primitive-admin 1.2.0-alpha.3 → 1.2.0-alpha.5

package/dist/src/commands/settings.js

@@ -1,54 +1,102 @@
 /**
- * `primitive settings` — the app-settings READER (issue #1033, Phase 2;
- * narrowed to a reader by #2645).
+ * `primitive settings` — the app-settings sync surface (issue #1033, Phase 2).
  *
- * App settings are authored in `app.toml` and applied with `sync push`, so
- * this group carries the one thing the file cannot answer: what the server is
- * actually running. `settings get` renders the server-effective settings —
- * `get` rather than `show`, so the read verb is the same word on every
- * configuration surface.
+ * A focused command for the app-settings TOML round-trip that `sync` handles as
+ * part of the whole-config export/import. `settings pull` / `push` / `diff`
+ * operate on the SAME `app.toml` and the SAME single `entities.app.contentHash`
+ * as `sync`, so the two are interchangeable and idempotent together. `settings
+ * show` renders the current server-effective settings (with `googleClientSecret`
+ * redacted).
  *
- * `settings pull`, `settings diff` and `settings push` are gone. They operated
- * on the same `app.toml` and the same `entities.app` hash `sync` owns, so they
- * were a second pathway to one piece of state; `sync pull|diff|push --only app`
- * is the single one. The remaining command logic lives in
- * `sync-app-settings.ts`, shared with `sync`.
+ * The command logic lives in `sync-app-settings.ts` so `sync` and `settings`
+ * share one implementation; this file only wires up the commander surface.
  */
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { showAppSettings } from "./sync-app-settings.js";
+import { resolveSyncDir, isAutoResolvedSyncDir, checkLegacySyncMigration, } from "../lib/sync-paths.js";
+import { info, warn } from "../lib/output.js";
+import { showAppSettings, pullAppSettings, pushAppSettings, diffAppSettings, } from "./sync-app-settings.js";
+/**
+ * Resolve the sync directory and print the per-environment hint the way `sync`
+ * does (suppressed under `--json` so stdout stays pure JSON).
+ */
+function resolveConfigDir(appId, options) {
+    const configDir = resolveSyncDir({ appId, userDir: options.dir });
+    if (isAutoResolvedSyncDir(options.dir) && !options.json) {
+        info(`Using per-environment sync directory: ${configDir}`);
+        const legacyHint = checkLegacySyncMigration(configDir);
+        if (legacyHint)
+            warn(legacyHint);
+    }
+    return configDir;
+}
 export function registerSettingsCommands(program) {
     const settings = program
         .command("settings")
-        .description("View the app settings the server is running")
+        .description("View and sync app settings through app.toml")
         .addHelpText("after", `
 Examples:
-  $ primitive settings get                  # Render current server settings
-  $ primitive settings get --json           # Machine-readable
-  $ primitive sync pull --only app          # Write server settings to app.toml
-  $ primitive config set app app.baseUrl=https://example.com
-  $ primitive sync diff --only app          # Show local app.toml vs server
-  $ primitive sync push --only app          # Apply app.toml edits to the server
+  $ primitive settings show                 # Render current server settings
+  $ primitive settings show --json          # Machine-readable (secret redacted)
+  $ primitive settings pull                 # Write server settings to app.toml
+  $ primitive settings diff                 # Show local app.toml vs server
+  $ primitive settings push                 # Apply app.toml edits to the server
 
-app.toml is the ONLY way to manage app configuration (issue #2645): a full
-\`sync push\` applies it, and \`sync push --only app\` applies it alone.
-\`primitive config fields app\` lists its keys, types and defaults. The Google OAuth
-client secret is an ordinary [auth] key holding a reference into the app's
-secret store, never the secret itself: store the value with
-'primitive secrets set GOOGLE_CLIENT_SECRET --value <secret>', then set
-googleClientSecret = "{{secrets.GOOGLE_CLIENT_SECRET}}" in app.toml. A literal
-secret there is rejected by the server.
+app.toml is the primary way to manage app configuration. The Google OAuth
+client secret is intentionally excluded from app.toml; set it with
+'primitive apps update <app-id> --google-client-secret <secret>'.
 `);
-    // settings get
+    // settings show
     settings
-        .command("get")
+        .command("show")
         .description("Show the current server-effective app settings")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--json", "Output as JSON")
+        .option("--json", "Output as JSON (googleClientSecret redacted)")
         .action(async (appId, options) => {
         const resolvedAppId = resolveAppId(appId, options);
         await showAppSettings(new ApiClient(), resolvedAppId, options);
     });
+    // settings pull
+    settings
+        .command("pull")
+        .description("Write the current server settings to app.toml")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        const configDir = resolveConfigDir(resolvedAppId, options);
+        await pullAppSettings(new ApiClient(), resolvedAppId, configDir, options);
+    });
+    // settings diff
+    settings
+        .command("diff")
+        .description("Show per-field differences between app.toml and the server")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        const configDir = resolveConfigDir(resolvedAppId, options);
+        await diffAppSettings(new ApiClient(), resolvedAppId, configDir, options);
+    });
+    // settings push
+    settings
+        .command("push")
+        .description("Apply app.toml settings to the server")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--dir <path>", "Config directory (overrides the auto-resolved per-env path)")
+        .option("--force", "Push even if app.toml is unchanged since the last sync")
+        .option("--dry-run", "Show what would be changed without applying")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        const configDir = resolveConfigDir(resolvedAppId, options);
+        await pushAppSettings(new ApiClient(), resolvedAppId, configDir, options);
+    });
 }
 //# sourceMappingURL=settings.js.map

package/dist/src/commands/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;CAiBL,CACI,CAAC;IAEJ,eAAe;IACf,QAAQ;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,SAAS,gBAAgB,CACvB,KAAa,EACb,OAAyC;IAEzC,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,CACV,OAAO,EACP;;;;;;;;;;;CAWL,CACI,CAAC;IAEJ,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;SACrF,MAAM,CAAC,SAAS,EAAE,wDAAwD,CAAC;SAC3E,MAAM,CAAC,WAAW,EAAE,6CAA6C,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sync.d.ts

@@ -1,7 +1,5 @@
 import { Command } from "commander";
 import { ApiClient } from "../lib/api-client.js";
-import { type OperationFormHints } from "../lib/toml-database-config.js";
-import { type FieldForm } from "../lib/toml-native-form.js";
 import { type PullWriteTally } from "../lib/pull-write.js";
 import { type PushMode } from "../lib/config-payload.js";
 import { type ConfigObjectSurface, type ConfigTable } from "../lib/generated-config-surfaces.js";
@@ -688,21 +686,14 @@ export declare function serializeBlobBucket(bucket: any, ruleSetIdToName?: Map<s
  * `config push` builds its bodies from and `config diff` compares.
  *
  * Read in CREATE mode, so the immutable `ttlTier` stays nameable. The rule set
- * is left as `_ruleSetName` for `resolveRuleSetReference`; the deprecated
- * `ruleSetId` spelling is forwarded as the id it already is. A file carrying
- * both is refused by the preflight (`blobBucketFileErrors`) before this runs.
+ * is left as `_ruleSetName` for `resolveRuleSetReference`. The id spelling
+ * `ruleSetId` is a retired key (#4283): the preflight refuses a file carrying
+ * it, and this parse never reads it.
  *
  * An omitted `name` stays omitted: the update leaves the server's name alone,
  * and only the create body falls back to the key.
  */
 export declare function parseBlobBucketToml(doc: any): any;
-/**
- * The advisory `config push` prints for a bucket file still naming its rule set
- * by id (#4116). The key is deprecated, not retired: the file pushes.
- */
-export declare function blobBucketDeprecatedKeyWarning(filePath: string, tomlData: any): string | null;
-/** A bucket file's own refusals, decided from the file alone (#4116). */
-export declare function blobBucketFileErrors(filePath: string, tomlData: any): string[];
 /**
  * Build the PATCH payload for a blob-bucket update from local TOML.
  *
@@ -767,23 +758,26 @@ export declare function promptConfigPayload(tomlConfig: any, options?: {
 export declare function buildBlobBucketCreatePayload(key: string, bucket: any): Record<string, any>;
 export declare function serializePrompt(prompt: any, logger?: (message: string) => void): string;
 /**
- * The `config push` warning for a resource pushed with no `accessRule` (#2652).
+ * The `config push` warning for a caller workflow pushed with no `accessRule`
+ * (#2652).
  *
  * Returns `null` when a rule is declared — and for a `runAs = "system"`
  * workflow, which rejects any rule and cannot be started by a member at all.
- * Otherwise it names the resource, the consequence, and the one-line restore,
- * because after the #2652 flip a ruleless prompt or caller workflow denies
- * every non-admin caller from the deploy onward.
+ * Otherwise it names the workflow, the consequence, and the one-line restore,
+ * because after the #2652 flip a ruleless caller workflow denies every
+ * non-admin caller from the deploy onward.
+ *
+ * A prompt gets no warning (#4368): a server function runs it on its
+ * `prompt:<key>` grant, which never consults the rule, so a ruleless prompt is
+ * the ordinary case, not a lockout.
  *
- * Both kinds now push `accessRule` as value-or-`null` — the prompt since #1567,
- * the workflow since #2743's always-send conversion — so for either one an
- * omitted key really does leave the resource ruleless on the server. The
- * workflow wording says so explicitly, because it used to say the opposite
- * (the update path preserved a stored rule) and an operator who learned that
- * caveat needs to see it retracted.
+ * The workflow pushes `accessRule` as value-or-`null` since #2743's
+ * always-send conversion, so an omitted key really does leave it ruleless on
+ * the server. The wording says so explicitly, because it used to say the
+ * opposite (the update path preserved a stored rule) and an operator who
+ * learned that caveat needs to see it retracted.
  */
 export declare function missingAccessRuleWarning(opts: {
-    kind: "prompt" | "workflow";
     key: string;
     accessRule: unknown;
     runAs?: unknown;
@@ -1020,10 +1014,28 @@ export declare function partitionPromptFilesForPush(promptsDir: string, files: r
     afterFunctions: string[];
 };
 /**
- * Every `prompts/<key>.tests/*.toml` sidecar whose prompt is an agent — #3798
- * (§D1: prompt test cases are refused for the kind in v1). The admin test-case
- * routes refuse the same case with `AGENT_TEST_CASE_NOT_SUPPORTED`; this says
- * so before anything is applied.
+ * The deferred agent files `config push` can still apply — #4437. An agent
+ * that names a function this push failed to apply, and that the server does
+ * not already hold, would only be refused as naming a function the app does
+ * not have. It is held back instead, with a failure that names the function as
+ * the cause; the function's own failure row says why. A file that does not
+ * parse is left for the prompt leg to report.
+ */
+export declare function holdAgentPromptFilesForUnappliedFunctions(promptsDir: string, files: readonly string[], unappliedFunctionKeys: ReadonlySet<string>): {
+    apply: string[];
+    held: Array<{
+        key: string;
+        message: string;
+    }>;
+};
+/**
+ * Every `prompts/<key>.tests/*.toml` sidecar the agent test case's rule
+ * refuses — #4262 (#3798 refused every sidecar on an agent). An agent's case
+ * is checked by the vendored shape rule (`resolveAgentTestCase`), which the
+ * admin routes run too; a `[test.agent]` block on a chat or decisions
+ * prompt's case is refused by name. One line per file, naming it. What needs
+ * the app (the input, context and event schemas, the declared names) is the
+ * routes' to decide at apply.
  */
 export declare function promptAgentSidecarErrors(configDir: string): string[];
 /**
@@ -1062,10 +1074,8 @@ export declare function promptKindImmutableOutcome(storedKind: PromptKind | unde
 export declare function configFileValidationMessages(filePath: string, tomlData: any, surface: ConfigObjectSurface, tables: readonly ConfigTable[]): string[];
 /**
  * Whether `config pull` must rewrite a local file whatever it says (#4160):
- * `config push` would refuse it, or it spells something in a deprecated form
- * pull exists to migrate (a bucket naming its rule set by id). Keeping such a
- * file because its VALUES match would leave the tree unpushable, or the
- * deprecation unresolved, after a pull that reported success.
+ * `config push` would refuse it. Keeping such a file because its VALUES match
+ * would leave the tree unpushable after a pull that reported success.
  */
 export declare function pullMustRewrite(label: string, tomlData: any): boolean;
 export declare function collectConfigFileValidationErrors(configDir: string): ConfigFileValidationError[];
@@ -1086,17 +1096,6 @@ export declare function collectConfigFileValidationErrors(configDir: string): Co
  * the parse error itself, and reporting it twice helps nobody.
  */
 export declare function collectFunctionTomlValidationErrors(configDir: string): ConfigFileValidationError[];
-/**
- * The retired runtime keys every `functions/*.toml` in the tree still carries
- * — #3482, the warning half of the collector above.
- *
- * Separate from the errors because it IS separate: a file carrying one of
- * these pushes, with every other key applied, so it is not a row `config diff`
- * calls invalid. It is a line an author reads on stderr from both commands, so
- * the two keep reading identically (the #2880 symmetry the errors collector
- * exists for, applied to advice rather than refusals).
- */
-export declare function collectFunctionTomlIgnoredKeyWarnings(configDir: string): string[];
 /**
  * The collectors' rows, one per diff row (#2880 symmetry, #3320).
  *
@@ -1193,15 +1192,9 @@ export declare function workflowPushSendsUpdate(configDir: string, key: string,
 export declare function documentSchemaPreflightError(resolution: DocumentSchemaResolution): string | null;
 export declare function workflowUpdateNameError(filePath: string, workflow: any): string | null;
 export declare function serializeWorkflow(workflow: any, draft: any, configs: any[], logger?: (message: string) => void): string;
-export declare function serializeDatabaseType(typeConfig: any, operations: any[], ruleSetIdToName: Map<string, string>, options?: {
-    /** Per-op form hints derived from the existing file. */
-    hints?: OperationFormHints;
-    /** Default form for ops with no hint. New files → "native". */
-    defaultForm?: FieldForm;
-    /** Sink for human-readable fallback messages (logged via `info`). */
+export declare function serializeDatabaseType(typeConfig: any, ruleSetIdToName: Map<string, string>, options?: {
+    /** Sink for human-readable messages (logged via `info`). */
     logger?: (message: string) => void;
-    /** Server subscription rows to emit as `[[subscriptions]]` (issue #803). */
-    subscriptions?: any[];
 }): string;
 /**
  * Flatten an email-template detail response onto its field surface.
@@ -1308,46 +1301,8 @@ export declare function buildOwnedScalarUpdate(typeConfig: any): Record<string,
  * GET; without it (fresh type or a failed fetch) nothing is reported cleared.
  */
 export declare function ownedScalarsBeingCleared(updateData: Record<string, any>, serverConfig: any): string[];
-/** The look-ahead a type-config PATCH carries about this push's operations. */
-export interface PendingOpClaims {
-    pendingOpDeletes: string[];
-    finalOpNames: string[];
-    pendingOpUpdates: Array<{
-        name: string;
-        access: string | null;
-        params: any;
-    }>;
-    pendingOpUpserts: Array<Record<string, any>>;
-}
-/**
- * What this push's operation set will BE, stated to the server (issues #813,
- * #1336, #2732).
- *
- * The type-config PATCH runs its gates BEFORE the same push's operation calls,
- * so without a look-ahead every gate judges the pre-push operations: a push
- * that removes a model is blocked by the very references it is deleting. The
- * file IS the target state (config-as-code), so the claims are derived from it:
- *
- *   - `finalOpNames` — the names the type ends with. Both other claims are
- *     verified against it server-side, which is what keeps them from being a
- *     gate bypass for a direct-API caller.
- *   - `pendingOpDeletes` — its complement among the ops last sync recorded, so
- *     an op this push deletes is excluded from the schema / OPS_EXIST gates.
- *   - `pendingOpUpserts` — the post-push BODY of every declared op, so the
- *     schema-edit gate lints a rewritten op as rewritten and a model removal
- *     plus its operation rewrites lands in one push (#2732).
- *   - `pendingOpUpdates` — the rule-only form (`access`/`params`) the manifest
- *     re-lint reads (#1336).
- *
- * All four are built here and sent together, on the dry-run and on the real
- * PATCH alike. They are never conditioned on the push having a deletion: a push
- * that only REWRITES operations is exactly the case #2732 exists for.
- */
-export declare function buildPendingOpClaims(operations: any[], existingOpNames: string[]): PendingOpClaims;
 export declare function parseDatabaseTypeToml(tomlData: any): {
     typeConfig: any;
-    operations: any[];
-    subscriptions: any[];
 };
 /**
  * The parsed shape of a rule-set TOML: the definition's fields plus the
@@ -1843,28 +1798,6 @@ export declare function resolveExistingId(input: {
     liveId?: string;
     manifestId?: string;
 }): string | undefined;
-/**
- * Which CHILD rows a database type's push reconciles against (#2731 B3).
- *
- * `resolveExistingId` answers this for a whole entity; a database type's
- * operations and subscriptions are rows with the same question and the same
- * two possible answers. The manifest can name an operation the server no
- * longer has (the update PUTs a row that is gone) and be silent about one it
- * does have (the create POSTs a duplicate key) — both abort the push with a
- * server error, which is exactly the recovery `--force` is supposed to
- * perform.
- *
- * When the reconcile read the rows, they ARE the baseline: existence, the
- * timestamp each update guards with, and — as the complement of the file's own
- * list — which rows this push deletes. `undefined` means the read did not
- * happen (the degraded path, or a type live state says is absent), and the
- * manifest stays what it has always been.
- */
-export declare function liveChildBaseline(live: Map<string, any> | undefined, manifestChildren?: Record<string, {
-    modifiedAt: string;
-}>): Record<string, {
-    modifiedAt: string;
-}> | undefined;
 /**
  * The app's live rule sets, indexed the three ways push reads them (#2731 B3).
  *