primitive-admin 1.1.0-alpha.73 → 1.1.0-alpha.75

package/dist/src/lib/sync-paths.d.ts

@@ -1,39 +1,71 @@
 /**
  * Sync data path resolution.
  *
- * Per issue #373, sync state is scoped by environment AND by app:
+ * The COMMITTED tree lives at
  *
- *   <projectRoot>/.primitive/sync/<env>/<appId>/
+ *   <projectRoot>/primitive/<env>/
  *
- * This ensures that switching environments (dev -> prod) or apps never
- * clobbers sync state from another slot. Push to dev and then to prod
- * see independent "last synced" pointers, so prod won't falsely believe
- * dev's changes are already in sync.
+ * — one directory per environment, and nothing else in the path. There is no
+ * app segment (#3153): since #3152 an environment names exactly one app, so
+ * the segment only duplicated what the environment already said, and it made
+ * the path unreadable. Per-environment partitioning is what issue #373 was
+ * actually about, and it is unchanged: push to dev and then to prod still see
+ * independent "last synced" pointers.
+ *
+ * MACHINE-LOCAL state stays hidden, under `<projectRoot>/.primitive/`. Snapshot
+ * backups keep BOTH partitions there — `<env>/<appId>/` — because an
+ * environment can be rebound to a different app, and a snapshot taken against
+ * the former one must not be restorable through the new one (#578, #373).
  *
  * When the user still passes `--dir <path>` (the legacy flag) we honor
  * it and store sync state inside that directory, same as before. This
  * keeps pre-project-config workflows working.
  */
+/** The sync-state baseline, committed beside the environment's TOML (#3153). */
+export declare const SYNC_STATE_FILENAME = ".sync-state.json";
+/** Its pre-#3153 name. Detected so a missed rename is loud, never read. */
+export declare const LEGACY_SYNC_STATE_FILENAME = ".primitive-sync.json";
 export interface ResolveSyncDirOptions {
-    /** The resolved app ID for this sync operation. */
-    appId: string;
     /**
      * If the user passed `--dir <path>` on the command line, forward it
      * here. Explicit user input always wins.
      */
     userDir?: string;
 }
+export interface ResolveSnapshotsRootOptions extends ResolveSyncDirOptions {
+    /** The resolved app ID this snapshot slot belongs to. */
+    appId: string;
+}
+/**
+ * The sync-state baseline for a config directory.
+ *
+ * Refuses — with the same migration message every other reader gives — a
+ * directory that still holds the pre-#3153 filename and not the new one. A
+ * silently un-renamed baseline would read as "nothing has ever been synced",
+ * which turns the first `config diff` after a migration into a full-tree diff
+ * and the first push into a re-create of everything.
+ */
+export declare function syncStatePath(configDir: string): string;
+/**
+ * The same refusal as a preflight: asked at the TOP of a tree command, before
+ * a request is sent, a snapshot is copied, or a directory is created.
+ *
+ * `syncStatePath` alone refuses too late for that — a pull reaches it only
+ * after fetching the whole server export, backing the tree up (legacy baseline
+ * and all) and scaffolding the directories it is about to write. The refusal
+ * has to cost nothing in either tree, so it runs before any of that.
+ */
+export declare function assertSyncStateLayout(configDir: string): void;
 /**
  * Returns the directory that should hold TOML files + sync state for the
  * current sync operation.
  *
  * Resolution order:
  *   1. If userDir is set, return it as-is (legacy behavior).
- *   2. If we're in project mode, return
- *      <projectRoot>/.primitive/sync/<env>/<appId>
+ *   2. If we're in project mode, return <projectRoot>/primitive/<env>
  *   3. Otherwise fall back to "./config" (the old default).
  */
-export declare function resolveSyncDir(options: ResolveSyncDirOptions): string;
+export declare function resolveSyncDir(options?: ResolveSyncDirOptions): string;
 /**
  * Returns the snapshot-backups root for the slot a given sync operation
  * belongs to (issue #578, Phase 1). Snapshots reuse the SAME resolution chain
@@ -45,11 +77,15 @@ export declare function resolveSyncDir(options: ResolveSyncDirOptions): string;
  *   1. If userDir (legacy `--dir`) is set, snapshots live in a sibling
  *      `<userDir>/.snapshots/` so revert works without a project root
  *      (Fork 4 — designed explicitly).
- *   2. In project mode, the project sibling
- *      `<projectRoot>/.primitive/sync-backups/<env>/<appId>/`.
+ *   2. In project mode, the machine-local
+ *      `<projectRoot>/.primitive/backups/<env>/<appId>/`. The app partition
+ *      survives the tree's loss of it (#3153): backups are not committed, so
+ *      the no-app-ID rule does not govern them, and the partition is what
+ *      stops `config revert` restoring a former app's snapshot after an
+ *      environment is rebound.
  *   3. Otherwise (bare `./config` legacy default), `./config-snapshots`.
  */
-export declare function resolveSnapshotsRoot(options: ResolveSyncDirOptions): string;
+export declare function resolveSnapshotsRoot(options: ResolveSnapshotsRootOptions): string;
 export declare function assertSafePathComponent(value: string, label: string): void;
 /**
  * Returns true if the path we'd use for sync data is the auto-resolved
@@ -60,7 +96,7 @@ export declare function isAutoResolvedSyncDir(userDir: string | undefined): bool
  * Ensures the sync directory exists, creating it (and parents) if
  * necessary. Returns the path.
  */
-export declare function ensureSyncDir(options: ResolveSyncDirOptions): string;
+export declare function ensureSyncDir(options?: ResolveSyncDirOptions): string;
 /**
  * Checks whether an old-style sync state file exists at `./config/.primitive-sync.json`
  * (the pre-project-config default path). Returns a warning message if found and
@@ -96,7 +132,7 @@ export interface LegacyDatabaseTypesDirNotice {
  * managed type's file would read as deleted.
  *
  * Both messages render RESOLVED paths. The config directory defaults to
- * `<projectRoot>/.primitive/sync/<env>/<appId>/` and the CLI is invoked from
+ * `<projectRoot>/primitive/<env>/` and the CLI is invoked from
  * the project root, so a bare `git mv database-types database-type-configs`
  * would fail there — and fail differently again under `--dir`.
  *

package/dist/src/lib/sync-paths.js

@@ -1,14 +1,21 @@
 /**
  * Sync data path resolution.
  *
- * Per issue #373, sync state is scoped by environment AND by app:
+ * The COMMITTED tree lives at
  *
- *   <projectRoot>/.primitive/sync/<env>/<appId>/
+ *   <projectRoot>/primitive/<env>/
  *
- * This ensures that switching environments (dev -> prod) or apps never
- * clobbers sync state from another slot. Push to dev and then to prod
- * see independent "last synced" pointers, so prod won't falsely believe
- * dev's changes are already in sync.
+ * — one directory per environment, and nothing else in the path. There is no
+ * app segment (#3153): since #3152 an environment names exactly one app, so
+ * the segment only duplicated what the environment already said, and it made
+ * the path unreadable. Per-environment partitioning is what issue #373 was
+ * actually about, and it is unchanged: push to dev and then to prod still see
+ * independent "last synced" pointers.
+ *
+ * MACHINE-LOCAL state stays hidden, under `<projectRoot>/.primitive/`. Snapshot
+ * backups keep BOTH partitions there — `<env>/<appId>/` — because an
+ * environment can be rebound to a different app, and a snapshot taken against
+ * the former one must not be restorable through the new one (#578, #373).
  *
  * When the user still passes `--dir <path>` (the legacy flag) we honor
  * it and store sync state inside that directory, same as before. This
@@ -17,27 +24,61 @@
 import { existsSync, mkdirSync } from "fs";
 import { join } from "path";
 import { getCurrentEnvironment } from "./env-resolver.js";
+import { PrimitiveEnvError, PROJECT_LOCAL_STATE_DIR, PROJECT_TREE_DIR, staleLayoutMessage, } from "./env-resolver-core.js";
+/** The sync-state baseline, committed beside the environment's TOML (#3153). */
+export const SYNC_STATE_FILENAME = ".sync-state.json";
+/** Its pre-#3153 name. Detected so a missed rename is loud, never read. */
+export const LEGACY_SYNC_STATE_FILENAME = ".primitive-sync.json";
+/**
+ * The sync-state baseline for a config directory.
+ *
+ * Refuses — with the same migration message every other reader gives — a
+ * directory that still holds the pre-#3153 filename and not the new one. A
+ * silently un-renamed baseline would read as "nothing has ever been synced",
+ * which turns the first `config diff` after a migration into a full-tree diff
+ * and the first push into a re-create of everything.
+ */
+export function syncStatePath(configDir) {
+    const current = join(configDir, SYNC_STATE_FILENAME);
+    if (!existsSync(current)) {
+        const legacy = join(configDir, LEGACY_SYNC_STATE_FILENAME);
+        if (existsSync(legacy)) {
+            throw new PrimitiveEnvError("stale-layout", staleLayoutMessage(`${legacy} has not been renamed to ${SYNC_STATE_FILENAME}.`), legacy);
+        }
+    }
+    return current;
+}
+/**
+ * The same refusal as a preflight: asked at the TOP of a tree command, before
+ * a request is sent, a snapshot is copied, or a directory is created.
+ *
+ * `syncStatePath` alone refuses too late for that — a pull reaches it only
+ * after fetching the whole server export, backing the tree up (legacy baseline
+ * and all) and scaffolding the directories it is about to write. The refusal
+ * has to cost nothing in either tree, so it runs before any of that.
+ */
+export function assertSyncStateLayout(configDir) {
+    syncStatePath(configDir);
+}
 /**
  * Returns the directory that should hold TOML files + sync state for the
  * current sync operation.
  *
  * Resolution order:
  *   1. If userDir is set, return it as-is (legacy behavior).
- *   2. If we're in project mode, return
- *      <projectRoot>/.primitive/sync/<env>/<appId>
+ *   2. If we're in project mode, return <projectRoot>/primitive/<env>
  *   3. Otherwise fall back to "./config" (the old default).
  */
-export function resolveSyncDir(options) {
+export function resolveSyncDir(options = {}) {
     if (options.userDir)
         return options.userDir;
     const env = safeEnv();
     if (env) {
-        // Defence-in-depth: appId is expected to be a ULID from the server, but
-        // we must never trust it blindly when building file-system paths. Reject
-        // anything that contains path separators or `..` sequences before
-        // joining it into <projectRoot>/.primitive/sync/...
-        assertSafePathComponent(options.appId, "appId");
-        return join(env.projectRoot, ".primitive", "sync", env.name, options.appId);
+        // Defence-in-depth: the environment name comes from a hand-edited config
+        // file and is the only variable segment left in the tree path, so reject
+        // separators and `..` before joining it into <projectRoot>/primitive/...
+        assertSafePathComponent(env.name, "environment name");
+        return join(env.projectRoot, PROJECT_TREE_DIR, env.name);
     }
     return "./config";
 }
@@ -52,8 +93,12 @@ export function resolveSyncDir(options) {
  *   1. If userDir (legacy `--dir`) is set, snapshots live in a sibling
  *      `<userDir>/.snapshots/` so revert works without a project root
  *      (Fork 4 — designed explicitly).
- *   2. In project mode, the project sibling
- *      `<projectRoot>/.primitive/sync-backups/<env>/<appId>/`.
+ *   2. In project mode, the machine-local
+ *      `<projectRoot>/.primitive/backups/<env>/<appId>/`. The app partition
+ *      survives the tree's loss of it (#3153): backups are not committed, so
+ *      the no-app-ID rule does not govern them, and the partition is what
+ *      stops `config revert` restoring a former app's snapshot after an
+ *      environment is rebound.
  *   3. Otherwise (bare `./config` legacy default), `./config-snapshots`.
  */
 export function resolveSnapshotsRoot(options) {
@@ -64,8 +109,9 @@ export function resolveSnapshotsRoot(options) {
     if (env) {
         // Same defence-in-depth as resolveSyncDir: never trust appId blindly when
         // building a file-system path.
+        assertSafePathComponent(env.name, "environment name");
         assertSafePathComponent(options.appId, "appId");
-        return join(env.projectRoot, ".primitive", "sync-backups", env.name, options.appId);
+        return join(env.projectRoot, PROJECT_LOCAL_STATE_DIR, "backups", env.name, options.appId);
     }
     return "./config-snapshots";
 }
@@ -92,7 +138,7 @@ export function isAutoResolvedSyncDir(userDir) {
  * Ensures the sync directory exists, creating it (and parents) if
  * necessary. Returns the path.
  */
-export function ensureSyncDir(options) {
+export function ensureSyncDir(options = {}) {
     const dir = resolveSyncDir(options);
     if (!existsSync(dir)) {
         mkdirSync(dir, { recursive: true });
@@ -116,14 +162,14 @@ function safeEnv() {
  * their old sync data won't be picked up automatically.
  */
 export function checkLegacySyncMigration(currentSyncDir) {
-    const legacySync = join(".", "config", ".primitive-sync.json");
+    const legacySync = join(".", "config", LEGACY_SYNC_STATE_FILENAME);
     if (!existsSync(legacySync))
         return null;
     // Only warn if the resolved dir is different from the legacy default.
     const legacyDir = join(".", "config");
     if (currentSyncDir === legacyDir)
         return null;
-    return (`Detected old sync state at ./config/.primitive-sync.json. ` +
+    return (`Detected old sync state at ./config/${LEGACY_SYNC_STATE_FILENAME}. ` +
         `The config directory now lives at ${currentSyncDir}. ` +
         `Run 'primitive config pull' to re-sync into the new location.`);
 }
@@ -154,7 +200,7 @@ function shellQuote(path) {
  * managed type's file would read as deleted.
  *
  * Both messages render RESOLVED paths. The config directory defaults to
- * `<projectRoot>/.primitive/sync/<env>/<appId>/` and the CLI is invoked from
+ * `<projectRoot>/primitive/<env>/` and the CLI is invoked from
  * the project root, so a bare `git mv database-types database-type-configs`
  * would fail there — and fail differently again under `--dir`.
  *

package/dist/src/lib/sync-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-paths.js","sourceRoot":"","sources":["../../../src/lib/sync-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAY1D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,wEAAwE;QACxE,yEAAyE;QACzE,kEAAkE;QAClE,oDAAoD;QACpD,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CACT,GAAG,CAAC,WAAW,EACf,YAAY,EACZ,MAAM,EACN,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,0EAA0E;QAC1E,+BAA+B;QAC/B,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CACT,GAAG,CAAC,WAAW,EACf,YAAY,EACZ,cAAc,EACd,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA2B;IAC/D,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAA8B;IAC1D,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,cAAsB;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CACL,4DAA4D;QAC5D,qCAAqC,cAAc,IAAI;QACvD,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAejE;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,UAA8C,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,UAAU;YAC7D,GAAG,UAAU,iBAAiB,SAAS,EAAE;QAC3C,CAAC,CAAC,aAAa,SAAS,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,GAAG,WAAW,qDAAqD;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,iCAAiC;QACnC,CAAC,CAAC,sEAAsE;YACtE,yEAAyE,CAAC;IAE9E,MAAM,OAAO,GACX,GAAG,UAAU,qDAAqD;QAClE,GAAG,WAAW,mBAAmB,KAAK,OAAO,WAAW,EAAE,CAAC;IAC7D,MAAM,UAAU,GACd,2BAA2B,UAAU,+BAA+B;QACpE,uCAAuC,WAAW,mBAAmB;QACrE,uEAAuE;QACvE,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,SAAS;QAChE,OAAO,WAAW,EAAE,CAAC;IAEvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"sync-paths.js","sourceRoot":"","sources":["../../../src/lib/sync-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAejE;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,kBAAkB,CAChB,GAAG,MAAM,4BAA4B,mBAAmB,GAAG,CAC5D,EACD,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,aAAa,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,0EAA0E;QAC1E,+BAA+B;QAC/B,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACtD,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CACT,GAAG,CAAC,WAAW,EACf,uBAAuB,EACvB,SAAS,EACT,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA2B;IAC/D,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC,EAAE;IAC/D,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,cAAsB;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CACL,uCAAuC,0BAA0B,IAAI;QACrE,qCAAqC,cAAc,IAAI;QACvD,+DAA+D,CAChE,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAejE;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,UAA8C,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,UAAU;YAC7D,GAAG,UAAU,iBAAiB,SAAS,EAAE;QAC3C,CAAC,CAAC,aAAa,SAAS,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,GAAG,WAAW,qDAAqD;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,iCAAiC;QACnC,CAAC,CAAC,sEAAsE;YACtE,yEAAyE,CAAC;IAE9E,MAAM,OAAO,GACX,GAAG,UAAU,qDAAqD;QAClE,GAAG,WAAW,mBAAmB,KAAK,OAAO,WAAW,EAAE,CAAC;IAC7D,MAAM,UAAU,GACd,2BAA2B,UAAU,+BAA+B;QACpE,uCAAuC,WAAW,mBAAmB;QACrE,uEAAuE;QACvE,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,SAAS;QAChE,OAAO,WAAW,EAAE,CAAC;IAEvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}

package/dist/src/lib/sync-resource-types.d.ts

@@ -3,7 +3,7 @@
  * into a sync slot (issue #1659).
  *
  * `config pull` writes one file per server entity and records what it wrote in
- * `.primitive-sync.json` (`SyncState.entities[<slot>]`). Until #1659 it never
+ * `.sync-state.json` (`SyncState.entities[<slot>]`). Until #1659 it never
  * removed a local file whose entity had disappeared server-side, so the next
  * `config push` — which treats local TOML as the source of truth — silently
  * re-created the just-deleted entity.
@@ -122,7 +122,7 @@ export declare function attemptFetch<T>(fn: () => Promise<T>): Promise<{
 }>;
 /**
  * A filename must stay inside its type's directory. State is read from a file
- * on disk, so a corrupt or hand-edited `.primitive-sync.json` must never be
+ * on disk, so a corrupt or hand-edited `.sync-state.json` must never be
  * able to steer an `unlinkSync` outside the sync slot.
  */
 export declare function isSafeSyncFilename(filename: string): boolean;
@@ -264,8 +264,10 @@ export interface PruneResult {
  * sidecar `<key>.tests/` directory.
  *
  * A file with uncommitted git edits is kept and reported instead: the operator
- * may be mid-way through authoring a change they meant to push. Everything
- * removed here is recoverable from the pre-pull snapshot via `config revert`.
+ * may be mid-way through authoring a change they meant to push — and for an
+ * entity that owns source files beyond its TOML (#3179), an edit to any of them
+ * keeps the whole entity. Everything removed here is recoverable from the
+ * pre-pull snapshot via `config revert`.
  */
 export declare function applyPrune(options: {
     configDir: string;
@@ -276,6 +278,23 @@ export declare function applyPrune(options: {
         blockType?: string;
         blockKey?: string;
     }>;
+    /**
+     * Further tree-relative files this entity owns, from the prior sync state
+     * (#3179). A server function is its `functions/<key>.toml` PLUS the
+     * TypeScript its `entry` reaches, which lives at paths only the state knows —
+     * so removing the file alone would leave orphaned code that the next push
+     * would try to capture again. Returned paths are confined to the config tree;
+     * anything else is ignored rather than followed.
+     */
+    extraFilesForKey?: (key: string) => string[];
+    /**
+     * Tree-relative paths that SURVIVE this prune because another entity still
+     * owns them (#3179). Two functions may import the same module, and the
+     * pulled sources of both list it; deleting it with one would leave the other
+     * unbuildable while its sync state still called it current. A shared path is
+     * left alone and reported.
+     */
+    retainedFiles?: Set<string>;
     logger?: (msg: string) => void;
 }): Promise<PruneResult>;
 /** Address a prior-state entry for detail-fetch and delete. */

package/dist/src/lib/sync-resource-types.js

@@ -3,7 +3,7 @@
  * into a sync slot (issue #1659).
  *
  * `config pull` writes one file per server entity and records what it wrote in
- * `.primitive-sync.json` (`SyncState.entities[<slot>]`). Until #1659 it never
+ * `.sync-state.json` (`SyncState.entities[<slot>]`). Until #1659 it never
  * removed a local file whose entity had disappeared server-side, so the next
  * `config push` — which treats local TOML as the source of truth — silently
  * re-created the just-deleted entity.
@@ -13,7 +13,7 @@
  * test-directory block type. The pull write loops deliberately stay as they are
  * — this table is layout metadata, not a write framework.
  */
-import { existsSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync } from "fs";
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, } from "fs";
 import { basename, dirname, join, resolve, sep } from "path";
 import { parseConfigToml } from "./config-toml.js";
 const tomlFile = (key) => `${key}.toml`;
@@ -104,6 +104,21 @@ export const SYNC_RESOURCE_TYPES = [
         // Server drains `scriptsByApp` across all pages (#1668).
         listingComplete: true,
     },
+    {
+        // #3179 — server functions. `functions/<key>.toml` states the function and
+        // names its `entry`; the TypeScript the entry reaches lives beside it in
+        // the same tree and is captured into the version envelope on push, so the
+        // entity spans more than its one file. Prune removes the TOML; the sources
+        // it pulled are tracked in the state slot and removed with it.
+        label: "function",
+        dir: "functions",
+        ext: ".toml",
+        stateSlot: "functions",
+        fileFromKey: tomlFile,
+        // Server drains `functionsByApp` across all pages (#1668's rule, applied at
+        // birth in `server-functions-controller.ts`).
+        listingComplete: true,
+    },
     {
         label: "database-type-config",
         dir: "database-type-configs",
@@ -180,7 +195,7 @@ export async function attemptFetch(fn) {
 }
 /**
  * A filename must stay inside its type's directory. State is read from a file
- * on disk, so a corrupt or hand-edited `.primitive-sync.json` must never be
+ * on disk, so a corrupt or hand-edited `.sync-state.json` must never be
  * able to steer an `unlinkSync` outside the sync slot.
  */
 export function isSafeSyncFilename(filename) {
@@ -386,16 +401,37 @@ export function classifyLocalOnly(priorEntities, slot, key) {
     const managed = (priorEntities?.[slot] ?? {});
     return key in managed ? LOCAL_ONLY_ABSENT : LOCAL_ONLY_NEW;
 }
+/**
+ * Whether `target` is still inside `root` once symlinks are resolved.
+ *
+ * A lexical prefix check answers a question about strings; this one answers the
+ * question the `unlinkSync` actually asks. `functions/shared` pointing at an
+ * external directory passes the string test and deletes someone else's file.
+ */
+function realPathStaysInside(root, target) {
+    try {
+        if (lstatSync(target).isSymbolicLink())
+            return false;
+        const realRoot = realpathSync(root);
+        const real = realpathSync(target);
+        return real.startsWith(realRoot + sep);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Remove the local files for `keys` (as decided by `planPrune`), along with any
  * sidecar `<key>.tests/` directory.
  *
  * A file with uncommitted git edits is kept and reported instead: the operator
- * may be mid-way through authoring a change they meant to push. Everything
- * removed here is recoverable from the pre-pull snapshot via `config revert`.
+ * may be mid-way through authoring a change they meant to push — and for an
+ * entity that owns source files beyond its TOML (#3179), an edit to any of them
+ * keeps the whole entity. Everything removed here is recoverable from the
+ * pre-pull snapshot via `config revert`.
  */
 export async function applyPrune(options) {
-    const { configDir, resourceType, keys, testCaseEntities, logger } = options;
+    const { configDir, resourceType, keys, testCaseEntities, extraFilesForKey, retainedFiles, logger, } = options;
     const log = logger ?? (() => { });
     const result = {
         prunedKeys: [],
@@ -409,19 +445,65 @@ export async function applyPrune(options) {
         const filePath = join(configDir, resourceType.dir, filename);
         if (!existsSync(filePath))
             continue;
+        // #3179 — the entity's own source files, recorded by the pull that wrote
+        // them. Each path is re-confined here: it came out of a JSON file on disk,
+        // so a corrupt or hand-edited sync state must never steer an `unlinkSync`
+        // out of the tree — lexically first, then against the real path, because a
+        // symlinked directory inside the tree resolves outside it.
+        const extras = [];
+        for (const extra of extraFilesForKey?.(key) ?? []) {
+            if (retainedFiles?.has(extra)) {
+                log(`  Kept ${extra} — another entity still uses it`);
+                continue;
+            }
+            const target = resolve(configDir, extra);
+            const root = resolve(configDir);
+            if (target === root || !target.startsWith(root + sep)) {
+                log(`  Skipped removing '${extra}' — it resolves outside the config tree`);
+                continue;
+            }
+            if (!existsSync(target))
+                continue;
+            if (!realPathStaysInside(root, target)) {
+                log(`  Skipped removing '${extra}' — a symlink takes it outside the config tree`);
+                continue;
+            }
+            extras.push({ relative: extra, absolute: target });
+        }
         // Untracked does not mean edited: in a sync dir that was never committed
         // (or in no repository at all) every pulled file is untracked, and counting
         // that as a local edit would keep every stale file and leave #1659 unfixed.
+        //
+        // The entity's source files are asked the same question BEFORE anything is
+        // removed (#3179): a half-pruned function — TOML gone, edited TypeScript
+        // kept — is neither state the operator can act on, so an edit anywhere in
+        // the entity keeps all of it.
+        const edited = [];
         if (await hasUncommittedChanges(filePath, { includeUntracked: false })) {
+            edited.push(relativePath);
+        }
+        for (const extra of extras) {
+            if (await hasUncommittedChanges(extra.absolute, { includeUntracked: false })) {
+                edited.push(extra.relative);
+            }
+        }
+        if (edited.length > 0) {
             result.keptWithLocalEdits.push(key);
-            log(`  Kept ${relativePath} — ${ABSENT_FROM_EXPORT} but the file has ` +
-                "uncommitted local edits; remove it yourself or re-create the entity on the server");
+            log(`  Kept ${relativePath} — ${ABSENT_FROM_EXPORT} but ${edited.join(", ")} ` +
+                "has uncommitted local edits; remove it yourself or re-create the entity on the server");
             continue;
         }
         unlinkSync(filePath);
         result.prunedKeys.push(key);
         result.removed.push(relativePath);
         log(`  Removed ${relativePath} — ${ABSENT_FROM_EXPORT}`);
+        for (const extra of extras) {
+            if (!existsSync(extra.absolute))
+                continue;
+            unlinkSync(extra.absolute);
+            result.removed.push(extra.relative);
+            log(`  Removed ${extra.relative} — ${ABSENT_FROM_EXPORT}`);
+        }
         // #2645 — the entity's named config bodies go with it. They describe
         // configurations of a block the server no longer has, and leaving them
         // would have the next push re-create the block from its own leftovers.
@@ -673,6 +755,22 @@ export const PUSH_PRUNE_SPECS = [
             await c.deletePrompt(a, id, true);
         },
     },
+    {
+        // #3179 — server functions. Hard-delete rather than archive, following the
+        // same reasoning as every sibling: an archived function keeps holding its
+        // key in the app's SINGLE key namespace, which now blocks not just another
+        // function but a workflow, a script or a webhook wanting that key, with no
+        // way to reclaim it from `config`. The hard delete is also what destroys
+        // the versions' R2 objects, so a pruned function leaves no bundles behind.
+        resourceType: pruneTypeFor("function"),
+        keyFromFile: tomlDeclaredKeyFromFile("function", "key"),
+        addressOf: addressById,
+        fetchDetail: (c, a, id) => c.getFunction(a, id),
+        modifiedAtOf: pruneModifiedAt,
+        deleteEntity: async (c, a, id) => {
+            await c.deleteFunction(a, id, { hard: true });
+        },
+    },
     {
         resourceType: pruneTypeFor("workflow"),
         keyFromFile: tomlDeclaredKeyFromFile("workflow", "key"),