionsPushDir).filter((f) => f.endsWith(".toml")));
+                const functionSpec = configDiffSpec("function");
+                const liveFunctions = new Map();
+                let functionsLiveOk = true;
+                if (files.length > 0) {
+                    try {
+                        const listed = await client.listFunctions(resolvedAppId);
+                        for (const f of (listed?.items ?? [])) {
+                            if (f?.functionKey)
+                                liveFunctions.set(f.functionKey, f);
+                        }
+                    }
+                    catch (err) {
+                        functionsLiveOk = false;
+                        warnLiveUnavailable("functions", err);
+                    }
+                }
+                /** The version a function currently runs, or null. */
+                const liveActiveVersion = async (functionId, activeConfigId) => {
+                    if (!activeConfigId)
+                        return null;
+                    const { items } = await client.listFunctionConfigs(resolvedAppId, functionId);
+                    return ((items || []).find((c) => String(c.configId) === String(activeConfigId)) ?? null);
+                };
+                for (const file of files) {
+                    const filePath = join(functionsPushDir, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const key = tomlData.function?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "function", { key });
+                    const existingEntry = syncState?.entities?.functions?.[key];
+                    const liveFunction = liveFunctions.get(key);
+                    // Build first: nothing is sent for a function whose code does not
+                    // compile or whose imports leave the tree.
+                    let push;
+                    try {
+                        push = await buildFunctionConfigPush({
+                            configDir,
+                            functionKey: key,
+                            filePath,
+                            tomlData,
+                        });
+                    }
+                    catch (err) {
+                        if (!(err instanceof FunctionBuildError))
+                            throw err;
+                        applyFailures.push({
+                            type: "function",
+                            key,
+                            message: err.message,
+                        });
+                        continue;
+                    }
+                    // The active version, needed by BOTH axes: the header comparison
+                    // reads `entry`/`durable`/`limits` off it, and the code axis
+                    // compares its `envelopeHash`.
+                    let activeVersion = null;
+                    let versionOk = functionsLiveOk;
+                    if (functionsLiveOk && liveFunction?.functionId) {
+                        try {
+                            activeVersion = await liveActiveVersion(liveFunction.functionId, liveFunction.activeConfigId);
+                        }
+                        catch (err) {
+                            versionOk = false;
+                            warnLiveUnavailable(`function ${key}`, err);
+                        }
+                    }
+                    let headerAction = "skip";
+                    if (versionOk && functionsLiveOk) {
+                        const gate = decidePushForConfig({
+                            spec: functionSpec,
+                            maps: pushDiffMaps,
+                            localParsed: tomlData,
+                            live: liveFunction
+                                ? {
+                                    record: liveFunction,
+                                    // The version-carried keys the remote side is projected
+                                    // through; the header row does not hold them.
+                                    extra: activeVersion ?? undefined,
+                                    modifiedAt: liveFunction.modifiedAt,
+                                }
+                                : null,
+                            entry: existingEntry,
+                            localFileHash: computeFileHash(filePath),
+                            force: options.force,
+                            // The create leg adopts by key on the server's 409 (#1006), so
+                            // an untracked function the server already holds is that same
+                            // adopt reached one step earlier.
+                            adoptsUntrackedByKey: true,
+                        });
+                        if (gate.action === "drift" ||
+                            gate.action === "conflict" ||
+                            gate.action === "immutable") {
+                            recordDeclined("function", key, gate, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                        headerAction = gate.action === "skip"
+                            ? "skip"
+                            : liveFunction
+                                ? "update"
+                                : "create";
+                    }
+                    else {
+                        const degraded = decideDegradedPush({
+                            force: options.force,
+                            storedContentHash: existingEntry?.contentHash,
+                            currentFileHash: computeFileHash(filePath),
+                        });
+                        if (degraded.action === "decline") {
+                            recordDeclined("function", key, { action: "live-unavailable" }, existingEntry?.modifiedAt);
+                            continue;
+                        }
+                        headerAction = degraded.action === "skip"
+                            ? "skip"
+                            : liveFunction
+                                ? "update"
+                                : "create";
+                    }
+                    // The code axis. `envelopeHash` is the server's own no-op test, so
+                    // matching it here means the call would create nothing.
+                    const codeUnchanged = !!liveFunction &&
+                        !!activeVersion &&
+                        String(activeVersion.envelopeHash ?? "") === push.envelopeHash;
+                    if (headerAction === "skip" && codeUnchanged) {
+                        skippedCount++;
+                        if (syncState && liveFunction?.functionId) {
+                            if (!syncState.entities.functions)
+                                syncState.entities.functions = {};
+                            syncState.entities.functions[key] = {
+                                ...(existingEntry ?? {}),
+                                id: liveFunction.functionId,
+                                modifiedAt: liveFunction.modifiedAt ||
+                                    existingEntry?.modifiedAt ||
+                                    new Date().toISOString(),
+                                contentHash: computeFileHash(filePath),
+                                semanticHash: hashRemoteConfigForDiff(functionSpec, liveFunction, pushDiffMaps, activeVersion ?? undefined),
+                                envelopeHash: push.envelopeHash,
+                                activeConfigId: activeVersion?.configId,
+                                sources: push.sources.map((src) => src.path),
+                            };
+                        }
+                        continue;
+                    }
+                    changes.push({
+                        type: "function",
+                        action: liveFunction ? "update" : "create",
+                        key,
+                    });
+                    if (options.dryRun)
+                        continue;
+                    // Every server refusal below is recorded against THIS function and
+                    // the loop moves on. A single archived tombstone — or a key the
+                    // app's namespace already holds — must not abort a push carrying
+                    // unrelated changes: the run reports what it could not apply, exits
+                    // non-zero, and everything else in the tree still lands. That is
+                    // the same contract `applyFailures` gives every other type; a throw
+                    // here would let one refusal block a whole repository.
+                    let functionId = liveFunction?.functionId ?? existingEntry?.id;
+                    let pushedVersion;
+                    try {
+                        if (!functionId) {
+                            const created = await client.createFunction(resolvedAppId, buildFunctionCreatePayload(key, tomlData.function ?? {})).catch(async (err) => {
+                                // #1006 — a function the server already holds under this key
+                                // is adopted rather than re-created. The conflict may name a
+                                // WORKFLOW, a script or a webhook instead: those are the
+                                // single key namespace refusing the key, and they are not
+                                // adoptable, so `adoptByKeyOnCreate409` re-throws the original
+                                // error with its holder named.
+                                const existing = await adoptByKeyOnCreate409({
+                                    err,
+                                    kind: "function",
+                                    key,
+                                    lookup: async () => (await client.listFunctions(resolvedAppId)).items || [],
+                                    matchKey: (f) => f?.functionKey === key,
+                                });
+                                return existing;
+                            });
+                            functionId = created.functionId;
+                            info(`  Created function: ${key}`);
+                        }
+                        else if (headerAction !== "skip") {
+                            const updatePayload = buildFunctionUpdatePayload(tomlData.function ?? {});
+                            if (Object.keys(updatePayload).length > 0) {
+                                await client.updateFunction(resolvedAppId, functionId, updatePayload);
+                            }
+                            info(`  Updated function: ${key}`);
+                        }
+                        // The version. `status` is NEVER in this body: pushing code to a
+                        // disabled function updates it and leaves it out of service
+                        // (#2803's resurrection guard), and a push to an archived one is
+                        // refused by the server with the archived-holder message — which
+                        // names the remedies that release its key.
+                        pushedVersion = await client.pushFunctionConfig(resolvedAppId, String(functionId), push);
+                    }
+                    catch (err) {
+                        applyFailures.push({
+                            type: "function",
+                            key,
+                            message: String(err?.message ?? err),
+                        });
+                        continue;
+                    }
+                    if (pushedVersion?.created === false) {
+                        info(`  Function ${key}: code unchanged (no new version)`);
+                    }
+                    else {
+                        info(`  Pushed function ${key} version ${pushedVersion?.configId ?? ""}`.trim());
+                    }
+                    if (syncState) {
+                        if (!syncState.entities.functions)
+                            syncState.entities.functions = {};
+                        let refreshed = liveFunction;
+                        try {
+                            refreshed = await client.getFunction(resolvedAppId, String(functionId));
+                        }
+                        catch {
+                            // Non-fatal: the baseline falls back to what the listing said.
+                            // The next push reconciles it.
+                        }
+                        syncState.entities.functions[key] = {
+                            id: String(functionId),
+                            modifiedAt: refreshed?.modifiedAt ||
+                                existingEntry?.modifiedAt ||
+                                new Date().toISOString(),
+                            contentHash: computeFileHash(filePath),
+                            semanticHash: refreshed
+                                ? hashRemoteConfigForDiff(functionSpec, refreshed, pushDiffMaps, pushedVersion ?? undefined)
+                                : undefined,
+                            envelopeHash: push.envelopeHash,
+                            activeConfigId: pushedVersion?.configId,
+                            sources: push.sources.map((src) => src.path),
+                        };
+                    }
+                }
+            }
             // Process workflows
             const workflowsDir = join(configDir, "workflows");
             if (existsSync(workflowsDir)) {
@@ -13786,7 +14330,7 @@ export function registerConfigSyncCommands(sync) {
                 notCompared.push({ type: label, reason: gateReason(outcome.error) });
                 return empty;
             };
-            const [integrationsOutcome, promptsOutcome, workflowsOutcome, emailTemplatesOutcomeDiff, webhooksOutcome, cronTriggersOutcomeDiff, blobBucketsOutcomeDiff, scriptsOutcomeDiff, varsOutcomeDiff, databaseTypeConfigsOutcomeDiff, ruleSetsOutcomeDiff, groupTypeConfigsOutcomeDiff, collectionTypeConfigsOutcomeDiff, metadataCategoryConfigsOutcomeDiff,] = await Promise.all([
+            const [integrationsOutcome, promptsOutcome, workflowsOutcome, emailTemplatesOutcomeDiff, webhooksOutcome, cronTriggersOutcomeDiff, blobBucketsOutcomeDiff, scriptsOutcomeDiff, functionsOutcomeDiff, varsOutcomeDiff, databaseTypeConfigsOutcomeDiff, ruleSetsOutcomeDiff, groupTypeConfigsOutcomeDiff, collectionTypeConfigsOutcomeDiff, metadataCategoryConfigsOutcomeDiff,] = await Promise.all([
                 attemptFetch(() => fetchAll((p) => client.listIntegrations(resolvedAppId, p))),
                 attemptFetch(() => fetchAll((p) => client.listPrompts(resolvedAppId, p))),
                 attemptFetch(() => fetchAll((p) => client.listWorkflows(resolvedAppId, p))),
@@ -13795,6 +14339,7 @@ export function registerConfigSyncCommands(sync) {
                 attemptFetch(() => client.listCronTriggers(resolvedAppId)),
                 attemptFetch(() => client.listBlobBuckets(resolvedAppId)),
                 attemptFetch(() => client.listScripts(resolvedAppId)),
+                attemptFetch(() => client.listFunctions(resolvedAppId)),
                 attemptFetch(() => client.listAppConfigVars(resolvedAppId)),
                 attemptFetch(() => client.listDatabaseTypeConfigs(resolvedAppId)),
                 attemptFetch(() => client.listRuleSets(resolvedAppId)),
@@ -13810,6 +14355,7 @@ export function registerConfigSyncCommands(sync) {
             const cronTriggerItemsDiff = gate(cronTriggersOutcomeDiff, "cron-triggers", { items: [] }).items || [];
             const blobBucketsDiffResult = gate(blobBucketsOutcomeDiff, "blob-buckets", { items: [] });
             const scriptItemsDiff = gate(scriptsOutcomeDiff, "transforms", { items: [] }).items || [];
+            const functionItemsDiff = gate(functionsOutcomeDiff, "functions", { items: [] }).items || [];
             const remoteVarItemsDiff = gate(varsOutcomeDiff, "vars", []);
             const databaseTypeConfigsDiff = gate(databaseTypeConfigsOutcomeDiff, "database-type-configs", []);
             const ruleSetsDiff = gate(ruleSetsOutcomeDiff, "rule-sets", []);
@@ -14114,6 +14660,25 @@ export function registerConfigSyncCommands(sync) {
                     localScripts.set(name, readFileSync(join(transformsDirPath, file), "utf-8"));
                 }
             }
+            // Server functions — #3179. Two axes, exactly as push has: the
+            // header/version fields through the shared spec, and the CODE through
+            // `envelopeHash`. The code axis is why a function's diff builds the
+            // bundle: a comment-only edit to a source file changes nothing the
+            // table can see and is still a change push will apply.
+            const remoteFunctions = new Map(functionItemsDiff
+                .filter((f) => f?.functionKey && String(f.status ?? "active") !== "archived")
+                .map((f) => [f.functionKey, f]));
+            const localFunctionsParsed = new Map();
+            const functionsDirPath = join(configDir, "functions");
+            if (functionsOutcomeDiff.ok && existsSync(functionsDirPath)) {
+                for (const file of readdirSync(functionsDirPath).filter((f) => f.endsWith(".toml"))) {
+                    const filePath = join(functionsDirPath, file);
+                    const tomlData = parseTomlFile(filePath);
+                    const key = tomlData.function?.key || basename(file, ".toml");
+                    withDerivedIdentity(tomlData, "function", { key });
+                    localFunctionsParsed.set(key, { tomlData, filePath });
+                }
+            }
             // Config vars — issue #1423. The remote vars were fetched through the
             // ok/error gate above (`remoteVarItemsDiff`); the local `vars.toml` is
             // read only when that fetch succeeded.
@@ -14377,6 +14942,89 @@ export function registerConfigSyncCommands(sync) {
                     differences.push({ type: "prompt", key, status: remoteOnlyStatus("prompts", key) });
                 }
             }
+            // Server functions — #3179.
+            const functionSpecDiff = configDiffSpec("function");
+            const functionDiffMaps = {
+                ruleSetIdToName: new Map(),
+                ruleSetNameToId: new Map(),
+            };
+            for (const [key, local] of localFunctionsParsed) {
+                const remote = remoteFunctions.get(key);
+                if (!remote) {
+                    differences.push({
+                        type: "function",
+                        key,
+                        status: localOnlyStatus("functions", key),
+                    });
+                    continue;
+                }
+                let status = "exists";
+                let hint;
+                // The active version carries `entry`, `durable` and `limits`, and its
+                // `envelopeHash` is the code axis.
+                const versionOutcome = await attemptFetch(async () => {
+                    if (!remote.activeConfigId)
+                        return null;
+                    const { items } = await client.listFunctionConfigs(resolvedAppId, remote.functionId);
+                    return ((items || []).find((c) => String(c.configId) === String(remote.activeConfigId)) ?? null);
+                });
+                if (!versionOutcome.ok) {
+                    hint = "content not compared (fetch failed)";
+                }
+                else {
+                    const active = versionOutcome.value;
+                    const verdict = compareLocalToRemote(functionSpecDiff, local.tomlData, remote, functionDiffMaps, active ?? undefined);
+                    status = verdict.status;
+                    hint = verdict.hint;
+                    if (status === "exists") {
+                        // The header agrees; the code is the other half. Building here is
+                        // what makes "config diff is clean immediately after pull" a
+                        // statement about the SOURCES and not just the TOML.
+                        try {
+                            const built = await buildFunctionConfigPush({
+                                configDir,
+                                functionKey: key,
+                                filePath: local.filePath,
+                                tomlData: local.tomlData,
+                            });
+                            if (!active ||
+                                String(active.envelopeHash ?? "") !== built.envelopeHash) {
+                                status = "modified";
+                                hint =
+                                    "the built bundle or a source file differs — `config push` " +
+                                        "creates a new immutable version";
+                            }
+                        }
+                        catch (err) {
+                            if (err instanceof FunctionBuildError) {
+                                // #2880 — the file is not pushable, so the row says so
+                                // rather than reading as Synced. This is the state a
+                                // function created through the API and never pushed lands
+                                // in: pull can only serialize the header, so the file has
+                                // no `entry` and the very next push refuses it. A Synced row
+                                // there tells the operator there is nothing to do about a
+                                // file nothing can apply.
+                                status = VALIDATION_ERROR;
+                                hint = err.message.split("\n")[0];
+                            }
+                            else {
+                                hint = "content not compared (comparison failed)";
+                            }
+                        }
+                    }
+                }
+                hint = outOfServiceHint(remote, hint);
+                differences.push({ type: "function", key, status, hint });
+            }
+            for (const key of remoteFunctions.keys()) {
+                if (!localFunctionsParsed.has(key)) {
+                    differences.push({
+                        type: "function",
+                        key,
+                        status: remoteOnlyStatus("functions", key),
+                    });
+                }
+            }
             // Workflows — #1175: content-aware comparison.
             //
             // For workflows present on BOTH sides we no longer stop at key