@dboio/cli 0.6.13 → 0.6.14

package/README.md

@@ -169,6 +169,10 @@ All configuration is **directory-scoped**. Each project folder maintains its own
 
 These are set interactively on first clone and saved for future use. Pre-set them in `config.json` to skip the prompt entirely.
 
+#### `app.json._domain`
+
+The `_domain` field in `app.json` stores the project's reference domain (set during `dbo clone`). This is committed to git and used for domain-change detection when running `dbo init --force` or `dbo clone --domain`. It provides a stable cross-user baseline — all collaborators share the same reference domain.
+
 ### Legacy migration
 
 If your project uses the older `.domain`, `.username`, `.password`, `.cookies` files, `dbo init` will detect them and offer to migrate automatically.
@@ -196,17 +200,20 @@ dbo init --domain my-domain.com --username me@co.io   # with credentials
 dbo init --force                                      # overwrite existing config
 dbo init --domain my-domain.com --app myapp --clone   # init + clone an app
 dbo init --domain my-domain.com -y                    # skip all prompts
+dbo init --scaffold                                   # scaffold dirs (prompts for domain)
+dbo init --scaffold --yes                             # scaffold dirs non-interactively
 ```
 
 | Flag | Description |
 |------|-------------|
 | `--domain <host>` | DBO instance domain |
 | `--username <user>` | DBO username (stored for login default) |
-| `--force` | Overwrite existing configuration |
+| `--force` | Overwrite existing configuration. Triggers a domain-change confirmation prompt when the new domain differs from the project reference domain |
 | `--app <shortName>` | App short name (triggers clone after init) |
 | `--clone` | Clone the app after initialization |
 | `-g, --global` | Install Claude commands globally (`~/.claude/commands/`) |
 | `--local` | Install Claude commands to project (`.claude/commands/`) |
+| `--scaffold` | Pre-create standard project directories (`App Versions`, `Automations`, `Bins`, `Data Sources`, `Documentation`, `Extensions`, `Groups`, `Integrations`, `Sites`) |
 | `-y, --yes` | Skip all interactive prompts (legacy migration, Claude Code setup) |
 | `--non-interactive` | Alias for `--yes` |
 
@@ -234,10 +241,16 @@ dbo init --domain my-domain.com --app myapp --clone
 |------|-------------|
 | `<source>` | Local JSON file path (optional positional argument) |
 | `--app <name>` | App short name to fetch from server |
-| `--domain <host>` | Override domain |
+| `--domain <host>` | Override domain. Triggers a domain-change confirmation prompt when it differs from the project reference domain |
 | `-y, --yes` | Auto-accept all prompts |
 | `-v, --verbose` | Show HTTP request details |
 
+#### Domain change detection
+
+When cloning with a different domain than the project's reference domain (`app.json._domain` or `config.json.domain`), the CLI warns before proceeding. When `TransactionKeyPreset=RowID`, this escalates to a critical error because numeric IDs are not unique across domains — pushing to the wrong domain can corrupt records. In non-interactive mode (`-y`), RowUID domain changes proceed with a warning, but RowID domain changes throw a hard error.
+
+The project's reference domain is stored in `app.json._domain` (committed to git) during clone, giving the CLI a stable cross-user baseline.
+
 #### What clone does
 
 1. **Loads app JSON** — from a local file, server API, or interactive prompt
@@ -438,7 +451,6 @@ Output:
   Domain: my-domain.com
   Username: user@example.com
   User ID: 10296
-  User UID: albain3dwkofbhnd1qtd1q
   Directory: /Users/me/projects/operator
   Session: Active (expires: 2026-03-15T10:30:00.000Z)
   Cookies: /Users/me/projects/operator/.dbo/cookies.txt
@@ -447,7 +459,7 @@ Output:
   dbo: ✓ global (~/.claude/commands/dbo.md)
 ```
 
-User ID and UID are populated by `dbo login`. If they show "(not set)", run `dbo login` to fetch them.
+User ID is populated by `dbo login`. If it shows "(not set)", run `dbo login` to fetch it.
 
 Plugin scopes (project or global) are displayed when plugins have been installed. Scopes are stored in `.dbo/config.local.json`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dboio/cli",
-  "version": "0.6.13",
+  "version": "0.6.14",
   "description": "CLI for the DBO.io framework",
   "type": "module",
   "bin": {

package/src/commands/clone.js

@@ -7,6 +7,7 @@ import { buildBinHierarchy, resolveBinPath, createDirectories, saveStructureFile
 import { log } from '../lib/logger.js';
 import { setFileTimestamps } from '../lib/timestamps.js';
 import { getLocalSyncTime, isServerNewer, hasLocalModifications, promptChangeDetection, inlineDiffAndMerge } from '../lib/diff.js';
+import { checkDomainChange } from '../lib/domain-guard.js';
 
 /**
  * Resolve a column value that may be base64-encoded.
@@ -437,6 +438,7 @@ export const cloneCommand = new Command('clone')
  */
 export async function performClone(source, options = {}) {
   const config = await loadConfig();
+  const effectiveDomain = options.domain || config.domain;
   let appJson;
 
   // Step 1: Load the app JSON
@@ -487,6 +489,15 @@ export async function performClone(source, options = {}) {
     throw new Error('Invalid app JSON: missing UID or children');
   }
 
+  // Domain change detection
+  if (effectiveDomain) {
+    const { changed, proceed } = await checkDomainChange(effectiveDomain, options);
+    if (changed && !proceed) {
+      log.info('Clone aborted: domain change denied.');
+      return;
+    }
+  }
+
   log.success(`Cloning "${appJson.Name}" (${appJson.ShortName})`);
 
   // Ensure sensitive files are gitignored
@@ -615,7 +626,7 @@ export async function performClone(source, options = {}) {
   }
 
   // Step 7: Save app.json with references
-  await saveAppJson(appJson, contentRefs, otherRefs);
+  await saveAppJson(appJson, contentRefs, otherRefs, effectiveDomain);
 
   // Step 8: Create .app.json baseline for delta tracking
   await saveBaselineFile(appJson);
@@ -1692,8 +1703,9 @@ export function guessExtensionForColumn(columnName) {
 /**
  * Save app.json to project root with @ references replacing processed entries.
  */
-async function saveAppJson(appJson, contentRefs, otherRefs) {
+async function saveAppJson(appJson, contentRefs, otherRefs, domain) {
   const output = { ...appJson };
+  if (domain) output._domain = domain;
   output.children = { ...appJson.children };
 
   // Replace content array with references

package/src/commands/init.js

@@ -1,9 +1,11 @@
 import { Command } from 'commander';
-import { access } from 'fs/promises';
+import { access, readdir } from 'fs/promises';
 import { join } from 'path';
 import { isInitialized, hasLegacyConfig, readLegacyConfig, initConfig, saveCredentials, ensureGitignore, saveTransactionKeyPreset } from '../lib/config.js';
 import { installOrUpdateClaudeCommands } from './install.js';
+import { scaffoldProjectDirs, logScaffoldResult } from '../lib/scaffold.js';
 import { log } from '../lib/logger.js';
+import { checkDomainChange, writeAppJsonDomain } from '../lib/domain-guard.js';
 
 export const initCommand = new Command('init')
   .description('Initialize DBO CLI configuration for the current directory')
@@ -16,11 +18,17 @@ export const initCommand = new Command('init')
   .option('--non-interactive', 'Skip all interactive prompts')
   .option('-g, --global', 'Install Claude commands to user home directory (~/.claude/commands/)')
   .option('--local', 'Install Claude commands to project directory (.claude/commands/)')
+  .option('--scaffold', 'Create standard project directories (App Versions, Automations, Bins, …)')
   .action(async (options) => {
     // Merge --yes into nonInteractive
     if (options.yes) options.nonInteractive = true;
     try {
       if (await isInitialized() && !options.force) {
+        if (options.scaffold) {
+          const result = await scaffoldProjectDirs();
+          logScaffoldResult(result);
+          return;
+        }
         log.warn('Already initialized. Use --force to overwrite.');
         return;
       }
@@ -49,18 +57,32 @@ export const initCommand = new Command('init')
       if (!domain || !username) {
         const inquirer = (await import('inquirer')).default;
         const answers = await inquirer.prompt([
-          { type: 'input', name: 'domain', message: 'Domain (e.g., myapp.dbo.io):', default: domain || undefined, when: !domain, validate: v => v ? true : 'Domain is required' },
+          { type: 'input', name: 'domain', message: 'Domain (e.g., myapp.dbo.io):', default: domain || undefined, when: !domain },
           { type: 'input', name: 'username', message: 'Username (email):', when: !username },
         ]);
         domain = domain || answers.domain;
         username = username || answers.username;
       }
 
+      let domainChanged = false;
+      if (options.force) {
+        const { changed, proceed } = await checkDomainChange(domain, options);
+        if (changed && !proceed) {
+          log.info('Init aborted: domain change denied.');
+          return;
+        }
+        domainChanged = changed;
+      }
+
       await initConfig(domain);
       if (username) {
         await saveCredentials(username);
       }
 
+      if (options.force && domainChanged) {
+        await writeAppJsonDomain(domain);
+      }
+
       // Ensure sensitive files are gitignored
       await ensureGitignore(['.dbo/credentials.json', '.dbo/cookies.txt', '.dbo/config.local.json', '.dbo/ticketing.local.json']);
 
@@ -85,6 +107,29 @@ export const initCommand = new Command('init')
         await saveTransactionKeyPreset('RowUID');
       }
 
+      // ─── Scaffold ─────────────────────────────────────────────────────────────
+      let shouldScaffold = options.scaffold;
+
+      if (!shouldScaffold && !options.nonInteractive) {
+        const entries = await readdir(process.cwd());
+        const IGNORED = new Set(['.dbo', '.claude', '.idea', '.vscode']);
+        const isEmpty = entries.every(e => IGNORED.has(e));
+
+        const inquirer = (await import('inquirer')).default;
+        const { doScaffold } = await inquirer.prompt([{
+          type: 'confirm',
+          name: 'doScaffold',
+          message: 'Would you like to scaffold the standard project directory structure?',
+          default: isEmpty,
+        }]);
+        shouldScaffold = doScaffold;
+      }
+
+      if (shouldScaffold) {
+        const result = await scaffoldProjectDirs();
+        logScaffoldResult(result);
+      }
+
       // Clone if requested
       if (options.clone || options.app) {
         let appShortName = options.app;

package/src/commands/status.js

@@ -18,7 +18,6 @@ export const statusCommand = new Command('status')
       log.label('Username', config.username || '(not set)');
       const userInfo = await loadUserInfo();
       log.label('User ID', userInfo.userId || '(not set)');
-      log.label('User UID', userInfo.userUid || '(not set — run "dbo login")');
       log.label('Directory', process.cwd());
 
       const cookiesPath = await getActiveCookiesPath();

package/src/lib/domain-guard.js

@@ -0,0 +1,95 @@
+import { readFile, writeFile, stat, utimes } from 'fs/promises';
+import { join } from 'path';
+import { loadConfig, loadTransactionKeyPreset } from './config.js';
+import { log } from './logger.js';
+
+const appJsonPath = () => join(process.cwd(), 'app.json');
+
+/** Read _domain from app.json. Returns null if file missing or field absent. */
+export async function readAppJsonDomain() {
+  try {
+    const obj = JSON.parse(await readFile(appJsonPath(), 'utf8'));
+    return obj._domain || null;
+  } catch { return null; }
+}
+
+/**
+ * Write _domain to app.json, preserving mtime so git doesn't see a spurious change.
+ * No-op if app.json does not exist.
+ */
+export async function writeAppJsonDomain(domain) {
+  const path = appJsonPath();
+  let originalStat;
+  try { originalStat = await stat(path); } catch { return; }
+  const obj = JSON.parse(await readFile(path, 'utf8'));
+  obj._domain = domain;
+  await writeFile(path, JSON.stringify(obj, null, 2) + '\n');
+  await utimes(path, originalStat.atime, originalStat.mtime); // restore mtime
+}
+
+/**
+ * Check whether newDomain differs from the project reference domain.
+ * Reference = app.json._domain (authoritative) → fallback: config.json.domain.
+ * If reference is absent entirely, returns { changed: false } (no warning).
+ *
+ * Returns { changed: false } or { changed: true, proceed: bool }.
+ * Throws in non-interactive mode when TransactionKeyPreset=RowID and domain changes.
+ */
+export async function checkDomainChange(newDomain, options = {}) {
+  let referenceDomain = await readAppJsonDomain();
+  if (!referenceDomain) {
+    const config = await loadConfig();
+    referenceDomain = config.domain || null;
+  }
+  if (!referenceDomain) return { changed: false };
+
+  const norm = d => d ? String(d).replace(/^https?:\/\//, '').replace(/\/$/, '').toLowerCase() : null;
+  if (norm(newDomain) === norm(referenceDomain)) return { changed: false };
+
+  const preset = await loadTransactionKeyPreset();
+  const isRowID = preset === 'RowID';
+
+  if (options.yes || !process.stdin.isTTY) {
+    if (isRowID) {
+      throw new Error(
+        `Domain change detected: "${referenceDomain}" → "${newDomain}"\n` +
+        `Cannot proceed in non-interactive mode with TransactionKeyPreset=RowID. ` +
+        `Numeric IDs are not unique across domains — submitting to the wrong domain may overwrite or corrupt records.`
+      );
+    }
+    log.warn(`Domain change detected: "${referenceDomain}" → "${newDomain}". Proceeding (TransactionKeyPreset=RowUID).`);
+    return { changed: true, proceed: true };
+  }
+
+  const inquirer = (await import('inquirer')).default;
+  log.plain('');
+
+  if (isRowID) {
+    log.error('⛔  CRITICAL: Domain change detected');
+    log.warn(`  Reference domain : ${referenceDomain}`);
+    log.warn(`  New domain       : ${newDomain}`);
+    log.plain('');
+    log.warn('  TransactionKeyPreset=RowID is active. Numeric IDs are NOT unique across');
+    log.warn('  domains. Pushing to the wrong domain may overwrite or corrupt records in');
+    log.warn('  a different app.');
+    log.plain('');
+    const { confirmText } = await inquirer.prompt([{
+      type: 'input',
+      name: 'confirmText',
+      message: `Type "yes, change domain" to confirm switching to "${newDomain}":`,
+    }]);
+    return { changed: true, proceed: confirmText.trim() === 'yes, change domain' };
+  }
+
+  log.warn('⚠  Domain change detected');
+  log.dim(`  Reference domain : ${referenceDomain}`);
+  log.dim(`  New domain       : ${newDomain}`);
+  log.plain('');
+  const { confirm } = await inquirer.prompt([{
+    type: 'confirm',
+    name: 'confirm',
+    message: `Switch domain from "${referenceDomain}" to "${newDomain}"?`,
+    default: false,
+  }]);
+  return { changed: true, proceed: confirm };
+}

package/src/lib/scaffold.js

@@ -0,0 +1,62 @@
+import { mkdir, stat, writeFile, access } from 'fs/promises';
+import { join } from 'path';
+import { DEFAULT_PROJECT_DIRS } from './structure.js';
+import { log } from './logger.js';
+
+/**
+ * Scaffold the standard DBO project directory structure in cwd.
+ * Creates missing directories, skips existing ones, warns on name conflicts.
+ * Also creates app.json with {} if absent.
+ *
+ * @param {string} [cwd=process.cwd()]
+ * @returns {Promise<{ created: string[], skipped: string[], warned: string[] }>}
+ */
+export async function scaffoldProjectDirs(cwd = process.cwd()) {
+  const created = [];
+  const skipped = [];
+  const warned  = [];
+
+  for (const dir of DEFAULT_PROJECT_DIRS) {
+    const target = join(cwd, dir);
+    try {
+      const s = await stat(target);
+      if (s.isDirectory()) {
+        skipped.push(dir);
+      } else {
+        log.warn(`  Skipping "${dir}" — a file with that name already exists`);
+        warned.push(dir);
+      }
+    } catch {
+      // Does not exist — create it
+      await mkdir(target, { recursive: true });
+      created.push(dir);
+    }
+  }
+
+  // Create app.json if absent
+  const appJsonPath = join(cwd, 'app.json');
+  try {
+    await access(appJsonPath);
+  } catch {
+    await writeFile(appJsonPath, '{}\n');
+    created.push('app.json');
+  }
+
+  return { created, skipped, warned };
+}
+
+/**
+ * Print the scaffold summary to the console.
+ * @param {{ created: string[], skipped: string[], warned: string[] }} result
+ */
+export function logScaffoldResult({ created, skipped, warned }) {
+  if (created.length) {
+    log.success('Scaffolded directories:');
+    for (const d of created) log.dim(`  + ${d}`);
+  }
+  if (skipped.length) {
+    log.dim('Skipped (already exist):');
+    for (const d of skipped) log.dim(`  · ${d}`);
+  }
+  // warned items already printed inline during scaffold
+}