primitive-admin 1.2.0-alpha.1 → 1.2.0-alpha.10

package/dist/src/commands/sync.d.ts

@@ -1,11 +1,11 @@
 import { Command } from "commander";
 import { ApiClient } from "../lib/api-client.js";
-import { type OperationFormHints } from "../lib/toml-database-config.js";
-import { type FieldForm } from "../lib/toml-native-form.js";
+import { type PullWriteTally } from "../lib/pull-write.js";
 import { type PushMode } from "../lib/config-payload.js";
 import { type ConfigObjectSurface, type ConfigTable } from "../lib/generated-config-surfaces.js";
 import { type PromptKind } from "../lib/generated-config-surfaces.js";
-import { type AgentFunctionFacts } from "../lib/generated-config-surfaces.js";
+import { type AgentFunctionFact, type AgentFunctionFacts } from "../lib/generated-config-surfaces.js";
+import { type AgentSchemaConfigFact } from "../lib/generated-config-surfaces.js";
 import { type DocumentSchemaResolution } from "../lib/function-document-types.js";
 import { type PresenceOutcome, type TestBlockType } from "../lib/sync-resource-types.js";
 export { resolveSlugCollisions, slugifyTestCaseName, testCaseFileBasenames, } from "../lib/test-case-file-names.js";
@@ -38,15 +38,6 @@ export declare function wrapEntityError(err: unknown, action: "create" | "update
  */
 export declare function wrapPromptConfigError(err: unknown, action: "create" | "update" | "activate", promptKey: string, configName: string | undefined): Error;
 export declare function computeFileHash(filePath: string): string;
-/**
- * A transform's comparison hash: the script body itself (#2731 B7).
- *
- * Unlike the config types there is no projection to do — the `.rhai` bytes are
- * exactly what push sends and exactly what diff compares — so the "semantic"
- * hash is just a stable hash of the body, computable from a server response
- * without going through the file.
- */
-export declare function computeScriptBodyHash(body: string): string;
 export declare function shouldPushFile(filePath: string, storedHash: string | undefined): boolean;
 /**
  * Hash the *expanded* (post-fragment-splice) content of a workflow TOML.
@@ -69,114 +60,6 @@ export declare function computeExpandedContentHash(parsed: any): string;
  * push-skip cache for any workflow that references them.
  */
 export declare function shouldPushExpandedFile(parsed: any, storedHash: string | undefined): boolean;
-/**
- * The `[workflow].activeConfigName` a file actually states, trimmed — or
- * `undefined` when the file has no opinion about activation.
- *
- * Push reads the key the same way: `applyWorkflowConfigSidecars` activates a
- * configuration only for a truthy name and otherwise leaves the running one
- * alone (`cli/src/lib/workflow-config-apply.ts`). Every diff decision about
- * activation keys off this one predicate so the comparison cannot claim a
- * difference push has no way to reconcile (#2743, review follow-up).
- */
-export declare function authoredActiveConfigName(parsed: any): string | undefined;
-/**
- * The configuration a server workflow is RUNNING — its `activeConfigId`, or the
- * first config as the fallback `serializeWorkflow` has always used, so pull's
- * `activeConfigName` and the diff's reading of it can never disagree.
- */
-export declare function resolveActiveWorkflowConfig(workflow: any, configs: any[]): any;
-/**
- * Normalize a parsed workflow TOML object into the form the SERVER would hold
- * after a `config push` of that file. Used by `diff` so a hand-authored workflow
- * compares equal to the running state it already describes — while a server
- * value that genuinely differs still shows as Modified.
- *
- * In order:
- *   1. Trim the fields the server trims (`name`, `description`).
- *   2. Drop explicit-empty authored values — a `""` string or an empty
- *      `capabilities` array. Push sends these as `null` (or the model default),
- *      and the pull serializer omits the key for a cleared field, so "spelled
- *      out as empty" and "absent" have to hash the same (#2743).
- *   3. Lowercase the two enums and floor the five queue limits, mirroring the
- *      server's accepted-value canonicalization
- *      (`src/workflows/config/workflow-field-handlers.ts`). A value the server
- *      would REJECT is left alone: push fails loudly for those, so there is
- *      nothing to preview. #2743 — without this, `dequeueOrder = "LIFO"` or
- *      `perUserMaxRunning = 4.9` pushes fine and then reports Modified forever.
- *   4. Fill the model defaults (`WORKFLOW_MODEL_DEFAULTS`) for what the file
- *      omits. `perAppMax*` / `queueTtlSeconds` joined that list in #1177: once
- *      the pull serializer emitted them (a GET always returns them, they carry
- *      a non-null model default), an unchanged workflow hashed unequal to a
- *      local TOML that omits them — a false `modified` that made `config pull`
- *      rewrite the file just to inject defaults. (`status` was on this list
- *      until #2803 took availability off the config wire entirely.)
- *   5. Fill `activeConfigName` with the name the server itself creates
- *      (`default`), so a hand-authored file that never named a config compares
- *      equal to the workflow that pushing it produces (#2743). This is the
- *      compare-BY-NAME case only: when the local file names no configuration at
- *      all, `config diff` hashes both sides with `compareActivation: false` and
- *      the fill never decides anything.
- *   6. Fill `key` from `resolvedKey` when the file omits it. `[workflow].key`
- *      is optional — push and diff both resolve it from the FILENAME
- *      (`tomlData.workflow?.key || basename(file, ".toml")`) — while the pull
- *      serializer always emits it. Without this a file relying on the filename
- *      hashes unequal to the very workflow it describes and reports Modified
- *      forever, which is exactly the non-convergence #2743 removes. Callers
- *      that already know the resolved key pass it; the rest leave the key as
- *      authored.
- *
- * Only the DIFF-hash path (`hashWorkflowTomlForDiff`) normalizes; the stored
- * content-hash path that push's skip check compares is untouched, so upgrading
- * forces no one-time re-push (same note as #1446's schema canonicalization).
- *
- * Returns a shallow clone with a normalized `workflow` table; the input is
- * not mutated. Non-workflow TOML (no `workflow` table) is returned unchanged.
- */
-export declare function normalizeWorkflowTomlDefaults(parsed: any, resolvedKey?: string): any;
-/**
- * Canonical content hash of a workflow TOML for `diff`'s content comparison.
- * Applies `normalizeWorkflowTomlDefaults` first so omitted-vs-defaulted fields
- * don't spuriously diff, then runs the same `computeExpandedContentHash` that
- * pull stores and push compares. Both the local file and the
- * `serializeWorkflow`-produced remote form flow through this single function,
- * so the two sides are normalized identically by construction.
- *
- * `resolvedKey` is the key the caller already paired the two sides on (the
- * `[workflow].key`, or the filename when the file omits it). Passing it lets a
- * file that relies on the filename fallback hash equal to the remote form,
- * which always spells the key out — see `normalizeWorkflowTomlDefaults`.
- *
- * `compareActivation: false` drops `activeConfigName` from the hash. `config diff`
- * passes it when the local file names no configuration: push activates nothing
- * for such a file, so the configuration the server happens to be running is not
- * a difference push could ever reconcile, and hashing it in would report the
- * workflow Modified after every successful push — the non-convergence #2743
- * exists to remove (review follow-up). The remote name stays visible as a hint
- * on the Synced row instead. Defaults to comparing, so the include-reconcile
- * path (`reconcileWorkflowIncludes`, which asks whether the local file already
- * expands to the running state) keeps seeing activation as content.
- */
-export declare function hashWorkflowTomlForDiff(parsed: any, resolvedKey?: string, options?: {
-    compareActivation?: boolean;
-}): string;
-/**
- * Build the canonical content hash for a *server* workflow (as returned by
- * `getWorkflow` + active `getWorkflowConfig`), mirroring exactly what a fresh
- * `config pull` would write to disk. Serializes via `serializeWorkflow`, parses
- * the resulting TOML (remote serialized TOML never carries `include`s, so a
- * plain `parseConfigToml` is sufficient — no fragment path needed), then hashes
- * through `hashWorkflowTomlForDiff` so it lines up with the local-file hash.
- *
- * `logger` is optional but `config diff` passes it: the serializer's
- * unrecognized-server-key warning (#2644) is the only signal that this CLI
- * version cannot represent a field the server holds, and a diff that swallowed
- * it would report the workflow as in sync with no hint that anything is
- * missing.
- */
-export declare function hashRemoteWorkflowForDiff(workflow: any, draft: any, configs: any[], logger?: (message: string) => void, options?: {
-    compareActivation?: boolean;
-}): string;
 export interface ParsedAuthSettings {
     settings: Record<string, any>;
     warnings: string[];
@@ -253,44 +136,6 @@ export declare function planScopedVarsPull(serverVars: Array<{
     content: string;
     varEntities: Record<string, VarEntity>;
 };
-/**
- * Validate a `config push`'s webhook writes against the server's per-app cap.
- * Returns a list of human-readable errors (empty when the push may proceed).
- *
- * Run in `config push`'s up-front preflight (the `planVarsPush` cap pattern) so a
- * push that would run past the cap aborts BEFORE any mutation. Without it the
- * push creates webhooks one at a time until the server rejects one at the cap,
- * leaving a partial push.
- *
- * **Only creates are capped.** The server grandfathers apps that already hold
- * more webhooks than the cap: it refuses new creates and nothing else. A plain
- * file count would break that — `config pull` writes one toml per webhook, so a
- * grandfathered app pulls more files than the cap and could then never push
- * again, its workflows, databases and vars included. So the check compares the
- * local keys against the keys already on the server: a push that creates
- * nothing new is always allowed, however far over the cap the app is, and a
- * push that does create is rejected only when the resulting row count would
- * exceed the cap.
- *
- * The remote key list this runs against comes from `GET
- * /admin/api/apps/{appId}/webhooks`, which applies no default status filter, so
- * archived rows are in `remoteKeys` exactly as they are in the server's count.
- * The two therefore agree on what is already on the server.
- *
- * Still advisory rather than authoritative: this counts creates the way the
- * *config dir* implies, while the apply loop decides create-vs-update from
- * local sync state, so a checkout with missing sync state issues creates this
- * check did not predict. Those creates name keys the server already holds, and
- * the server does not cap a create that adds no row — it answers 409
- * `WEBHOOK_KEY_EXISTS`, which `adoptByKeyOnCreate409` converges on. A push
- * allowed here can still be rejected server-side (concurrent writes, a stale
- * list); that rejection carries `WEBHOOK_LIMIT_REACHED` and names the limit.
- *
- * Planned prunes are deliberately NOT netted out of the count: `--prune` runs
- * after the webhook create loop, so a push that only fits once its prunes land
- * would still fail mid-apply. Prune first, then push the additions.
- */
-export declare function validateWebhookCapForPush(localKeys: string[], remoteKeys: string[]): string[];
 /**
  * Validate a parsed `vars.toml` table against the same key/value constraints
  * the server enforces (key format, string type, non-empty, size cap) plus the
@@ -314,6 +159,10 @@ export declare function validateWebhookCapForPush(localKeys: string[], remoteKey
  */
 export declare function validateVarsFile(parsedVars: Record<string, unknown>, options?: {
     onlyKeys?: ReadonlySet<string>;
+    /** The file the entries came from, for the messages (#4485). */
+    fileName?: string;
+    /** Skip the count cap — the caller measures it on a layered set (#4485). */
+    skipCountCap?: boolean;
 }): string[];
 /**
  * Plan the config-var writes a `config push` should make, detecting concurrent
@@ -418,114 +267,17 @@ export declare function countVarsAfterPush(remoteVars: Array<{
  * local value). Pure and side-effect-free so it's unit-testable without a live
  * server.
  */
-export declare function diffVars(localVars: Map<string, string>, remoteVars: Map<string, string>): Array<{
+export declare function diffVars(localVars: Map<string, string>, remoteVars: Map<string, string>, 
+/**
+ * The file `config pull` would write a server value into — a machine-local
+ * environment's override file (#4485). Defaults to `vars.toml`.
+ */
+pullTargetFile?: string): Array<{
     type: "var";
     key: string;
     status: string;
     hint?: string;
 }>;
-/**
- * Which of a workflow's configs `config pull` writes as sidecar files
- * (issue #2645, spec §Contracts/Named configs).
- *
- * Every config EXCEPT the active one. The active config's body is already the
- * `steps` at the top of `workflows/<key>.toml` — that is where authors edit it
- * and where `applyWorkflowBody` writes it — so emitting it again as a sidecar
- * would put the same body in two files and create a mismatch to adjudicate on
- * the next push. Two declarations of one piece of state is the shape of problem
- * this whole issue removes; it would be perverse to introduce one here.
- *
- * A config whose steps were not fetched is SKIPPED rather than written empty.
- * A sidecar is a claim about the server, and `steps = []` is a claim that would
- * tell the next push to blank a live configuration.
- *
- * Pure, so the selection is unit-testable without a live server.
- */
-export declare function workflowConfigSidecarsToWrite(workflow: any, configs: any[]): Array<{
-    name: string;
-    content: string;
-}>;
-/**
- * The names a workflow's configs occupy on the server, whatever their body.
- *
- * `workflowConfigSidecarsToWrite` deliberately skips a config whose steps were
- * not fetched, so it cannot answer "which sidecar files are stale". This can:
- * a local file whose name is absent HERE names a config the server no longer
- * has, which is the only safe basis for deleting it (issue #2645, review
- * follow-up).
- */
-export declare function workflowConfigNamesOnServer(workflow: any, configs: any[]): Set<string>;
-/**
- * Delete the sidecars naming a config the server no longer has (#2645).
- *
- * Pull is what makes the repo describe the server, and a sidecar left behind
- * after its config was archived — or after that config became the active one,
- * whose body is the workflow file's `steps` — is a file that would RE-CREATE it
- * on the next push. The repo would then be silently undoing the archive.
- *
- * Returns the file names removed, so pull can say what it did.
- */
-export declare function removeStaleWorkflowConfigSidecars(configDir: string, key: string, namesOnServer: Set<string>): string[];
-/**
- * The content hash `config push` skips a workflow on — sidecars included.
- *
- * The stored hash used to cover `workflows/<key>.toml` alone, so editing or
- * adding a named config sidecar without touching the workflow file left the
- * hash unchanged: push reported success and made no call at all, which is
- * worse than failing (issue #2645, review follow-up). The named configs are
- * part of what push applies, so they are part of what push compares.
- *
- * A workflow with no sidecars hashes exactly as before, so the common case
- * does not re-push once on upgrade. An unreadable sidecar hashes to a distinct
- * value rather than throwing: a hash is a comparison, and the parse error
- * belongs to the apply path, which raises it with the file name attached.
- */
-export declare function workflowHashInput(configDir: string, key: string, parsedWorkflowToml: any): any;
-/** See `workflowHashInput`. */
-export declare function computeWorkflowContentHash(configDir: string, key: string, parsedWorkflowToml: any): string;
-/**
- * Canonical hash of a named config sidecar, for `config diff` (#2645).
- *
- * Hashes the parsed body rather than the bytes so comment and key-order
- * differences do not read as drift — the same semantic comparison `config diff`
- * makes everywhere else (spec criterion 3).
- */
-export declare function hashWorkflowConfigSidecar(parsed: any): string;
-/**
- * Does the file's `[workflow].activeConfigName` name a configuration that the
- * push could actually activate (#2743, review follow-up)?
- *
- * The diff normalizer equates an omitted `activeConfigName` with `default` —
- * the name the server itself gives the config it creates — so a file that
- * spells `default` out hashes equal to the omitted form. For a workflow with no
- * configuration at all (a legacy row the GET's auto-migration could not heal),
- * the remote side serializes an EMPTY active config name and normalizes to
- * `default` too, so the pair hashes equal while `config push` would stop on
- * `activeConfigName "default" names no configuration`. Reporting Synced for a
- * file whose next push fails is the one drift a change gate must not skip.
- *
- * A name the repo carries as a sidecar resolves: push creates that config and
- * activates it (and the sidecar comparison already reports the difference).
- * Read-only and non-throwing, like every other diff predicate.
- */
-export declare function workflowActiveConfigNameUnresolvable(configDir: string, key: string, localParsed: any, configs: any[]): boolean;
-/**
- * The `config diff` note for a workflow whose file names no configuration while
- * the server runs one other than the `default` it creates itself (#2743, review
- * follow-up).
- *
- * Such a file is not drift push can act on: activation is preserved, not
- * converged, so the row is Synced — the alternative, reporting Modified,
- * repeats forever because no push changes it. But the repo does not describe
- * which configuration is live, and only `config pull` records it, so the fact is
- * carried as a hint on the Synced row — the same way an operational disable is
- * (`outOfServiceHint`). The server-created `default` is the shape a
- * hand-authored file already means, so it is silent.
- *
- * Pure and non-throwing, like every other diff predicate. Returns the existing
- * hint untouched when there is nothing to add.
- */
-export declare function unmanagedActiveConfigHint(localParsed: any, workflow: any, configs: any[], existingHint?: string): string | undefined;
 /**
  * Drop the archived rows from a pull listing (#2803).
  *
@@ -624,53 +376,34 @@ export declare function outOfServiceHint(remote: any, existingHint?: string): st
 /**
  * Serialize an integration DETAIL response to its `integrations/<key>.toml`.
  *
- * #2631: `accessRule` is the CEL expression gating who may call the
- * integration. It comes back on the detail only (not the list summary), and it
- * is written to TOML so `config pull` → `config push` round-trips the rule instead
- * of clearing it. A null/empty rule has no TOML representation and is simply
- * omitted; the push path sends `null` for an omitted rule, which matches the
- * server state it came from.
+ * The `[integration]` keys come from the vendored definition, so the
+ * deprecated `accessRule` (#4872) is never written, even from a server that
+ * still returns it.
  */
 export declare function serializeIntegration(integration: any, logger?: (message: string) => void): string;
 /**
  * Build the `config push` body for one integration TOML.
  *
- * `accessRule` follows the #1567 TOML-owned rule: send value-or-`null` so
- * removing the line from the file clears the rule server-side rather than
- * leaving a stale one live. There is deliberately NO local "rule is required"
- * check here — a remote integration missing from local sync state is pushed as
- * a create, expected to 409, and adopted by key (#1006); a local check would
- * strand that path. The server decides (#2631).
+ * The deprecated `accessRule` line (#4872) is accepted in the file and never
+ * sent: the body carries the definition's fields only.
  */
 export declare function buildIntegrationPushPayload(key: string, tomlData: any, { mode }?: {
     mode?: PushMode;
 }): Record<string, any>;
-export declare function webhookConfigToTomlTable(scheme: string, config: any): Record<string, any> | undefined;
-export declare function tomlTableToWebhookConfig(scheme: string, table: any): Record<string, any> | undefined;
-export declare function serializeWebhook(webhook: any, logger?: (message: string) => void): string;
+export declare function serializeBlobBucket(bucket: any, ruleSetIdToName?: Map<string, string>, logger?: (message: string) => void): string;
 /**
- * Build the `config push` body for one webhook TOML.
+ * The entity a `blob-buckets/<key>.toml` describes (#4116) — the parse
+ * `config push` builds its bodies from and `config diff` compares.
  *
- * The `[webhook]`-derived half comes from the vendored definition; the four
- * structural tables the file also carries (`[allowedIps]`, `[inputMapping]`,
- * `[metadata]`, `[verification.<scheme>]`) keep their own conversion, which is
- * why the definition declares them `structural` rather than as fields.
- */
-export declare function buildWebhookPushPayload(key: string, tomlData: any, { mode }?: {
-    mode?: PushMode;
-}): Record<string, any>;
-export declare function serializeCronTrigger(trigger: any, logger?: (message: string) => void): string;
-/**
- * Build the `config push` body for one cron-trigger TOML.
+ * Read in CREATE mode, so the immutable `ttlTier` stays nameable. The rule set
+ * is left as `_ruleSetName` for `resolveRuleSetReference`. The id spelling
+ * `ruleSetId` is a retired key (#4283): the preflight refuses a file carrying
+ * it, and this parse never reads it.
  *
- * `state` is absent from the create body because the definition says the create
- * handler assigns it (`writableOn: ["update"]`) — the CLI used to send it and
- * the server used to drop it silently.
+ * An omitted `name` stays omitted: the update leaves the server's name alone,
+ * and only the create body falls back to the key.
  */
-export declare function buildCronTriggerPushPayload(key: string, tomlData: any, { mode }?: {
-    mode?: PushMode;
-}): Record<string, any>;
-export declare function serializeBlobBucket(bucket: any, logger?: (message: string) => void): string;
+export declare function parseBlobBucketToml(doc: any): any;
 /**
  * Build the PATCH payload for a blob-bucket update from local TOML.
  *
@@ -726,35 +459,14 @@ export declare function promptConfigPayload(tomlConfig: any, options?: {
     create?: boolean;
 }): Record<string, any>;
 /**
- * Build the POST body for a blob-bucket create from local TOML.
+ * Build the POST body for a blob-bucket create from the parsed entity
+ * (`parseBlobBucketToml`, its rule set resolved).
  *
  * `ttlTier` is here and absent from the update body because the definition says
  * so (`writableOn: ["create"]`) — the retention tier is fixed at creation.
  */
 export declare function buildBlobBucketCreatePayload(key: string, bucket: any): Record<string, any>;
 export declare function serializePrompt(prompt: any, logger?: (message: string) => void): string;
-/**
- * The `config push` warning for a resource pushed with no `accessRule` (#2652).
- *
- * Returns `null` when a rule is declared — and for a `runAs = "system"`
- * workflow, which rejects any rule and cannot be started by a member at all.
- * Otherwise it names the resource, the consequence, and the one-line restore,
- * because after the #2652 flip a ruleless prompt or caller workflow denies
- * every non-admin caller from the deploy onward.
- *
- * Both kinds now push `accessRule` as value-or-`null` — the prompt since #1567,
- * the workflow since #2743's always-send conversion — so for either one an
- * omitted key really does leave the resource ruleless on the server. The
- * workflow wording says so explicitly, because it used to say the opposite
- * (the update path preserved a stored rule) and an operator who learned that
- * caveat needs to see it retracted.
- */
-export declare function missingAccessRuleWarning(opts: {
-    kind: "prompt" | "workflow";
-    key: string;
-    accessRule: unknown;
-    runAs?: unknown;
-}): string | null;
 /**
  * Build the `config push` body for one prompt TOML's `[prompt]` table.
  *
@@ -819,25 +531,6 @@ export declare function seededOnlyPromptConfigFields(firstConfig: any, seededCon
 export declare function buildPromptConfigPayload(tomlConfig: any, { mode }?: {
     mode?: PushMode;
 }): Record<string, any>;
-/**
- * Rewrite a workflow TOML file's string-form `inputSchema` / `outputSchema` to
- * native object form for `config migrate-toml` (issue #1446).
- *
- * Purely local, no server fetch. Parses the raw source WITHOUT expanding
- * fragment `include`s (so those directives survive the rewrite), swaps a
- * JSON-string schema for its parsed object when it round-trips faithfully
- * (`canEmitNative === null`), and re-serializes via `stringifyConfigToml`.
- *
- * Only rewrites when a field is actually converted: a file whose schemas are
- * already native, absent, or un-representable (a `null` default) is returned
- * with `changed: false` and its original bytes untouched — so migrate is
- * idempotent and never reports a spurious migration or reformats a file it
- * didn't need to touch.
- */
-export declare function rewriteWorkflowSchemasToNative(rawToml: string, workflowKey?: string, log?: (message: string) => void): {
-    content: string;
-    changed: boolean;
-};
 /**
  * #2644 — `config push` rejects any key the vendored definition does not
  * recognize, so a mistyped or newer-server key fails locally instead of being
@@ -849,6 +542,13 @@ export declare function rewriteWorkflowSchemasToNative(rawToml: string, workflow
  * the third `[[configs]]` block is as loud as one in the first.
  */
 export declare function configUnknownKeyError(filePath: string, tomlData: any, table: ConfigTable): string | null;
+/**
+ * The warnings `config push` prints for one file that still carries a
+ * DEPRECATED key (#4872): the registry's dated sentence per key, prefixed with
+ * the file. The key is accepted and ignored, so these never fail the push;
+ * `[]` for a file that carries none.
+ */
+export declare function configDeprecatedKeyWarnings(filePath: string, tomlData: any, table: ConfigTable): string[];
 /**
  * #2644 — the document-level half of the same rejection: a top-level table the
  * object's definition does not declare, or a field table written with the wrong
@@ -858,7 +558,7 @@ export declare function configUnknownKeyError(filePath: string, tomlData: any, t
  * Unrecognized keys INSIDE a table were already rejected; a mistyped table
  * HEADER was not, and it is the more destructive of the two — `[integraton]`
  * leaves `[integration]` absent, so the push builder reads an empty table and
- * sends `description: null` / `accessRule: null`, CLEARING them server-side.
+ * sends `description: null`, CLEARING it server-side.
  * The design gate settled the posture (2026-08-12): push rejects everything
  * unknown, tables included.
  */
@@ -891,6 +591,26 @@ export interface ConfigFileValidationError {
     /** The messages, verbatim — the same text `config push` aborts with. */
     messages: string[];
 }
+/**
+ * The `SyncState.entities` slots of the object types #3190 retired. A state
+ * file written before the retirement still carries them; `config pull` drops
+ * them and says so once (`retiredSyncStateSlots`).
+ */
+export declare const RETIRED_SYNC_STATE_SLOTS: readonly ["workflows", "scripts", "webhooks", "cronTriggers"];
+/** The retired slots a prior state holds records in, in declaration order. */
+export declare function retiredSyncStateSlots(entities: unknown): string[];
+/**
+ * The retirement sentences for every retired object directory a config tree
+ * still holds (#3190), in the table's order. `config push` refuses the tree on
+ * any of them and `config diff` reports the same rows.
+ */
+export declare function retiredConfigDirectoriesIn(configDir: string): string[];
+/**
+ * The files a config tree still holds under a retired type-config directory
+ * (#4731), as one refusal per directory naming each file. An empty directory
+ * an older pull left behind holds nothing to apply and is not refused.
+ */
+export declare function retiredTypeConfigFilesIn(configDir: string): string[];
 /**
  * `config push`'s preflight — every check the authored files decide on their
  * own, run before the FIRST mutating call (#976 fix A, #3320, #3375).
@@ -926,9 +646,23 @@ export declare function runConfigPushPreflight(input: {
     syncState: SyncState | null;
     force: boolean;
     isCrossAppPush: boolean;
-    client: Pick<ApiClient, "listIntegrations" | "listFunctions">;
+    /**
+     * The environment is machine-local (#4117): `[app].name` is the shared
+     * tree's, never this app's, so it is out of the validated body.
+     */
+    localEnvironment?: boolean;
+    client: Pick<ApiClient, "listIntegrations" | "listFunctions" | "listPrompts" | "listPromptConfigs">;
+    /** #4485 — the environment's vars override file, layered over vars.toml. */
+    varsOverridePath?: string | null;
 }): Promise<{
     parsedVars: Record<string, unknown> | null;
+    /** #4441 — agent files to apply before the functions leg. */
+    agentFilesFirst: string[];
+    /** #4485 — which override keys replace or add, when an override was read. */
+    varsOverrideKeys: {
+        overridingKeys: string[];
+        addedKeys: string[];
+    } | null;
 }>;
 export declare function promptKindFileErrors(filePath: string, tomlData: any): string[];
 /**
@@ -958,6 +692,90 @@ export declare function agentFunctionFactsForPush(input: {
     facts: AgentFunctionFacts;
     liveListed: boolean;
 };
+/**
+ * The functions the app holds now, as the agent rules read them — #3798. A
+ * live row that is archived is a tombstone, not a function, so it is absent.
+ */
+export declare function liveAgentFunctionFacts(live: ReadonlyArray<Record<string, unknown>> | null): Record<string, AgentFunctionFact>;
+/** A selected `functions/<file>` and the key push resolves it to. */
+export interface FunctionChangePreflightFile {
+    file: string;
+    key: string;
+}
+/** A prompt of the app's live listing, as `functionChangePreflight` reads it. */
+export interface FunctionChangePreflightPrompt {
+    promptId: string;
+    promptKey: string;
+    kind?: unknown;
+    status?: unknown;
+    /** `[prompt.agent]` as stored. */
+    agent?: unknown;
+}
+/** A selected agent prompt file. */
+export interface FunctionChangePreflightAgentFile {
+    /** The file name under `prompts/`. */
+    file: string;
+    promptKey: string;
+    /** The parsed file. */
+    tomlData: any;
+}
+/** What `functionChangePreflight` reads: everything the push already listed or parsed. */
+export interface FunctionChangePreflightInput {
+    /** The function files this push selects. */
+    selectedFunctionFiles: ReadonlyArray<FunctionChangePreflightFile>;
+    /** The functions the app holds now (`liveAgentFunctionFacts`). */
+    live: AgentFunctionFacts;
+    /** What this push believes: the live functions overlaid by the selected files. */
+    pushed: AgentFunctionFacts;
+    /** The app's prompts, or `null` when they could not be listed. */
+    prompts: ReadonlyArray<FunctionChangePreflightPrompt> | null;
+    /** Every config of each live agent that names a changed function, by `promptId`. */
+    configsOf: ReadonlyMap<string, ReadonlyArray<AgentSchemaConfigFact>>;
+    /** The agent prompt files this push selects. */
+    selectedAgentFiles: ReadonlyArray<FunctionChangePreflightAgentFile>;
+}
+/** The preflight errors, the warnings, and the agent files to apply first. */
+export interface FunctionChangePreflightResult {
+    errors: string[];
+    warnings: string[];
+    /** Agent files to apply before the server-functions leg (`partitionPromptFilesForPush`). */
+    agentFilesFirst: string[];
+}
+/**
+ * The selected function files that CHANGE a live function — #4441. A file
+ * whose function is not live creates it, which no agent can depend on yet.
+ * The push lists the app's prompts only when this is non-empty.
+ */
+export declare function functionChangePreflightKeys(selectedFunctionFiles: ReadonlyArray<FunctionChangePreflightFile>, live: AgentFunctionFacts): FunctionChangePreflightFile[];
+/**
+ * The live, non-archived agent prompts that name at least one of `keys`.
+ * Whose configs the push reads for `functionChangePreflight`.
+ */
+export declare function functionChangePreflightAgents(prompts: ReadonlyArray<FunctionChangePreflightPrompt>, keys: ReadonlyArray<string>): FunctionChangePreflightPrompt[];
+/**
+ * Would a function change this push makes break a live agent? — #4441.
+ *
+ * The same rule the function routes run (`agentFunctionChangeRefusals`), so a
+ * change the preflight lets through is one the server accepts, run for every
+ * selected file that changes a live function against every live non-archived
+ * agent that names it, with every config of that agent:
+ *
+ *  - an agent whose prompt file this push does NOT select would be broken by
+ *    the change: a preflight error naming the function file, the agent and its
+ *    uses, and the remedy (change the agent in the same push, or retire it);
+ *  - an agent whose file IS selected keeps the existing order (applied after
+ *    the functions leg) unless its LIVE declaration would be broken by the
+ *    change. Then the file must go first to release the reference, which it
+ *    can only do when it is valid against the functions the app holds NOW —
+ *    its references, the providers of its non-archived configs, and the
+ *    providers of the configs the server still holds at its prompt PATCH. When it
+ *    is, it joins `agentFilesFirst`; when it is not, the push cannot be
+ *    ordered in one run and the error names the sequence that can.
+ *
+ * `prompts: null` (the listing failed) checks nothing and says so once; the
+ * server's refusal remains.
+ */
+export declare function functionChangePreflight(input: FunctionChangePreflightInput): FunctionChangePreflightResult;
 /**
  * The function half of an agent's declaration — #3798: every tool, turn
  * context and history function that the functions this push believes
@@ -975,17 +793,36 @@ export declare function promptAgentFunctionErrors(filePath: string, tomlData: an
  * server functions that must exist when it is created, and the push applies
  * prompts before functions, so agent files go AFTER the server-functions leg;
  * every other file keeps its place. A file that does not parse stays first, so
- * the leg reports it where it always has.
+ * the leg reports it where it always has. #4441 — the agent files in
+ * `agentFilesFirst` (`functionChangePreflight`) go before the leg instead.
  */
-export declare function partitionPromptFilesForPush(promptsDir: string, files: readonly string[]): {
+export declare function partitionPromptFilesForPush(promptsDir: string, files: readonly string[], agentFilesFirst?: readonly string[]): {
     beforeFunctions: string[];
     afterFunctions: string[];
 };
 /**
- * Every `prompts/<key>.tests/*.toml` sidecar whose prompt is an agent — #3798
- * (§D1: prompt test cases are refused for the kind in v1). The admin test-case
- * routes refuse the same case with `AGENT_TEST_CASE_NOT_SUPPORTED`; this says
- * so before anything is applied.
+ * The deferred agent files `config push` can still apply — #4437. An agent
+ * that names a function this push failed to apply, and that the server does
+ * not already hold, would only be refused as naming a function the app does
+ * not have. It is held back instead, with a failure that names the function as
+ * the cause; the function's own failure row says why. A file that does not
+ * parse is left for the prompt leg to report.
+ */
+export declare function holdAgentPromptFilesForUnappliedFunctions(promptsDir: string, files: readonly string[], unappliedFunctionKeys: ReadonlySet<string>): {
+    apply: string[];
+    held: Array<{
+        key: string;
+        message: string;
+    }>;
+};
+/**
+ * Every `prompts/<key>.tests/*.toml` sidecar the agent test case's rule
+ * refuses — #4262 (#3798 refused every sidecar on an agent). An agent's case
+ * is checked by the vendored shape rule (`resolveAgentTestCase`), which the
+ * admin routes run too; a `[test.agent]` block on a chat or decisions
+ * prompt's case is refused by name. One line per file, naming it. What needs
+ * the app (the input, context and event schemas, the declared names) is the
+ * routes' to decide at apply.
  */
 export declare function promptAgentSidecarErrors(configDir: string): string[];
 /**
@@ -1013,14 +850,32 @@ export declare function promptKindImmutableOutcome(storedKind: PromptKind | unde
     action: "immutable";
 }> | null;
 /**
- * The one deprecation notice a prompt file using the FLAT chat spelling earns
- * — #3626 §4, beside the `celContextAccess` notice's precedent.
+ * The file-decidable refusals `config push` gives one config file — the
+ * per-file body of `collectConfigFileValidationErrors`, shared with `config
+ * pull` (#4160), which never keeps a local file push would refuse.
  *
- * Advisory: the push continues and the keys are applied. `null` when the file
- * is already written in the grouped spelling, so a migrated tree is silent.
+ * `tables` are the tables whose unrecognized keys are checked here (none for a
+ * workflow, whose own validator owns that message); declared types run over
+ * every table of the surface.
  */
-export declare function promptFlatChatKeyWarning(filePath: string, tomlData: any): string | null;
+export declare function configFileValidationMessages(filePath: string, tomlData: any, surface: ConfigObjectSurface, tables: readonly ConfigTable[]): string[];
+/**
+ * Whether `config pull` must rewrite a local file whatever it says (#4160):
+ * `config push` would refuse it. Keeping such a file because its VALUES match
+ * would leave the tree unpushable after a pull that reported success.
+ *
+ * #4872 — or it still carries a DEPRECATED key. The key compares as nothing,
+ * so the file would be kept, and the pull the push warning names would not
+ * remove the line.
+ */
+export declare function pullMustRewrite(label: string, tomlData: any): boolean;
 export declare function collectConfigFileValidationErrors(configDir: string): ConfigFileValidationError[];
+/**
+ * The deprecated-key warnings for every file `collectConfigFileValidationErrors`
+ * reads (#4872), one line per file and key. Advisory: the keys are accepted and
+ * ignored, so these are printed and never refuse a push.
+ */
+export declare function collectConfigDeprecatedKeyWarnings(configDir: string): string[];
 /**
  * Every `functions/<key>.toml` whose file-decidable errors `config push` would
  * refuse (#3320).
@@ -1038,17 +893,6 @@ export declare function collectConfigFileValidationErrors(configDir: string): Co
  * the parse error itself, and reporting it twice helps nobody.
  */
 export declare function collectFunctionTomlValidationErrors(configDir: string): ConfigFileValidationError[];
-/**
- * The retired runtime keys every `functions/*.toml` in the tree still carries
- * — #3482, the warning half of the collector above.
- *
- * Separate from the errors because it IS separate: a file carrying one of
- * these pushes, with every other key applied, so it is not a row `config diff`
- * calls invalid. It is a line an author reads on stderr from both commands, so
- * the two keep reading identically (the #2880 symmetry the errors collector
- * exists for, applied to advice rather than refusals).
- */
-export declare function collectFunctionTomlIgnoredKeyWarnings(configDir: string): string[];
 /**
  * The collectors' rows, one per diff row (#2880 symmetry, #3320).
  *
@@ -1066,8 +910,7 @@ export declare function mergeConfigFileValidationErrors(collected: ConfigFileVal
  *
  * Test cases are a registered surface (#2644 phase 3) but they are not a
  * `SYNC_RESOURCE_TYPES` directory — they live beside the block they test, in
- * `prompts/<key>.tests/`, `workflows/<key>.tests/`, `transforms/<name>.tests/`
- * and (since #2769) `integrations/<key>.tests/` — so
+ * `prompts/<key>.tests/` and (since #2769) `integrations/<key>.tests/` — so
  * `unknownKeyPreflightTargets`, which crosses
  * the registry with that table, never reaches them. Listing them here gives the
  * sidecars the same unrecognized-key rejection every per-entity file has
@@ -1075,42 +918,6 @@ export declare function mergeConfigFileValidationErrors(collected: ConfigFileVal
  * dropped on the way to the server.
  */
 export declare function testCaseTomlFiles(configDir: string): string[];
-/** The `[workflow]` case of `configUnknownKeyError` (#2644 phase 1). */
-export declare function workflowUnknownKeyError(filePath: string, tomlData: any): string | null;
-/**
- * Will `config push` reach this workflow key through its UPDATE path?
- *
- * The push takes that path when sync state already holds an id for the key —
- * the `existingId` the apply loop reads. Everything else is a create (including
- * a create that 409s and adopts by key, which cannot be known before the server
- * answers). Exported so the front-loaded preflight can decide, before the first
- * mutating call, which files the update-only `name` pre-check applies to.
- */
-export declare function isWorkflowUpdateTarget(key: string, syncState: {
-    entities?: {
-        workflows?: Record<string, any>;
-    };
-} | null): boolean;
-/**
- * Will the apply loop actually SEND this workflow, or skip it as unchanged?
- *
- * Mirrors the loop's skip condition (`!force && existingId &&
- * !shouldPushExpandedFile(...)`): a create always sends, `--force` always
- * sends, and an update sends only when the expanded content (workflow file plus
- * its config sidecars) differs from the hash sync state recorded for it.
- *
- * Exported so the front-loaded preflight can scope the update-only `name`
- * pre-check to the files this push will really update. Without that scoping a
- * workflow created through the manifest-key `name` fallback — an authoring
- * shape the create path deliberately supports — would push once and then fail
- * every later push, including a no-change one and its `--dry-run`, on a file
- * the push was never going to send (#2743, review follow-up).
- */
-export declare function workflowPushSendsUpdate(configDir: string, key: string, parsedWorkflowToml: any, syncState: {
-    entities?: {
-        workflows?: Record<string, any>;
-    };
-} | null, force?: boolean): boolean;
 /**
  * The UPDATE path's `name` pre-check (#2743).
  *
@@ -1143,18 +950,24 @@ export declare function workflowPushSendsUpdate(configDir: string, key: string,
  * other unusable-schema case stays the apply loop's warning (D3455-004).
  */
 export declare function documentSchemaPreflightError(resolution: DocumentSchemaResolution): string | null;
-export declare function workflowUpdateNameError(filePath: string, workflow: any): string | null;
-export declare function serializeWorkflow(workflow: any, draft: any, configs: any[], logger?: (message: string) => void): string;
-export declare function serializeDatabaseType(typeConfig: any, operations: any[], ruleSetIdToName: Map<string, string>, options?: {
-    /** Per-op form hints derived from the existing file. */
-    hints?: OperationFormHints;
-    /** Default form for ops with no hint. New files → "native". */
-    defaultForm?: FieldForm;
-    /** Sink for human-readable fallback messages (logged via `info`). */
+export declare function serializeDatabaseType(typeConfig: any, ruleSetIdToName: Map<string, string>, options?: {
+    /** Sink for human-readable messages (logged via `info`). */
     logger?: (message: string) => void;
-    /** Server subscription rows to emit as `[[subscriptions]]` (issue #803). */
-    subscriptions?: any[];
 }): string;
+/**
+ * #4802 — the `db3-types/<name>.toml` a type row is pulled as: the database
+ * type file's content, its `[type]` table naming the type `name`.
+ */
+export declare function serializeDb3Type(typeConfig: any, ruleSetIdToName: Map<string, string>, options?: {
+    logger?: (message: string) => void;
+}): string;
+/**
+ * #4802 — a `db3-types/<name>.toml` file as the payload `PUT db3-types/:name`
+ * takes: the database type file's, its type read from `[type] name`.
+ */
+export declare function parseDb3TypeToml(tomlData: any): {
+    typeConfig: any;
+};
 /**
  * Flatten an email-template detail response onto its field surface.
  *
@@ -1192,18 +1005,6 @@ export declare function serializeRuleSet(ruleSet: any, logger?: (message: string
  * push would "succeed", change nothing, and be planned again on every run.
  */
 export declare function buildRuleSetPushPayload(tomlData: any, mode: PushMode): Record<string, any>;
-export declare function serializeGroupTypeConfig(config: any, ruleSetIdToName: Map<string, string>, logger?: (message: string) => void): string;
-/**
- * The create/update body for one group-type config (#2644).
- *
- * Takes the entity `parseGroupTypeConfigToml` produced, AFTER the rule-set
- * name → id resolution: the definition says which fields the server accepts in
- * each mode, so `groupType` rides the create body and the URL on update.
- */
-export declare function buildGroupTypeConfigPayload(configData: any, mode: PushMode): Record<string, any>;
-export declare function serializeCollectionTypeConfig(config: any, ruleSetIdToName: Map<string, string>, logger?: (message: string) => void): string;
-/** The create/update body for one collection-type config (#2644). */
-export declare function buildCollectionTypeConfigPayload(configData: any, mode: PushMode): Record<string, any>;
 /**
  * The upsert body for one metadata-category config (#2644).
  *
@@ -1246,8 +1047,7 @@ export declare function hasMeaningfulValue(v: any): boolean;
  * The server PATCH endpoint distinguishes an omitted key (preserve) from an
  * explicit `null` (clear), so sending every owned scalar as `value ?? null`
  * converges the server to the local TOML: a field removed from the file lands
- * as `null` and is cleared. Matches the always-send pattern the sibling
- * `collection-type-config` push already uses.
+ * as `null` and is cleared.
  */
 export declare function buildOwnedScalarUpdate(typeConfig: any): Record<string, any>;
 /**
@@ -1260,46 +1060,8 @@ export declare function buildOwnedScalarUpdate(typeConfig: any): Record<string,
  * GET; without it (fresh type or a failed fetch) nothing is reported cleared.
  */
 export declare function ownedScalarsBeingCleared(updateData: Record<string, any>, serverConfig: any): string[];
-/** The look-ahead a type-config PATCH carries about this push's operations. */
-export interface PendingOpClaims {
-    pendingOpDeletes: string[];
-    finalOpNames: string[];
-    pendingOpUpdates: Array<{
-        name: string;
-        access: string | null;
-        params: any;
-    }>;
-    pendingOpUpserts: Array<Record<string, any>>;
-}
-/**
- * What this push's operation set will BE, stated to the server (issues #813,
- * #1336, #2732).
- *
- * The type-config PATCH runs its gates BEFORE the same push's operation calls,
- * so without a look-ahead every gate judges the pre-push operations: a push
- * that removes a model is blocked by the very references it is deleting. The
- * file IS the target state (config-as-code), so the claims are derived from it:
- *
- *   - `finalOpNames` — the names the type ends with. Both other claims are
- *     verified against it server-side, which is what keeps them from being a
- *     gate bypass for a direct-API caller.
- *   - `pendingOpDeletes` — its complement among the ops last sync recorded, so
- *     an op this push deletes is excluded from the schema / OPS_EXIST gates.
- *   - `pendingOpUpserts` — the post-push BODY of every declared op, so the
- *     schema-edit gate lints a rewritten op as rewritten and a model removal
- *     plus its operation rewrites lands in one push (#2732).
- *   - `pendingOpUpdates` — the rule-only form (`access`/`params`) the manifest
- *     re-lint reads (#1336).
- *
- * All four are built here and sent together, on the dry-run and on the real
- * PATCH alike. They are never conditioned on the push having a deletion: a push
- * that only REWRITES operations is exactly the case #2732 exists for.
- */
-export declare function buildPendingOpClaims(operations: any[], existingOpNames: string[]): PendingOpClaims;
-export declare function parseDatabaseTypeToml(tomlData: any): {
+export declare function parseDatabaseTypeToml(tomlData: any, table?: ConfigTable): {
     typeConfig: any;
-    operations: any[];
-    subscriptions: any[];
 };
 /**
  * The parsed shape of a rule-set TOML: the definition's fields plus the
@@ -1307,8 +1069,6 @@ export declare function parseDatabaseTypeToml(tomlData: any): {
  * `config diff` hashes both sides through.
  */
 export declare function parseRuleSetToml(tomlData: any): any;
-export declare function parseGroupTypeConfigToml(tomlData: any): any;
-export declare function parseCollectionTypeConfigToml(tomlData: any): any;
 /**
  * `config diff`'s hash for one configuration object, over the field set its
  * DEFINITION declares (#2644 criterion 8).
@@ -1492,6 +1252,26 @@ export interface ConfigDiffSpec {
     /** How the type names itself in the rule-set resolution message. */
     describe(entity: any): string;
 }
+/**
+ * #4802 — the comparison a `db3-types/<name>.toml` file goes through: the
+ * database type's, read off its own table. Kept out of `CONFIG_DIFF_SPECS`
+ * (the shared comparator's registry, whose round-trip bar requires a fixture
+ * per entry): it is the database type spec with another `[type]` table, and
+ * its own suite covers the round trip.
+ */
+export declare const DB3_TYPE_DIFF_SPEC: ConfigDiffSpec;
+/**
+ * #4802 — the names a config tree holds in BOTH `db3-types/` and
+ * `database-type-configs/`, each one resource. Twins whose files read the same
+ * type are `agreeing`: the db3 file is pushed and the legacy one is synced
+ * with it. Twins that read differently are refused before anything is
+ * applied, naming both files.
+ */
+export declare function classifyDb3TypeTwins(configDir: string, maps?: ConfigDiffMaps): {
+    agreeing: string[];
+    refusals: string[];
+    refusedNames: string[];
+};
 /**
  * Every type the shared comparator serves — the types `config diff` compares
  * field-for-field, and that `config push` gates on the same projection
@@ -1524,6 +1304,21 @@ export declare function projectConfigPair(spec: ConfigDiffSpec, localParsed: any
     local: Record<string, any>;
     remote: Record<string, any>;
 };
+/**
+ * One `config diff` row's verdict once both sides exist (#4116, DSO-4116-003).
+ *
+ * A type whose files name a rule set cannot be compared without the app's
+ * rule-set listing: an unresolvable reference would read as a difference that
+ * is not there. So when the listing failed the row says so rather than
+ * comparing; otherwise `compare` decides.
+ */
+export declare function configDiffRowVerdict(parsed: any, remote: any, compare: (parsed: any, remote: any) => {
+    status: string;
+    hint?: string;
+}, contentComparable: boolean): {
+    status: string;
+    hint?: string;
+};
 /**
  * One `config diff` row's content verdict for a registered type (#2880).
  *
@@ -1556,6 +1351,64 @@ export declare function hashLocalConfigForDiff(spec: ConfigDiffSpec, parsedToml:
  * `extra` carries the sibling rows a type's file also holds: a database type's
  * operations and subscriptions, which the list response does not include.
  */
+/**
+ * The baseline `config pull` records for a function with a pushed version —
+ * #4717, F4717-CODE-003. #4738 — `access` is on neither side of any function
+ * comparison, so this is the one hash every function's baseline is read by.
+ */
+export declare function pulledFunctionSemanticHash(record: any, active: any): string;
+/**
+ * The function baseline with `access` out — #4717, F4717-CODE-004.
+ *
+ * Still recorded beside `semanticHash` at every baseline write. Since #4738
+ * the two are equal; a baseline written between #4717 and #4738 carries a
+ * `semanticHash` with the header's rule hashed in, and this is the one the
+ * next push reads.
+ */
+export declare function functionAccessFreeSemanticHash(record: any, active: any, maps?: ConfigDiffMaps): string;
+/**
+ * The manifest entry a function's push gate reads (#4717, #4738): the
+ * access-free baseline for every function, bare or flagged. An entry written
+ * before that hash existed keeps its one hash.
+ */
+export declare function functionPushBaselineEntry<E extends {
+    semanticHash?: string;
+    accessFreeSemanticHash?: string;
+}>(entry: E | null | undefined): E | null | undefined;
+/**
+ * The manifest entry a prompt's or an integration's push gate reads (#4872).
+ *
+ * A baseline recorded before the retirement hashed `accessRule` into
+ * `semanticHash`, and the live projection no longer carries it, so that hash
+ * matches neither side and would turn an ordinary local edit into a false
+ * `both-changed`. Every baseline written since records `ruleFreeSemanticHash`
+ * beside it, and that is the one read.
+ *
+ * An entry without it is a pre-retirement entry, and its hash is translated
+ * rather than trusted or thrown away. The old projection was the current one
+ * plus `accessRule` (a `whenSet` string; canonical JSON sorts keys), and the
+ * file still carries the rule it was synced with, so the old hash of either
+ * side is recomputable: the side whose old hash IS the baseline did not move,
+ * and its rule-free hash becomes the baseline. Only when neither side
+ * reproduces it — the rule line was edited or removed, or the baseline is from
+ * an older projection still — does the fallback apply:
+ *
+ *  - an integration drops the hash, so `classifyPushChange` reads the #2731
+ *    legacy signals; its header `modifiedAt` covers everything it projects;
+ *  - a prompt keeps the stale hash, which matches neither side and so declines
+ *    as `both-changed`. Its `[[configs]]` rows are not covered by the header
+ *    timestamp, so the legacy inference would read a remote template edit as
+ *    "server unchanged" and overwrite it.
+ */
+export declare function ruleFreePushBaselineEntry<E extends {
+    semanticHash?: string;
+    ruleFreeSemanticHash?: string;
+}>(entry: E | null | undefined, legacy: {
+    label: "prompt" | "integration";
+    maps: ConfigDiffMaps;
+    localParsed: any;
+    liveRecord: any;
+}): E | null | undefined;
 export declare function hashRemoteConfigForDiff(spec: ConfigDiffSpec, record: any, maps: ConfigDiffMaps, extra?: any): string;
 /** One field's disagreement between the local file and the live server entity. */
 export interface PushFieldDiff {
@@ -1780,28 +1633,6 @@ export declare function resolveExistingId(input: {
     liveId?: string;
     manifestId?: string;
 }): string | undefined;
-/**
- * Which CHILD rows a database type's push reconciles against (#2731 B3).
- *
- * `resolveExistingId` answers this for a whole entity; a database type's
- * operations and subscriptions are rows with the same question and the same
- * two possible answers. The manifest can name an operation the server no
- * longer has (the update PUTs a row that is gone) and be silent about one it
- * does have (the create POSTs a duplicate key) — both abort the push with a
- * server error, which is exactly the recovery `--force` is supposed to
- * perform.
- *
- * When the reconcile read the rows, they ARE the baseline: existence, the
- * timestamp each update guards with, and — as the complement of the file's own
- * list — which rows this push deletes. `undefined` means the read did not
- * happen (the degraded path, or a type live state says is absent), and the
- * manifest stays what it has always been.
- */
-export declare function liveChildBaseline(live: Map<string, any> | undefined, manifestChildren?: Record<string, {
-    modifiedAt: string;
-}>): Record<string, {
-    modifiedAt: string;
-}> | undefined;
 /**
  * The app's live rule sets, indexed the three ways push reads them (#2731 B3).
  *
@@ -1814,7 +1645,7 @@ export declare function liveChildBaseline(live: Map<string, any> | undefined, ma
  *    the file spells;
  *  - `nameToId` — how a referencing file's `ruleSetName` resolves to something
  *    push can send. Seeding it from live is what lets `--only
- *    group-type-config/team` resolve a rule set that exists on the server but
+ *    database-type-config/orders` resolve a rule set that exists on the server but
  *    was never recorded locally, instead of failing as an unresolved
  *    reference.
  */
@@ -1855,63 +1686,6 @@ export declare function remoteSemanticBaseline(input: {
      */
     isStoredRecord?: (returned: any) => boolean;
 }): string | undefined;
-/** What `config push` decides for one transform (#2731 B7). */
-export type ScriptPushOutcome = {
-    action: "skip";
-    localHash: string;
-    remoteHash: string;
-} | {
-    action: "update";
-    direction: "local-edited" | "forced" | "no-active-body";
-    localHash: string;
-} | {
-    action: "drift";
-    localHash: string;
-    remoteHash: string;
-} | {
-    action: "conflict";
-    direction: "both-changed" | "unknown-direction";
-    localHash: string;
-    remoteHash: string;
-};
-/**
- * `config push`'s change decision for one transform (#2731 B7).
- *
- * A transform's comparator IS its bytes: the body push sends is the body diff
- * compares, so there is no projection to reconcile — only the same three
- * questions every converted type asks. Local versus the LIVE active body, with
- * the manifest demoted to the baseline that says which side moved.
- *
- * A script the manifest has never seen reaches here too (adopted by name from
- * the live index). It has no baseline and no legacy signal, so an unequal body
- * classifies as `unknown-direction` — a conflict to report rather than a server
- * body to overwrite on a guess.
- */
-export declare function decidePushForScript(input: {
-    localBody: string;
-    /** Byte hash of the local file — the legacy direction signal. */
-    localFileHash?: string;
-    /**
-     * The live active body, and the script row's timestamp beside it — the other
-     * legacy direction signal (#2731 B4). Activating a config updates the script
-     * row, so a timestamp still equal to the manifest's proves the server body
-     * has not moved: an upgraded installation's first push applies a genuine
-     * local edit instead of reporting a direction it could have known.
-     *
-     * `null` is an ANSWER, not a failed read: the script row exists and nothing
-     * is active on it. See below.
-     */
-    live: {
-        body: string;
-        modifiedAt?: string;
-    } | null;
-    entry?: {
-        contentHash?: string;
-        semanticHash?: string;
-        modifiedAt?: string;
-    } | null;
-    force?: boolean;
-}): ScriptPushOutcome;
 /**
  * One side of a field diff, rendered for a conflict report (#2731 B5).
  *
@@ -1986,6 +1760,38 @@ export declare function countAppliedChanges(input: {
  * than taking the command down.
  */
 export declare function configSemanticHash(label: string, filePath: string, maps: ConfigDiffMaps): string | undefined;
+/**
+ * Whether a local config file says what the file `config pull` would write
+ * says (#4160) — the definition-projected field set `config diff` compares, so
+ * a file diff calls Synced keeps its comments, key order and explicit defaults
+ * through a pull.
+ *
+ * Both sides go through the same projection with the same context, so
+ * `extra` is the context a reference is read through (a test case's lookups),
+ * never server-only rows. As in diff, the file is paired by the identity it
+ * states (or `filePath`'s name), and the fields it leaves unmanaged take the
+ * server's values — so a kept file's baseline is the server's projection
+ * (`pulledSemanticHash`), never the file's own.
+ */
+export declare function sameConfigAs(label: string, serverContent: string, filePath: string, maps: ConfigDiffMaps, extra?: any): (localContent: string) => boolean;
+/**
+ * #4802 — `sameConfigAs` for a `db3-types/` file: a local file that reads the
+ * same type as the server's rendering is left as it is.
+ */
+export declare function sameDb3TypeAs(serverContent: string, maps: ConfigDiffMaps): (localContent: string) => boolean;
+/**
+ * The semantic baseline `config pull` stamps for a config file (#4160): the
+ * projection of what the server serializes, whether the file was written or
+ * kept. A kept file can leave unmanaged fields or its identity to the server,
+ * so hashing it would record a baseline the server never had.
+ */
+export declare function pulledSemanticHash(label: string, serverContent: string, maps: ConfigDiffMaps): string | undefined;
+/**
+ * Whether a local TOML file parses to the same document as `serverContent`
+ * (#4160): the comparison for `vars.toml`, which has no field definition
+ * behind it, so only comments, key order and spelling are free.
+ */
+export declare function sameTomlAs(serverContent: string): (localContent: string) => boolean;
 /**
  * The sync state `config push` writes into (#2731 B6, closing #2374).
  *
@@ -2136,69 +1942,6 @@ export declare function serializeTestCase(testCase: any, lookupMaps?: TestCaseLo
  */
 export declare function serializeTestCaseForComparison(testCase: any, lookupMaps?: TestCaseLookupMaps): string;
 export declare function parseTestCaseToml(tomlData: any): any;
-/**
- * Pull server-side `Script` rows into `transforms/*.rhai` and record
- * each in the returned sync-state map. Issue #892 slice 7 + codex
- * follow-up on PR #893; body materialization fixed in issue #1196.
- * Exported so the unit test can drive it against stubbed
- * `client.listScripts` / `client.getScript`.
- *
- * Two-call contract: `listScripts` returns the `Script` HEADER only
- * (no `body` — see `serializeScript` in `src/admin-api.ts`). The Rhai
- * source lives on a versioned `ScriptConfig`. So for each listed
- * script we fetch the full record with `getScript`, which returns the
- * header plus serialized `configs` (each carrying its `body`), and
- * write the ACTIVE config's body. Reading the body off the list shape
- * (the old behavior) always produced 0-byte files.
- *
- * Idempotency: every call writes the active-config body the server
- * returned, so re-running `config pull` on an unchanged server overwrites
- * with the same bytes and produces the same `contentHash`. The result
- * map always reflects the current server state for the writes performed.
- *
- * `count` is the number of files actually written, not the number of
- * scripts listed: scripts with no active config and scripts whose
- * config fetch fails are skipped (we never clobber a `.rhai` with an
- * empty file).
- *
- * Older-server graceful path: if `listScripts` rejects (e.g. older
- * server without the route), the caller catches and treats it as
- * "no scripts to pull", leaving the directory empty. A per-script
- * `getScript` failure is caught and that one script is skipped without
- * aborting the rest of the pull.
- */
-export declare function pullScripts(client: ApiClient, appId: string, configDir: string, logger?: (msg: string) => void, 
-/**
- * `config pull --only` (issue #2645): which transform names this pull may
- * write. Defaults to every one the server lists.
- */
-selects?: (name: string) => boolean): Promise<{
-    scriptEntities: Record<string, {
-        id: string;
-        modifiedAt: string;
-        contentHash?: string;
-        semanticHash?: string;
-    }>;
-    count: number;
-    /**
-     * Which scripts the server listed, for the #1659 prune pass. `ok: false` when
-     * the listing failed (an older server without the route, or a transient
-     * error) or when any per-script fetch failed — in either case this pull's
-     * picture of the type is incomplete and must not drive deletions. Scripts
-     * skipped for having no active config are still *present*, so their keys stay
-     * in the set and their local `.rhai` survives.
-     */
-    presence: PresenceOutcome;
-    /**
-     * Whether the script LISTING succeeded. Distinct from `presence`: a failed
-     * per-script fetch blocks pruning but still leaves the other scripts written,
-     * so their fresh state entries must be kept. Only a failed listing means
-     * nothing was written and the prior state slot should be preserved whole.
-     */
-    listOk: boolean;
-    /** Names the server listed, empty when the listing failed. */
-    serverKeys: string[];
-}>;
 /**
  * The manifest row `config push` records for a function it just pushed
  * (#3317), and whether the server had already moved past that push.
@@ -2236,6 +1979,7 @@ export declare function pushedFunctionBaseline(input: {
         modifiedAt: string;
         contentHash: string;
         semanticHash?: string;
+        accessFreeSemanticHash?: string;
         envelopeHash: string;
         activeConfigId?: string;
         sources: string[];
@@ -2261,12 +2005,15 @@ export declare function pushedFunctionBaseline(input: {
  * normalizes outside the tree, and the refusals are reported rather than
  * swallowed.
  */
-export declare function pullFunctions(client: ApiClient, appId: string, configDir: string, logger?: (msg: string) => void, selects?: (key: string) => boolean): Promise<{
+export declare function pullFunctions(client: ApiClient, appId: string, configDir: string, logger?: (msg: string) => void, selects?: (key: string) => boolean, 
+/** Counts each function file as written or left unchanged (#4160). */
+writes?: PullWriteTally): Promise<{
     functionEntities: Record<string, {
         id: string;
         modifiedAt: string;
         contentHash?: string;
         semanticHash?: string;
+        accessFreeSemanticHash?: string;
         envelopeHash?: string;
         activeConfigId?: string;
         sources?: string[];
@@ -2350,6 +2097,7 @@ export declare function listAllTestCases(client: ApiClient, appId: string, block
     items: any[];
 } | {
     ok: false;
+    error: unknown;
 }>;
 /**
  * Copy a block's prior `entities.testCases` records into the pull's fresh map
@@ -2383,6 +2131,8 @@ export declare function pullTestCasesForBlock(params: {
     priorTestCaseEntities?: Record<string, any>;
     lookupMaps?: TestCaseLookupMaps;
     logger?: (message: string) => void;
+    /** Counts each case file as written or left unchanged (#4160). */
+    writes?: PullWriteTally;
 }): Promise<TestCasePullOutcome>;
 /**
  * One pull leg: every block of a type the pull selected (#2769).
@@ -2405,6 +2155,8 @@ export declare function pullTestCasesForBlocks(params: {
     priorTestCaseEntities?: Record<string, any>;
     lookupMaps?: TestCaseLookupMaps;
     logger?: (message: string) => void;
+    /** Counts each case file as written or left unchanged (#4160). */
+    writes?: PullWriteTally;
 }): Promise<{
     count: number;
     skippedBlocks: string[];
@@ -2413,8 +2165,6 @@ export declare function pullTestCasesForBlocks(params: {
 interface PushResolutionMaps {
     promptKeyToId: Map<string, string>;
     promptConfigNameToId: Map<string, string>;
-    workflowConfigNameToId: Map<string, string>;
-    scriptConfigNameToId?: Map<string, string>;
     integrationConfigNameToId?: Map<string, string>;
     /**
      * Fill one block's config name→id entries from the server on demand (#2769),