primitive-admin 1.2.0-alpha.4 → 1.2.0-alpha.6

package/dist/src/lib/generated-allowlist.js

@@ -33,7 +33,6 @@ export const GENERATED_ALLOWLISTED_FIELDS = [
     "as",
     "asBase64",
     "attachments",
-    "batch",
     "blobId",
     "blobIds",
     "blockKey",
@@ -66,10 +65,8 @@ export const GENERATED_ALLOWLISTED_FIELDS = [
     "deepLink",
     "default",
     "description",
-    "direction",
     "documentAlias",
     "documentId",
-    "dryRun",
     "durationMs",
     "email",
     "events",
@@ -118,14 +115,12 @@ export const GENERATED_ALLOWLISTED_FIELDS = [
     "offset",
     "onConflict",
     "onPartialFailure",
-    "operationName",
     "operations",
     "options",
     "output",
     "ownerOnly",
     "page",
     "pageSize",
-    "params",
     "payload",
     "perUser",
     "permission",
@@ -152,7 +147,6 @@ export const GENERATED_ALLOWLISTED_FIELDS = [
     "signupEndDay",
     "signupStartDay",
     "skipWhenSkipped",
-    "sort",
     "source",
     "step",
     "strict",
@@ -206,22 +200,8 @@ export const GENERATED_KNOWN_KINDS = [
     "collection.grantGroupPermission",
     "collection.removeDocument",
     "create",
-    "database.aggregate",
-    "database.aggregateForUser",
-    "database.applyToQuery",
-    "database.applyToQueryForUser",
-    "database.batch",
-    "database.batchForUser",
-    "database.count",
-    "database.countForUser",
     "database.create",
     "database.delete",
-    "database.mutate",
-    "database.mutateForUser",
-    "database.pipeline",
-    "database.pipelineForUser",
-    "database.query",
-    "database.queryForUser",
     "database.syncIndexes",
     "delay",
     "document.bulkUpdate",

package/dist/src/lib/generated-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-allowlist.js","sourceRoot":"","sources":["../../../src/lib/generated-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kBAAkB;IAClB,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,UAAU;IACV,UAAU;IACV,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,SAAS;IACT,eAAe;IACf,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,MAAM;IACN,YAAY;IACZ,cAAc;IACd,UAAU;IACV,SAAS;IACT,aAAa;IACb,WAAW;IACX,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,IAAI;IACJ,gBAAgB;IAChB,aAAa;IACb,oBAAoB;IACpB,iBAAiB;IACjB,OAAO;IACP,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,KAAK;IACL,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,SAAS;IACT,OAAO;IACP,WAAW;IACX,eAAe;IACf,IAAI;IACJ,iBAAiB;IACjB,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,WAAW;IACX,MAAM;IACN,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,SAAS;IACT,KAAK;IACL,SAAS;IACT,YAAY;IACZ,cAAc;IACd,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,cAAc;IACd,SAAS;IACT,aAAa;IACb,cAAc;IACd,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IACf,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,MAAM;IACN,aAAa;IACb,cAAc;CACf,CAAC;AAEF,0GAA0G;AAC1G,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,iBAAiB;IACjB,iBAAiB;IACjB,wBAAwB;IACxB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,wBAAwB;IACxB,mBAAmB;IACnB,mBAAmB;IACnB,iCAAiC;IACjC,2BAA2B;IAC3B,QAAQ;IACR,oBAAoB;IACpB,2BAA2B;IAC3B,uBAAuB;IACvB,8BAA8B;IAC9B,gBAAgB;IAChB,uBAAuB;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,wBAAwB;IACxB,mBAAmB;IACnB,0BAA0B;IAC1B,gBAAgB;IAChB,uBAAuB;IACvB,sBAAsB;IACtB,OAAO;IACP,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;IACrB,sCAAsC;IACtC,yBAAyB;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,8BAA8B;IAC9B,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,eAAe;IACf,UAAU;IACV,cAAc;IACd,cAAc;IACd,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,MAAM;IACN,mBAAmB;IACnB,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,yBAAyB;IACzB,eAAe;CAChB,CAAC"}
+{"version":3,"file":"generated-allowlist.js","sourceRoot":"","sources":["../../../src/lib/generated-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kBAAkB;IAClB,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,MAAM;IACN,UAAU;IACV,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,UAAU;IACV,UAAU;IACV,YAAY;IACZ,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,UAAU;IACV,SAAS;IACT,eAAe;IACf,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,MAAM;IACN,YAAY;IACZ,cAAc;IACd,UAAU;IACV,SAAS;IACT,aAAa;IACb,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,IAAI;IACJ,gBAAgB;IAChB,aAAa;IACb,oBAAoB;IACpB,iBAAiB;IACjB,OAAO;IACP,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,KAAK;IACL,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,SAAS;IACT,OAAO;IACP,WAAW;IACX,eAAe;IACf,IAAI;IACJ,iBAAiB;IACjB,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,WAAW;IACX,MAAM;IACN,UAAU;IACV,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,WAAW;IACX,SAAS;IACT,KAAK;IACL,SAAS;IACT,YAAY;IACZ,cAAc;IACd,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,cAAc;IACd,SAAS;IACT,aAAa;IACb,cAAc;IACd,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IACf,UAAU;IACV,SAAS;IACT,WAAW;IACX,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,MAAM;IACN,aAAa;IACb,cAAc;CACf,CAAC;AAEF,0GAA0G;AAC1G,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,iBAAiB;IACjB,iBAAiB;IACjB,wBAAwB;IACxB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,wBAAwB;IACxB,mBAAmB;IACnB,mBAAmB;IACnB,iCAAiC;IACjC,2BAA2B;IAC3B,QAAQ;IACR,iBAAiB;IACjB,iBAAiB;IACjB,sBAAsB;IACtB,OAAO;IACP,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;IACrB,sCAAsC;IACtC,yBAAyB;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,8BAA8B;IAC9B,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,eAAe;IACf,UAAU;IACV,cAAc;IACd,cAAc;IACd,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,MAAM;IACN,mBAAmB;IACnB,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,yBAAyB;IACzB,eAAe;CAChB,CAAC"}

package/dist/src/lib/generated-config-surfaces.d.ts

@@ -31,7 +31,7 @@
  * server; the CLI vendors them at build time into
  * `cli/src/lib/generated-config-surfaces.ts`
  * (`cli/scripts/gen-config-surfaces.mjs`), the same server→CLI vendoring
- * `gen-operation-def-descriptor.mjs` (#1544) already uses, so the published CLI
+ * `gen-workflow-schema-descriptor.mjs` (#1442) already uses, so the published CLI
  * still imports no server code at runtime.
  *
  * ── Scope: declarative classification and coverage ONLY ──────────────────
@@ -1101,6 +1101,19 @@ export interface RetiredConfigKey {
     request: string;
 }
 export declare const RETIRED_CONFIG_KEYS: Record<string, Record<string, RetiredConfigKey>>;
+/**
+ * Top-level TOML tables a configuration object's FILE retired — keyed by the
+ * surface's label, then by the table key. Only the TOML half exists: these were
+ * sub-trees applied through their own endpoints, never request keys of the
+ * object itself, so no request body can carry one.
+ *
+ * Without an entry here a retired table would be answered as an unrecognized
+ * one ("check the spelling, or upgrade the CLI"), which is backwards for a
+ * table removed on purpose.
+ */
+export declare const RETIRED_DOCUMENT_KEYS: Record<string, Record<string, RetiredTomlSpelling>>;
+/** The retired-table guidance for `key` on the surface labelled `label`, or null. */
+export declare function retiredDocumentKey(label: string, key: string): RetiredTomlSpelling | null;
 /** The retired-key entry for `key` under `prefix`, or null when it is simply unknown. */
 export declare function retiredConfigKey(prefix: string, key: string): RetiredConfigKey | null;
 /**
@@ -1968,7 +1981,7 @@ export declare function validateSigningSecretDeclaration(input: {
  * `preflight`.
  */
 /** The rule ids this module owns — the union type below anchors them (#3373). */
-export declare const WORKFLOW_RULE_IDS: readonly ["system-access-rule"];
+export declare const WORKFLOW_RULE_IDS: readonly ["system-access-rule", "retired-database-step-kind"];
 type WorkflowRuleId = (typeof WORKFLOW_RULE_IDS)[number];
 /** A violation of one of this module's rules, for a site to render. */
 export interface WorkflowRuleViolation extends RuleRefusal<WorkflowRuleId> {
@@ -1986,6 +1999,31 @@ export declare function checkWorkflowSystemAccessRule(input: {
     runAs?: unknown;
     accessRule?: unknown;
 }): WorkflowRuleViolation | null;
+/**
+ * The DSL step kinds that executed a registered database operation (#3189,
+ * phase 6 of project `server-functions`, matrix row M8).
+ *
+ * Every `database.*` runner except `database.syncIndexes` called
+ * `DatabaseOperationsController.execute`, so retiring database operations
+ * retires these fourteen kinds with them: the seven base kinds and their seven
+ * `*ForUser` twins. `database.syncIndexes` (which calls the records index
+ * route), `database.create` and `database.delete` (resource lifecycle) are not
+ * here and keep running until the engine retires.
+ */
+export declare const RETIRED_DATABASE_STEP_KINDS: readonly ["database.query", "database.mutate", "database.count", "database.aggregate", "database.pipeline", "database.applyToQuery", "database.batch", "database.queryForUser", "database.mutateForUser", "database.countForUser", "database.aggregateForUser", "database.pipelineForUser", "database.applyToQueryForUser", "database.batchForUser"];
+/**
+ * Every step in a definition — or the one step a run has reached — whose kind
+ * is a retired database kind, with the sentence naming the replacement.
+ *
+ * Walks the top-level `steps` and a `collect` step's nested `step`, the one
+ * place a step definition nests another. Push (the CLI preflight), save, the
+ * activation lint and the engine all ask this one question, so a definition is
+ * refused by the same words wherever it is caught, and a run that reaches such
+ * a step fails with them.
+ */
+export declare function checkWorkflowRetiredStepKinds(input: {
+    steps?: unknown;
+}): WorkflowRuleViolation[];
 export declare const WORKFLOW_SURFACE: ConfigObjectSurface;
 /**
  * Cron-expression and timezone VALIDITY — the half of `src/cron-parser.ts`

package/dist/src/lib/generated-config-surfaces.js

@@ -2440,7 +2440,44 @@ export const RETIRED_CONFIG_KEYS = {
     // #3997 — keyed by each table's TOML prefix. Only `database-type-config`
     // uses `[type]`, so that entry cannot reach another surface. The blob
     // bucket's `[bucket] ruleSetId` has its own entry under `bucket` (#4283).
-    type: { ruleSetId: RULE_SET_ID_RETIRED },
+    //
+    // #3189 — server-functions phase 6 retires database operations, and with
+    // them the two type-level CEL keys that existed for operations: the access
+    // an operation inherited and the gate on the (already retired, #3991)
+    // database CEL context. Data access goes through a function, whose `access`
+    // gate is the authorization; per-database values are resource metadata
+    // categories. Refused rather than ignored: a file that keeps the line would
+    // otherwise read as though it still gated something.
+    type: {
+        ruleSetId: RULE_SET_ID_RETIRED,
+        defaultAccess: {
+            toml: "`defaultAccess` is no longer a database type key (#3189): it was the " +
+                "access database operations inherited, and operations are retired. " +
+                "Read and write the type's records from a function — its `access` " +
+                "gate is the authorization. Delete the line and push again.",
+            request: "`defaultAccess` is retired (#3189): it was the access database " +
+                "operations inherited, and operations are retired. Gate data access " +
+                "with a function's `access` rule; omit the field.",
+        },
+        celContextAccess: {
+            toml: "`celContextAccess` is no longer a database type key (#3189): the " +
+                "database CEL context it gated is gone (#3991). Per-database values " +
+                "are resource metadata categories, each with its own readRule and " +
+                "writeRule. Delete the line and push again.",
+            request: "`celContextAccess` is retired (#3189): the database CEL context it " +
+                "gated is gone (#3991). Use a resource metadata category; omit the " +
+                "field.",
+        },
+        metadataAccess: {
+            toml: "`metadataAccess` is no longer a database type key (#3189): it was " +
+                "the legacy spelling of `celContextAccess`, which gated the retired " +
+                "database CEL context (#3991). Per-database values are resource " +
+                "metadata categories. Delete the line and push again.",
+            request: "`metadataAccess` is retired (#3189): the database CEL context it " +
+                "gated is gone (#3991). Use a resource metadata category, which has " +
+                "its own readRule and writeRule; omit the field.",
+        },
+    },
     groupTypeConfig: { ruleSetId: RULE_SET_ID_RETIRED },
     collectionTypeConfig: { ruleSetId: RULE_SET_ID_RETIRED },
     // #2803 — the OBJECT-level availability leaves TOML. The per-version
@@ -2615,6 +2652,41 @@ export const RETIRED_CONFIG_KEYS = {
         },
     },
 };
+/**
+ * Top-level TOML tables a configuration object's FILE retired — keyed by the
+ * surface's label, then by the table key. Only the TOML half exists: these were
+ * sub-trees applied through their own endpoints, never request keys of the
+ * object itself, so no request body can carry one.
+ *
+ * Without an entry here a retired table would be answered as an unrecognized
+ * one ("check the spelling, or upgrade the CLI"), which is backwards for a
+ * table removed on purpose.
+ */
+export const RETIRED_DOCUMENT_KEYS = {
+    // #3189 — server-functions phase 6 retires database operations and
+    // type-scoped subscriptions. Data access and change feeds are a function's
+    // now; the rows the two tables created are swept at deploy.
+    "database-type-config": {
+        operations: {
+            toml: "`[[operations]]` is no longer part of a database type file (#3189): " +
+                "database operations are retired. Read and write the type's records " +
+                "from a function (`ctx.db(<databaseId>).model(<Model>)`), and call the " +
+                "function from the client. Delete every `[[operations]]` block and " +
+                "push again.",
+        },
+        subscriptions: {
+            toml: "`[[subscriptions]]` is no longer part of a database type file " +
+                "(#3189): type-scoped subscriptions are retired. Publish changes on a " +
+                "channel from the function that writes them " +
+                "(`ctx.channels.authorize` / `ctx.channels.publish`). Delete every " +
+                "`[[subscriptions]]` block and push again.",
+        },
+    },
+};
+/** The retired-table guidance for `key` on the surface labelled `label`, or null. */
+export function retiredDocumentKey(label, key) {
+    return RETIRED_DOCUMENT_KEYS[label]?.[key] ?? null;
+}
 /** The retired-key entry for `key` under `prefix`, or null when it is simply unknown. */
 export function retiredConfigKey(prefix, key) {
     return RETIRED_CONFIG_KEYS[prefix]?.[key] ?? null;
@@ -4222,7 +4294,10 @@ export function validateSigningSecretDeclaration(input) {
  * `preflight`.
  */
 /** The rule ids this module owns — the union type below anchors them (#3373). */
-export const WORKFLOW_RULE_IDS = ["system-access-rule"];
+export const WORKFLOW_RULE_IDS = [
+    "system-access-rule",
+    "retired-database-step-kind",
+];
 /** The one refusal constructor: a new branch cannot compile without an id. */
 function refuseWorkflowRule(ruleId, message) {
     return { ruleId, message };
@@ -4245,6 +4320,64 @@ export function checkWorkflowSystemAccessRule(input) {
     }
     return null;
 }
+/**
+ * The DSL step kinds that executed a registered database operation (#3189,
+ * phase 6 of project `server-functions`, matrix row M8).
+ *
+ * Every `database.*` runner except `database.syncIndexes` called
+ * `DatabaseOperationsController.execute`, so retiring database operations
+ * retires these fourteen kinds with them: the seven base kinds and their seven
+ * `*ForUser` twins. `database.syncIndexes` (which calls the records index
+ * route), `database.create` and `database.delete` (resource lifecycle) are not
+ * here and keep running until the engine retires.
+ */
+export const RETIRED_DATABASE_STEP_KINDS = [
+    "database.query",
+    "database.mutate",
+    "database.count",
+    "database.aggregate",
+    "database.pipeline",
+    "database.applyToQuery",
+    "database.batch",
+    "database.queryForUser",
+    "database.mutateForUser",
+    "database.countForUser",
+    "database.aggregateForUser",
+    "database.pipelineForUser",
+    "database.applyToQueryForUser",
+    "database.batchForUser",
+];
+/**
+ * Every step in a definition — or the one step a run has reached — whose kind
+ * is a retired database kind, with the sentence naming the replacement.
+ *
+ * Walks the top-level `steps` and a `collect` step's nested `step`, the one
+ * place a step definition nests another. Push (the CLI preflight), save, the
+ * activation lint and the engine all ask this one question, so a definition is
+ * refused by the same words wherever it is caught, and a run that reaches such
+ * a step fails with them.
+ */
+export function checkWorkflowRetiredStepKinds(input) {
+    const violations = [];
+    const visit = (step) => {
+        if (!step || typeof step !== "object" || Array.isArray(step))
+            return;
+        const kind = step.kind;
+        const id = step.id;
+        if (typeof kind === "string" &&
+            RETIRED_DATABASE_STEP_KINDS.includes(kind)) {
+            const name = typeof id === "string" && id ? `step "${id}"` : "a step";
+            violations.push(refuseWorkflowRule("retired-database-step-kind", `${name} uses ${kind}, which was retired with database operations — ` +
+                "move its work into a server function (ctx.db(databaseId).model(name)) " +
+                "and call that function from the workflow with a workflow.call step"));
+        }
+        if (kind === "collect")
+            visit(step.step);
+    };
+    if (Array.isArray(input.steps))
+        input.steps.forEach(visit);
+    return violations;
+}
 // ── src/config-surface/workflow.ts ───────────────────────────────────────
 /**
  * The `workflow` configuration object's definition (issue #2644, phase 1).
@@ -4595,8 +4728,9 @@ export const WORKFLOW_SURFACE = {
     },
     // ── Cross-field rules (#3374) ─────────────────────────────────────────────
     //
-    // One rule the CLI's push preflight runs — through the vendored copy of
-    // `workflow-rules.ts` — and seven the server runs at save time. What stays
+    // Two rules the CLI's push preflight runs — through the vendored copy of
+    // `workflow-rules.ts` (the server runs both too) — and six more the server
+    // runs at save time. What stays
     // UNDECLARED, on purpose: the step-body validation (`validateWorkflowDefinition`
     // and the `steps` structural sub-tree, which is not a field-table rule), and
     // the enable-time activation lint (`workflow-activation-lint.ts`, a transition
@@ -4613,6 +4747,17 @@ export const WORKFLOW_SURFACE = {
             stage: "preflight",
             handler: enforcedBy("src/config-surface/workflow-rules.ts", "checkWorkflowSystemAccessRule"),
         },
+        {
+            id: "retired-database-step-kind",
+            description: "A step may not use a retired `database.*` kind (`database.query`, " +
+                "`mutate`, `count`, `aggregate`, `pipeline`, `applyToQuery`, `batch` " +
+                "and their `*ForUser` twins): each executed a registered database " +
+                "operation, and operations retired (#3189). `database.syncIndexes`, " +
+                "`database.create` and `database.delete` stay. Push, save, the " +
+                "activation lint and the engine ask the same predicate.",
+            stage: "preflight",
+            handler: enforcedBy("src/config-surface/workflow-rules.ts", "checkWorkflowRetiredStepKinds"),
+        },
         workflowApplyRule("run-as-value", "validateWorkflowIdentityConfig", '`runAs` must be "caller" or "system" when present — the runner has no ' +
             "third identity."),
         workflowApplyRule("capabilities-shape", "validateWorkflowIdentityConfig", "`capabilities` must be an array or set of capability strings."),
@@ -8952,20 +9097,21 @@ export const EMAIL_TEMPLATE_SURFACE = {
  * The `database-type-config` configuration object's definition (issue #2644, phase 3).
  *
  * `database-type-configs/<databaseType>.toml` is the most structured file in the sync
- * slot: a `[type]` scalar table, plus four authored sub-trees that keep the
+ * slot: a `[type]` scalar table, plus three authored sub-trees that keep the
  * validators that already own them, per the spec's scope boundary —
  *
  *   `[models.*]`      → the stored `schema` TOML string (`parseSchemaToml`)
- *   `[[operations]]`  → `DatabaseTypeOperation` rows (`toml-params-validator.ts`)
- *   `[[subscriptions]]` → `DatabaseTypeSubscription` rows (#803)
  *   `[triggers]`      → the trigger-rule tree (`validateTriggerRules`)
  *   `[metadata]`/`secrets` → the declared-access manifest (#1304)
  *
- * `operations` and `subscriptions` are separate models with their own
- * endpoints, so they are not fields of `DatabaseTypeConfig` at all; `schema`,
- * `triggers` and `metadataManifest` ARE model fields and are declared
- * `structural` here, naming the channel and the validator, so their absence
- * from the `[type]` table reads as a decision rather than an omission.
+ * `schema`, `triggers` and `metadataManifest` are model fields and are
+ * declared `structural` here, naming the channel and the validator, so their
+ * absence from the `[type]` table reads as a decision rather than an omission.
+ *
+ * #3189 — `[[operations]]` and `[[subscriptions]]` retired with database
+ * operations and type-scoped subscriptions; `config push` refuses a file that
+ * still carries either, with the sentence `retired-keys.ts` states
+ * (`RETIRED_DOCUMENT_KEYS`).
  *
  * The exposed `[type]` scalars are exactly the file-OWNED ones (#1567): `sync
  * push` sends each as value-or-`null` so removing a line from the TOML clears
@@ -9004,30 +9150,6 @@ export const DATABASE_TYPE_SURFACE = {
                     // spelling is retired in TOML (#3997): `retired-keys.ts`, `type`.
                     validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
                 },
-                {
-                    field: "metadataAccess",
-                    tomlKey: "celContextAccess",
-                    type: "string",
-                    emit: "whenSet",
-                    writableOn: BOTH,
-                    // CEL, parsed before storing (#1336). The legacy `metadataAccess`
-                    // spelling stays readable on push — see tomlOnlyKeys.
-                    deprecated: {
-                        note: "one CEL expression gates both read and update of the database " +
-                            "CEL context; use a resource metadata category, which has " +
-                            "separate readRule and writeRule",
-                    },
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
-                },
-                {
-                    field: "defaultAccess",
-                    tomlKey: "defaultAccess",
-                    type: "string",
-                    emit: "whenSet",
-                    writableOn: BOTH,
-                    // CEL, plus the shared `md`-shape allowlist (#1523).
-                    validation: handledBy(DB_TYPE_HANDLER, "DatabaseTypeConfigController", "apply"),
-                },
                 {
                     field: "autoPopulatedFields",
                     tomlKey: "autoPopulatedFields",
@@ -9087,44 +9209,8 @@ export const DATABASE_TYPE_SURFACE = {
                     note: "User who created the config; assigned server-side.",
                 },
             },
-            tomlOnlyKeys: {
-                metadataAccess: {
-                    kind: "deprecated",
-                    note: "The legacy spelling of `celContextAccess`. Read on push when the " +
-                        "newer key is absent (#1567 keeps `celContextAccess = \"\"` an " +
-                        "explicit clear); pull writes `celContextAccess`.",
-                },
-            },
-            requestOnlyKeys: {
-                pendingOpDeletes: {
-                    note: "Operation names this push is deleting, sent with the type-config " +
-                        "PATCH so the server validates the remaining schema against the " +
-                        "operations that will survive rather than the current set.",
-                },
-                pendingOpUpdates: {
-                    note: "#1336 — the post-push form of the operations this push rewrites " +
-                        "({ name, access, params }), so the child-op re-lint evaluates " +
-                        "each against what the push is about to store rather than the " +
-                        "stale row. Read by `type-config-access-lint.ts`, the same " +
-                        "look-ahead contract as `pendingOpDeletes` / `finalOpNames`.",
-                },
-                pendingOpUpserts: {
-                    modes: ["update"],
-                    note: "#2732 — the full post-push BODY of every operation this push " +
-                        "lands ({ name, type, modelName, access, definition, params }), so " +
-                        "the schema-edit gate lints a rewritten operation as rewritten " +
-                        "rather than as stored. That is what makes removing a model and " +
-                        "rewriting the operations that named it a single push. Read by " +
-                        "`pending-op-set.ts`, which honors an entry only when it is a " +
-                        "whole operation body whose name `finalOpNames` keeps — anything " +
-                        "less is ignored and the stored operation is gated instead. A " +
-                        "create has no stored operations to gate.",
-                },
-                finalOpNames: {
-                    note: "The operation names the file will end with, for the same " +
-                        "look-ahead validation as `pendingOpDeletes`.",
-                },
-            },
+            tomlOnlyKeys: {},
+            requestOnlyKeys: {},
             responseOnlyKeys: {},
         },
     ],
@@ -9134,15 +9220,6 @@ export const DATABASE_TYPE_SURFACE = {
             note: "#666 — the `[models.<Name>.fields.*]` blocks, re-serialized into the " +
                 "stored `schema` TOML string on push and merged back on pull.",
         },
-        operations: {
-            kind: "structural",
-            note: "The `[[operations]]` array. Keeps the validator that already owns it " +
-                "(`cli/src/lib/toml-params-validator.ts`) and its own endpoints.",
-        },
-        subscriptions: {
-            kind: "structural",
-            note: "#803 — the `[[subscriptions]]` array, applied through its own endpoints.",
-        },
         triggers: {
             kind: "structural",
             note: "The type's authored trigger table, stored on the type config as " +
@@ -9889,14 +9966,6 @@ export const SERVER_FUNCTION_SURFACE = {
                     note: "#3462 — WHICH admin put the active version live. Same two doors, " +
                         "same reason: the actor is observed, never declared.",
                 },
-                runAs: {
-                    kind: "server-owned",
-                    note: "RETIRED from the write surface by #3279: function code acts as " +
-                        "the system whoever invoked it, so the mode the column chose " +
-                        "between no longer exists. Declared-and-deprecated storage only " +
-                        "until phase 6 drops the column; a stored value decides nothing " +
-                        "and is never echoed.",
-                },
                 deleteLockedAt: {
                     kind: "server-owned",
                     note: "#3186 — the lease a hard delete takes before it scans for live " +
@@ -11115,8 +11184,6 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "databaseType",
         "ruleSetId",
         "triggers",
-        "metadataAccess",
-        "defaultAccess",
         "metadataManifest",
         "autoPopulatedFields",
         "timestamps",
@@ -11172,7 +11239,6 @@ export const GENERATED_CONFIG_MODEL_FIELDS = {
         "activeConfigId",
         "activeConfigActivatedAt",
         "activeConfigActivatedBy",
-        "runAs",
         "access",
         "inputSchema",
         "outputSchema",