primitive-admin 1.1.0-alpha.75 → 1.1.0-alpha.76

package/dist/src/commands/sync.js

@@ -35,11 +35,11 @@ import { buildPayloadFromToml, projectEntityToPayload, projectRecordToToml, toml
 import { CONFIG_SURFACES, isEmptyForEmit, } from "../lib/generated-config-surfaces.js";
 // #3179 — the function's two halves: the header payloads and the envelope
 // `config push` sends, and the bytes `config pull` writes back.
-import { applyFunctionPull, buildFunctionConfigPush, buildFunctionCreatePayload, buildFunctionUpdatePayload, collectManifestForPreflight, functionDiffEntity, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
+import { applyFunctionPull, buildFunctionConfigPush, buildFunctionCreatePayload, buildFunctionUpdatePayload, functionDiffEntity, planFunctionPull, serializeFunction, } from "../lib/function-sync.js";
 import { FunctionBuildError } from "../lib/function-bundle.js";
-// #3182 — the local half of grant validation. The grammar is the vendored
+// #3182 — the local half of capability validation. The grammar is the vendored
 // module the server also imports; this is where an author's own file is read.
-import { configObjectKeysFromTree, databaseTypesFromServer, databaseTypesFromTree, functionGrantErrors, functionNeedsManifest, mergeKnownDatabaseTypes, mergeKnownGrantTargets, } from "../lib/function-grants-preflight.js";
+import { configObjectKeysFromTree, functionGrantErrors, mergeKnownGrantTargets, } from "../lib/function-grants-preflight.js";
 // #3182 — the typed handle's generated declarations and the compiler wiring
 // that makes an editor load them.
 import { functionTypeWiringProblems, staleFunctionTypeArtifacts, writeFunctionTypeArtifacts, } from "../lib/function-db-types.js";
@@ -3209,6 +3209,114 @@ export function diffProjectedRecords(local, remote) {
     }
     return diffs;
 }
+/**
+ * The paths at which two projected records disagree, named the way the FILE
+ * spells them (#3267) — what a `config diff` Modified row prints.
+ *
+ * `diffProjectedRecords` answers at the granularity of the projection, and
+ * for a database type that is too coarse to act on: the 27 operations arrive
+ * as one `operations` extra, the whole `[models.*]` tree as one `schema`
+ * string. A row that read Modified for a reason the operator could not see —
+ * an empty params set spelled two ways, an operation block the file declares
+ * twice — was undiagnosable from the CLI. So this walks INTO each differing
+ * field: a keyed child collection (`spec.childKeys`) is compared row by row
+ * and named `operations["getInstitution"].params`, with a row only one side
+ * has or that the file repeats named as such; a TOML-string field
+ * (`spec.tomlFields`) is parsed on both sides and named by the path inside it
+ * (`schema (models.Institution.fields.name.required)`); everything else is
+ * walked as a value to its first differing leaf.
+ *
+ * Paths come back in projected-key order, keyed rows in key order, so the
+ * list is stable across runs, and every leaf is its own entry — a schema
+ * that differs in seven model fields is seven paths, so the caller's "+N
+ * more" cap counts them the way it counts operations. A value the walk
+ * cannot descend into (an array of a different length, a scalar against an
+ * object) is named at the level it stopped.
+ */
+export function describeProjectedDifferences(spec, local, remote) {
+    const paths = [];
+    for (const { field, local: l, server: r } of diffProjectedRecords(local, remote)) {
+        const childKey = spec.childKeys?.[field];
+        if (childKey && Array.isArray(l) && Array.isArray(r)) {
+            paths.push(...keyedChildDifferences(field, childKey, l, r));
+            continue;
+        }
+        if (spec.tomlFields?.includes(field) && typeof l === "string" && typeof r === "string") {
+            let inner;
+            try {
+                inner = valueDifferences("", parseConfigToml(l), parseConfigToml(r));
+            }
+            catch {
+                // A side that does not parse is named as the whole field below.
+            }
+            if (inner) {
+                if (inner.length === 0) {
+                    paths.push(field);
+                }
+                else {
+                    paths.push(...inner.map((path) => `${field} (${path})`));
+                }
+                continue;
+            }
+        }
+        paths.push(...valueDifferences(field, l, r));
+    }
+    return paths;
+}
+/** The leaf paths under `path` at which two values differ (see above). */
+function valueDifferences(path, a, b) {
+    if (canonicalJsonStringify(a) === canonicalJsonStringify(b))
+        return [];
+    const join = (key) => (path ? `${path}.${key}` : key);
+    if (isPlainObject(a) && isPlainObject(b)) {
+        const keys = [...new Set([...Object.keys(a), ...Object.keys(b)])].sort();
+        return keys.flatMap((key) => valueDifferences(join(key), a[key], b[key]));
+    }
+    if (Array.isArray(a) && Array.isArray(b) && a.length === b.length) {
+        return a.flatMap((item, i) => valueDifferences(`${path}[${i}]`, item, b[i]));
+    }
+    return [path || "(document)"];
+}
+/**
+ * A keyed child collection's differences, row by row. A key the file repeats
+ * is named as the cause rather than compared: the server keys rows by it, so
+ * only one of the blocks landed and no push can make the two sides agree
+ * while the file says two things under one name.
+ */
+function keyedChildDifferences(field, key, local, remote) {
+    const label = (k) => `${field}[${JSON.stringify(k)}]`;
+    const localByKey = new Map();
+    for (const row of local) {
+        const k = String(row?.[key] ?? "");
+        localByKey.set(k, [...(localByKey.get(k) ?? []), row]);
+    }
+    const remoteByKey = new Map(remote.map((row) => [String(row?.[key] ?? ""), row]));
+    const keys = [...new Set([...localByKey.keys(), ...remoteByKey.keys()])].sort();
+    const paths = [];
+    for (const k of keys) {
+        const rows = localByKey.get(k);
+        const remoteRow = remoteByKey.get(k);
+        if (rows && rows.length > 1) {
+            paths.push(`${label(k)} (declared ${rows.length} times locally)`);
+        }
+        else if (!rows) {
+            paths.push(`${label(k)} (server only)`);
+        }
+        else if (remoteRow === undefined) {
+            paths.push(`${label(k)} (local only)`);
+        }
+        else {
+            paths.push(...valueDifferences(label(k), rows[0], remoteRow));
+        }
+    }
+    return paths;
+}
+function isPlainObject(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        typeof value.toJSON !== "function");
+}
 /**
  * The differing fields the definition says an UPDATE does not accept (#2731 B8).
  *
@@ -3415,7 +3523,6 @@ const CONFIG_DIFF_SPECS = {
             capabilities: Array.isArray(entity.capabilities)
                 ? [...entity.capabilities].map((c) => String(c)).sort()
                 : [],
-            unscopedReads: entity.unscopedReads === true,
         }),
         describe: (entity) => `function "${entity?.functionKey}"`,
     },
@@ -3692,6 +3799,8 @@ const CONFIG_DIFF_SPECS = {
             subscriptions: byKey(entity.__subscriptions, "subscriptionKey"),
             _unresolvedRuleSetName: entity._unresolvedRuleSetName,
         }),
+        childKeys: { operations: "name", subscriptions: "subscriptionKey" },
+        tomlFields: ["schema"],
         ruleSetRef: true,
         describe: (entity) => `database type "${entity?.databaseType}"`,
     },
@@ -3786,9 +3895,11 @@ export function compareLocalToRemote(spec, localParsed, remoteRecord, maps = {
         const localHash = computeExpandedContentHash(pair.local);
         if (remoteHash === localHash)
             return { status: "exists" };
+        // #3267 — WHICH field, ahead of the remedy, so a row that differs for a
+        // reason the operator cannot see in the file is diagnosable from the CLI.
         return {
             status: "modified",
-            hint: "run `config pull` to rewrite the local TOML to match running state",
+            hint: namedDifferences(describeProjectedDifferences(spec, pair.local, pair.remote)) + "run `config pull` to rewrite the local TOML to match running state",
         };
     }
     catch {
@@ -3797,6 +3908,24 @@ export function compareLocalToRemote(spec, localParsed, remoteRecord, maps = {
         return { status: "exists", hint: "content not compared (comparison failed)" };
     }
 }
+/**
+ * How many differing paths a Modified row names before saying "+N more"
+ * (#3267). Enough to see the shape of a difference at a glance; the row is
+ * one line of a whole-tree diff, not the place to print 27 operations.
+ */
+const NAMED_DIFFERENCE_LIMIT = 5;
+/**
+ * The `differs in …; ` prefix of a Modified row's hint (#3267), or nothing
+ * when the walk could name no path — the hash still differs, so the row is
+ * still Modified, but the hint then says only what it always said.
+ */
+function namedDifferences(paths) {
+    if (paths.length === 0)
+        return "";
+    const shown = paths.slice(0, NAMED_DIFFERENCE_LIMIT).join(", ");
+    const more = paths.length - NAMED_DIFFERENCE_LIMIT;
+    return `differs in ${shown}${more > 0 ? ` (+${more} more)` : ""}; `;
+}
 /** Hash a LOCAL config file's definition-projected field set (#2644). */
 export function hashLocalConfigForDiff(spec, parsedToml, maps, extra) {
     return computeExpandedContentHash(projectLocalConfig(spec, parsedToml, maps, extra));
@@ -8310,52 +8439,35 @@ export function registerConfigSyncCommands(sync) {
                     preflightValidationErrors.push(`  vars.toml: ${err?.message || String(err)}`);
                 }
             }
-            // #3182 — a function's database grants, checked against the author's
-            // own file before anything is applied. The grammar and the
-            // unscoped-read rule are purely local; whether a grant names a type and
-            // model that will exist is answered against the tree's own
-            // `database-type-configs/` (applied BEFORE functions since this child)
-            // merged with the types the server already has. If the live listing
-            // cannot be fetched and the tree declares no types, the target check is
-            // skipped and the server — which is authoritative — has the last word.
+            // #3182 — a function's capabilities, checked against the author's own
+            // file before anything is applied. The grammar is purely local (and
+            // since #3279 it keeps three kinds: `integration:<key>`,
+            // `secret:<NAME>` and the high-blast opt-ins — a retired grant string
+            // is refused here with the retirement); whether an `integration:`
+            // names an integration that will exist is answered against the
+            // tree's own `integrations/` (applied BEFORE functions) merged with
+            // the integrations the server already has. If the live listing cannot
+            // be fetched and the tree declares none, the target check is skipped
+            // and the server — which is authoritative — has the last word.
             const preflightFunctionsDir = join(configDir, "functions");
             if (existsSync(preflightFunctionsDir)) {
                 const functionFiles = selectFiles("function", preflightFunctionsDir, readdirSync(preflightFunctionsDir).filter((f) => f.endsWith(".toml")));
                 if (functionFiles.length > 0) {
-                    const treeTypes = databaseTypesFromTree(configDir);
-                    let knownTypes = null;
-                    try {
-                        const live = await client.listDatabaseTypeConfigs(resolvedAppId);
-                        knownTypes = mergeKnownDatabaseTypes(databaseTypesFromServer(Array.isArray(live) ? live : []), treeTypes);
-                    }
-                    catch {
-                        knownTypes = treeTypes.size > 0 ? treeTypes : null;
-                    }
-                    // #3183 — the same question for the two grant families that name
-                    // config-tree objects. `secret:` and `var:` are absent on purpose
-                    // (D3183-002): their values are provisioned per environment, out
-                    // of band, so a tree can never answer for them.
                     const treeTargets = configObjectKeysFromTree(configDir);
                     let knownTargets = null;
                     try {
-                        const [integrations, prompts] = await Promise.all([
-                            client.listIntegrations(resolvedAppId, { status: "active" }),
-                            client.listPrompts(resolvedAppId, { status: "active" }),
-                        ]);
+                        const integrations = await client.listIntegrations(resolvedAppId, {
+                            status: "active",
+                        });
                         knownTargets = mergeKnownGrantTargets({
                             integrations: new Set((integrations?.items ?? [])
                                 .map((row) => String(row?.integrationKey ?? ""))
                                 .filter(Boolean)),
-                            prompts: new Set((prompts?.items ?? [])
-                                .map((row) => String(row?.promptKey ?? ""))
-                                .filter(Boolean)),
                         }, treeTargets);
                     }
                     catch {
                         knownTargets =
-                            treeTargets.integrations.size > 0 || treeTargets.prompts.size > 0
-                                ? treeTargets
-                                : null;
+                            treeTargets.integrations.size > 0 ? treeTargets : null;
                     }
                     for (const file of functionFiles) {
                         const filePath = join(preflightFunctionsDir, file);
@@ -8367,37 +8479,10 @@ export function registerConfigSyncCommands(sync) {
                             preflightValidationErrors.push(`  ${filePath}: ${err?.message || String(err)}`);
                             continue;
                         }
-                        // #3187 — a read grant declared without `unscopedReads = true`
-                        // is accepted when the tree's registered reads are all bound to
-                        // `$caller`, and only the MANIFEST says whether they are. So the
-                        // functions whose decision depends on it are built and collected
-                        // here, before anything is applied; the result is memoized
-                        // against the built bundle, so the push below does not run the
-                        // tree's module scope a second time (CR3187-001).
-                        let manifest = null;
-                        if (functionNeedsManifest(tomlData)) {
-                            try {
-                                manifest = await collectManifestForPreflight({
-                                    configDir,
-                                    // The same key the push loop derives, so a refusal names
-                                    // the function the way the rest of the run does.
-                                    functionKey: tomlData.function?.key || basename(file, ".toml"),
-                                    tomlData,
-                                });
-                            }
-                            catch (err) {
-                                // Fail-closed and early: the push would refuse this tree for
-                                // the same reason, naming the same error.
-                                preflightValidationErrors.push(`  ${filePath}: ${err?.message || String(err)}`);
-                                continue;
-                            }
-                        }
                         for (const message of functionGrantErrors({
                             filePath,
                             tomlData,
-                            knownTypes,
                             knownTargets,
-                            manifest,
                         })) {
                             preflightValidationErrors.push(`  ${message}`);
                         }
@@ -12838,7 +12923,7 @@ export function registerConfigSyncCommands(sync) {
             //
             // A function pushes on TWO axes and they are deliberately independent:
             //
-            //   - the HEADER (`[function]`'s gate, runAs, schemas, plus the three
+            //   - the HEADER (`[function]`'s gate, schemas, plus the three
             //     version-carried keys, all compared through the shared gate), and
             //   - the CODE — the authored TOML bytes, every source file and the
             //     built bundle, sent as one immutable config VERSION.
@@ -15422,7 +15507,7 @@ export function registerConfigSyncCommands(sync) {
             // below). Content comparison is a preview of `config pull` (pull would
             // rewrite the local TOML to match running state), exactly like the
             // workflow/transform blocks.
-            const compareConfigType = (typeLabel, slot, localParsed, remoteEntities, hashLocal, hashRemote, contentComparable) => {
+            const compareConfigType = (typeLabel, slot, localParsed, remoteEntities, compare, contentComparable) => {
                 for (const [key, parsed] of localParsed) {
                     if (!remoteEntities.has(key)) {
                         differences.push({ type: typeLabel, key, status: localOnlyStatus(slot, key) });
@@ -15437,16 +15522,10 @@ export function registerConfigSyncCommands(sync) {
                         hint = "content not compared (rule sets unavailable)";
                     }
                     else {
-                        try {
-                            if (hashLocal(parsed) !== hashRemote(remoteEntities.get(key))) {
-                                status = "modified";
-                                hint = "run `config pull` to rewrite the local TOML to match running state";
-                            }
-                        }
-                        catch {
-                            // A malformed local file must not abort the whole diff.
-                            hint = "content not compared (comparison failed)";
-                        }
+                        // The shared verdict names the differing field (#3267) and
+                        // degrades a malformed local file to "not compared" rather than
+                        // aborting the whole diff.
+                        ({ status, hint } = compare(parsed, remoteEntities.get(key)));
                     }
                     differences.push({ type: typeLabel, key, status, hint });
                 }
@@ -15465,7 +15544,7 @@ export function registerConfigSyncCommands(sync) {
             };
             const compareByDefinition = (label, slot, localParsed, remoteEntities, contentComparable) => {
                 const spec = configDiffSpec(label);
-                compareConfigType(label, slot, localParsed, remoteEntities, (p) => hashLocalConfigForDiff(spec, p, diffMaps), (e) => hashRemoteConfigForDiff(spec, e, diffMaps), contentComparable);
+                compareConfigType(label, slot, localParsed, remoteEntities, (p, e) => compareLocalToRemote(spec, p, e, diffMaps), contentComparable);
             };
             compareByDefinition("rule-set", "ruleSets", localRuleSetsParsed, remoteRuleSets, true);
             compareByDefinition("group-type-config", "groupTypeConfigs", localGroupTypeConfigsParsed, remoteGroupTypeConfigs, ruleSetsOk);
@@ -15497,20 +15576,14 @@ export function registerConfigSyncCommands(sync) {
                         hint = "content not compared (fetch failed)";
                     }
                     else {
-                        try {
-                            const operations = Array.isArray(opsOutcome.value) ? opsOutcome.value : [];
-                            const subscriptions = Array.isArray(subsOutcome.value) ? subsOutcome.value : [];
-                            const dbSpec = configDiffSpec("database-type-config");
-                            const remoteHash = hashRemoteConfigForDiff(dbSpec, remote, diffMaps, { operations, subscriptions });
-                            const localHash = hashLocalConfigForDiff(dbSpec, parsed, diffMaps);
-                            if (remoteHash !== localHash) {
-                                status = "modified";
-                                hint = "run `config pull` to rewrite the local TOML to match running state";
-                            }
-                        }
-                        catch {
-                            hint = "content not compared (comparison failed)";
-                        }
+                        const operations = Array.isArray(opsOutcome.value) ? opsOutcome.value : [];
+                        const subscriptions = Array.isArray(subsOutcome.value) ? subsOutcome.value : [];
+                        // The shared verdict (#3267): a Modified row names the
+                        // operation, subscription, model field or `[type]` scalar it
+                        // differs in, and a comparison that throws degrades this one
+                        // row to "not compared". The ops/subscriptions are the remote
+                        // side's extra only — the file already carries its own.
+                        ({ status, hint } = compareLocalToRemote(configDiffSpec("database-type-config"), parsed, remote, diffMaps, { operations, subscriptions }));
                     }
                 }
                 differences.push({ type: "database-type-config", key, status, hint });