@primitive.ai/prim 0.1.0-alpha.67 → 0.1.0-alpha.69

package/dist/{chunk-U6L2RU67.js → chunk-LMRYZL3D.js}

@@ -1,9 +1,13 @@
 import {
-  getClient
-} from "./chunk-RTLFE6EZ.js";
+  getClient,
+  isTerminalSafeText,
+  terminalSafeLine,
+  terminalSafeText
+} from "./chunk-Z7YPFWAZ.js";
 
 // src/decisions/feedback.ts
-var FEEDBACK_PROTOCOL_VERSION = 1;
+var FEEDBACK_PROTOCOL_VERSION = 2;
+var FEEDBACK_MIN_PROTOCOL_VERSION = 1;
 var FEEDBACK_DEADLINE_MS = 3e3;
 var MAX_FEEDBACK_EVENTS = 40;
 var MAX_FEEDBACK_MESSAGE_CODE_POINTS = 8e3;
@@ -15,38 +19,15 @@ var SHORT_ID = /^[0-9a-f]{8}$/u;
 var MAX_EVENT_ID_CHARS = 128;
 var MAX_RAW_INTENT_CODE_UNITS = 512;
 var MAX_FEEDBACK_WEB_URL_CHARS = 2048;
+var SAFE_PUBLISH_DECISION_ID = /^[A-Za-z0-9_-]+$/u;
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isUnsafeControl(point) {
-  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
-  const bidiControl = point === 1564 || point === 8206 || point === 8207 || point >= 8234 && point <= 8238 || point >= 8294 && point <= 8297;
-  return c0OrC1 || bidiControl;
-}
-function replaceIsolatedSurrogates(value) {
-  let out = "";
-  for (let index = 0; index < value.length; index += 1) {
-    const unit = value.charCodeAt(index);
-    if (unit >= 55296 && unit <= 56319) {
-      const next = value.charCodeAt(index + 1);
-      if (next >= 56320 && next <= 57343) {
-        out += value[index] + value[index + 1];
-        index += 1;
-      } else {
-        out += "\uFFFD";
-      }
-    } else if (unit >= 56320 && unit <= 57343) {
-      out += "\uFFFD";
-    } else {
-      out += value[index];
-    }
-  }
-  return out;
+function isSupportedProtocolVersion(value) {
+  return Number.isSafeInteger(value) && Number(value) >= FEEDBACK_MIN_PROTOCOL_VERSION && Number(value) <= FEEDBACK_PROTOCOL_VERSION;
 }
 function normalizeFeedbackIntent(value) {
-  const safeUnicode = replaceIsolatedSurrogates(value);
-  const whitespace = safeUnicode.replace(/\s+/gu, " ");
-  const withoutControls = Array.from(whitespace).filter((character) => !isUnsafeControl(character.codePointAt(0) ?? 0)).join("").replace(/\s+/gu, " ").trim();
+  const withoutControls = terminalSafeLine(value);
   const points = Array.from(withoutControls);
   if (points.length <= MAX_FEEDBACK_INTENT_CODE_POINTS) {
     return withoutControls;
@@ -54,7 +35,7 @@ function normalizeFeedbackIntent(value) {
   return `${points.slice(0, MAX_FEEDBACK_INTENT_CODE_POINTS - 1).join("")}\u2026`;
 }
 function parseFeedbackWebUrl(value) {
-  if (typeof value !== "string" || value.length === 0 || value.length > MAX_FEEDBACK_WEB_URL_CHARS || !/^https:\/\//iu.test(value) || /\s/u.test(value) || replaceIsolatedSurrogates(value) !== value || Array.from(value).some((character) => isUnsafeControl(character.codePointAt(0) ?? 0))) {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_FEEDBACK_WEB_URL_CHARS || !/^https:\/\//iu.test(value) || /\s/u.test(value) || !isTerminalSafeText(value)) {
     return void 0;
   }
   try {
@@ -67,9 +48,15 @@ function parseFeedbackWebUrl(value) {
   }
   return value;
 }
-function parseEvent(value) {
+function parseFeedbackDecisionId(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_EVENT_ID_CHARS || terminalSafeText(value) !== value || !SAFE_PUBLISH_DECISION_ID.test(value)) {
+    return void 0;
+  }
+  return value;
+}
+function parseEvent(value, protocolVersion) {
   if (!isRecord(value)) return void 0;
-  if (typeof value.eventId !== "string" || value.eventId.length === 0 || value.eventId.length > MAX_EVENT_ID_CHARS || Array.from(value.eventId).some((character) => isUnsafeControl(character.codePointAt(0) ?? 0))) {
+  if (typeof value.eventId !== "string" || value.eventId.length === 0 || value.eventId.length > MAX_EVENT_ID_CHARS || terminalSafeText(value.eventId) !== value.eventId) {
     return void 0;
   }
   if (!Number.isSafeInteger(value.leaseVersion) || Number(value.leaseVersion) < 1) {
@@ -85,40 +72,58 @@ function parseEvent(value) {
   if (!intent) return void 0;
   const webUrl = value.webUrl === void 0 ? void 0 : parseFeedbackWebUrl(value.webUrl);
   if (value.webUrl !== void 0 && webUrl === void 0) return void 0;
+  const kind = value.kind === void 0 && protocolVersion === 1 ? "confirm_prompt" : value.kind;
+  if (kind !== "confirm_prompt" && kind !== "publish_prompt") return void 0;
+  if (protocolVersion === 1 && kind === "publish_prompt") return void 0;
+  const decisionId = value.decisionId === void 0 ? void 0 : parseFeedbackDecisionId(value.decisionId);
+  if (value.decisionId !== void 0 && decisionId === void 0) return void 0;
+  if (decisionId !== void 0 && (protocolVersion !== 2 || kind !== "publish_prompt")) {
+    return void 0;
+  }
+  if (protocolVersion === 2 && kind === "publish_prompt" && decisionId === void 0) {
+    return void 0;
+  }
   return {
     eventId: value.eventId,
     leaseVersion: Number(value.leaseVersion),
     shortId: value.shortId,
     intent,
-    ...webUrl === void 0 ? {} : { webUrl }
+    ...webUrl === void 0 ? {} : { webUrl },
+    ...decisionId === void 0 ? {} : { decisionId },
+    kind
   };
 }
 function parseFeedbackLease(value) {
-  if (!isRecord(value) || value.protocolVersion !== FEEDBACK_PROTOCOL_VERSION) return void 0;
+  if (!isRecord(value) || !isSupportedProtocolVersion(value.protocolVersion)) return void 0;
+  const protocolVersion = value.protocolVersion;
   if (value.status === "empty") {
-    return value.hasMore === false ? { events: [], hasMore: false } : void 0;
+    return value.hasMore === false ? { protocolVersion, events: [], hasMore: false } : void 0;
   }
   if (value.status === "unavailable") {
-    return value.reason === "organization_unbound" ? { events: [], hasMore: false } : void 0;
+    return value.reason === "organization_unbound" ? { protocolVersion, events: [], hasMore: false } : void 0;
   }
   if (value.status !== "leased" || typeof value.hasMore !== "boolean") return void 0;
   if (!Array.isArray(value.events) || value.events.length === 0 || value.events.length > MAX_FEEDBACK_EVENTS) {
     return void 0;
   }
-  const events = value.events.map(parseEvent);
+  const events = value.events.map((event) => parseEvent(event, protocolVersion));
   if (events.some((event) => event === void 0)) return void 0;
   const parsedEvents = events;
   if (new Set(parsedEvents.map((event) => event.eventId)).size !== parsedEvents.length) {
     return void 0;
   }
-  return { events: parsedEvents, hasMore: value.hasMore };
+  return { protocolVersion, events: parsedEvents, hasMore: value.hasMore };
 }
 function renderFeedback(lease) {
   const lines = [];
   const deliveries = [];
   let pointCount = 0;
   for (const event of lease.events) {
-    const line = `[prim] response \u2192 created Decision (dec_${event.shortId}): ${event.intent}${event.webUrl ? ` (${event.webUrl})` : ""}`;
+    const decisionId = event.kind === "publish_prompt" ? parseFeedbackDecisionId(event.decisionId) : void 0;
+    if (event.kind === "publish_prompt" && decisionId === void 0) continue;
+    const identifier = `dec_${event.shortId}`;
+    const detail = `${event.intent}${event.webUrl ? ` (${event.webUrl})` : ""}`;
+    const line = event.kind === "publish_prompt" ? `[prim] publish this Decision draft (${identifier})? ${detail} Run \`prim decisions publish ${decisionId}\` to share it with your team.` : `[prim] response \u2192 created Decision (${identifier}): ${detail}`;
     const extra = Array.from(line).length + (lines.length === 0 ? 0 : 1);
     if (pointCount + extra > MAX_FEEDBACK_MESSAGE_CODE_POINTS) break;
     lines.push(line);
@@ -126,7 +131,7 @@ function renderFeedback(lease) {
     pointCount += extra;
   }
   if (lines.length === 0) return void 0;
-  return { systemMessage: lines.join("\n"), deliveries };
+  return { protocolVersion: lease.protocolVersion, systemMessage: lines.join("\n"), deliveries };
 }
 async function leaseDecisionFeedback(input, dependencies = {}) {
   try {
@@ -152,12 +157,14 @@ async function leaseDecisionFeedback(input, dependencies = {}) {
   }
 }
 async function acknowledgeDecisionFeedback(input, dependencies = {}) {
-  if (input.deliveries.length === 0 || input.deliveries.length > MAX_FEEDBACK_EVENTS) return false;
+  if (!isSupportedProtocolVersion(input.protocolVersion) || input.deliveries.length === 0 || input.deliveries.length > MAX_FEEDBACK_EVENTS) {
+    return false;
+  }
   try {
     const response = await (dependencies.client ?? getClient()).post(
       ACK_PATH,
       {
-        protocolVersion: FEEDBACK_PROTOCOL_VERSION,
+        protocolVersion: input.protocolVersion,
         workspaceId: input.workspaceId,
         deliveries: input.deliveries
       },
@@ -165,7 +172,7 @@ async function acknowledgeDecisionFeedback(input, dependencies = {}) {
     );
     const acknowledgedEventIds = isRecord(response) ? response.acknowledgedEventIds : void 0;
     const expectedEventIds = new Set(input.deliveries.map((delivery) => delivery.eventId));
-    const valid = isRecord(response) && response.protocolVersion === FEEDBACK_PROTOCOL_VERSION && response.status === "acked" && Array.isArray(acknowledgedEventIds) && acknowledgedEventIds.length <= input.deliveries.length && acknowledgedEventIds.every(
+    const valid = isRecord(response) && response.protocolVersion === input.protocolVersion && response.status === "acked" && Array.isArray(acknowledgedEventIds) && acknowledgedEventIds.length <= input.deliveries.length && acknowledgedEventIds.every(
       (id) => typeof id === "string" && id.length > 0 && id.length <= MAX_EVENT_ID_CHARS && expectedEventIds.has(id)
     ) && new Set(acknowledgedEventIds).size === acknowledgedEventIds.length;
     if (!valid) {
@@ -180,7 +187,7 @@ async function acknowledgeDecisionFeedback(input, dependencies = {}) {
   }
 }
 function parseFeedbackCapability(value) {
-  if (!isRecord(value) || value.protocolVersion !== FEEDBACK_PROTOCOL_VERSION) return void 0;
+  if (!isRecord(value) || !isSupportedProtocolVersion(value.protocolVersion)) return void 0;
   if (value.status === "available") return { status: "available" };
   if (value.status === "unavailable" && value.reason === "organization_unbound") {
     return { status: "unavailable", reason: "organization_unbound" };

package/dist/{chunk-XUAP572Z.js → chunk-RO3F6JYV.js}

@@ -1,10 +1,11 @@
 import {
   getClient,
-  getSiteUrl
-} from "./chunk-RTLFE6EZ.js";
+  getSiteUrl,
+  terminalSafeLine
+} from "./chunk-Z7YPFWAZ.js";
 import {
   daemonRequest
-} from "./chunk-UTKQTZHL.js";
+} from "./chunk-CUE2LKLR.js";
 
 // src/daemon/proxy.ts
 var DAEMON_HTTP_TIMEOUT_MS = 1e4;
@@ -93,7 +94,7 @@ var FILES_PREVIEW_LIMIT = 3;
 function formatDecisionsWarning(result) {
   const lines = [];
   if (result.unavailable !== void 0) {
-    lines.push(`[prim] decision check not verified \u2014 ${result.unavailable}`);
+    lines.push(`[prim] decision check not verified \u2014 ${terminalSafeLine(result.unavailable)}`);
   }
   if (result.decisions.length > 0) {
     lines.push(
@@ -101,12 +102,12 @@ function formatDecisionsWarning(result) {
     );
     for (const d of result.decisions) {
       const statusMark = d.status === "under_review" ? " (under review)" : "";
-      const preview = d.matchedFiles.slice(0, FILES_PREVIEW_LIMIT).join(", ");
+      const preview = d.matchedFiles.slice(0, FILES_PREVIEW_LIMIT).map(terminalSafeLine).join(", ");
       const overflow = d.matchedFiles.length > FILES_PREVIEW_LIMIT ? ` (+${String(d.matchedFiles.length - FILES_PREVIEW_LIMIT)} more)` : "";
-      lines.push(`  \xB7 ${d.intent}${statusMark}`);
+      lines.push(`  \xB7 ${terminalSafeLine(d.intent)}${statusMark}`);
       lines.push(`    files: ${preview}${overflow}`);
       if (d.rationale) {
-        lines.push(`    rationale: ${d.rationale}`);
+        lines.push(`    rationale: ${terminalSafeLine(d.rationale)}`);
       }
     }
   }

package/dist/{chunk-TDRXHBEX.js → chunk-TJTVHDJ5.js}

@@ -4,6 +4,8 @@ import { createHash } from "crypto";
 import { lstatSync, realpathSync } from "fs";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
 var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
 function gitToplevel(cwd) {
   try {
     return execFileSync("git", ["rev-parse", "--show-toplevel"], {
@@ -38,7 +40,9 @@ function githubRepositoryFullName(cwd) {
   const path = match?.[1] ?? match?.[2];
   if (!path) return null;
   const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
-  if (parts.length !== 2 || parts.some((part) => !part || part !== part.trim())) return null;
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
   return `${parts[0]}/${parts[1]}`;
 }
 function canonicalGitRoot(cwd) {
@@ -186,6 +190,8 @@ import { homedir } from "os";
 import { join } from "path";
 var PRIM_ACTIVE_KEY = "prim.active";
 var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
 var GIT_TIMEOUT_MS2 = 1e3;
 var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
@@ -218,20 +224,26 @@ function setRepoActive(cwd, active) {
 function isValidRepoSyncId(value) {
   return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
 }
-function repoSyncId(cwd) {
+function localGitConfigValue(cwd, key) {
   try {
-    const value = execFileSync2("git", ["config", "--local", "--get", PRIM_REPO_SYNC_ID_KEY], {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: GIT_TIMEOUT_MS2
     }).trim();
-    return isValidRepoSyncId(value) ? value : void 0;
+    return value || void 0;
   } catch {
     return void 0;
   }
 }
-function setRepoSyncId(cwd, value) {
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
+}
+function setRepoSyncId(cwd, value, repositoryFullName) {
   if (!isValidRepoSyncId(value)) {
     throw new Error("invalid repository binding returned by server");
   }
@@ -240,20 +252,30 @@ function setRepoSyncId(cwd, value) {
     stdio: ["ignore", "ignore", "pipe"],
     timeout: GIT_TIMEOUT_MS2
   });
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_REPOSITORY_KEY, repositoryFullName], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
 }
-function clearRepoSyncId(cwd) {
-  try {
-    execFileSync2("git", ["config", "--local", "--unset-all", PRIM_REPO_SYNC_ID_KEY], {
-      cwd,
-      stdio: ["ignore", "ignore", "pipe"],
-      timeout: GIT_TIMEOUT_MS2
-    });
-  } catch (error) {
-    if (typeof error === "object" && error !== null && "status" in error && error.status === 5) {
-      return;
-    }
-    throw error;
+function setRepositoryBindingState(cwd, state) {
+  if (state !== "connected" && state !== "unbound" && state !== "invalid") {
+    throw new Error("invalid repository binding state");
   }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_BINDING_STATE_KEY, state], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function repositoryBindingState(cwd) {
+  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
+  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
+  if (marker === "unbound" || marker === "invalid") return marker;
+  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
+  if (marker !== void 0) return "invalid";
+  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
 }
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
@@ -292,7 +314,8 @@ export {
   isValidRepoSyncId,
   repoSyncId,
   setRepoSyncId,
-  clearRepoSyncId,
+  setRepositoryBindingState,
+  repositoryBindingState,
   isRepoActiveForCapture,
   decisionIngestionStatus
 };

package/dist/{chunk-TCDUH7AN.js → chunk-WB7AUZ4C.js}

@@ -9,6 +9,7 @@ function parseAgent(argv) {
 }
 
 // src/hooks/normalize.ts
+import { createHash } from "crypto";
 var HERMES_EVENT_MAP = {
   on_session_start: "SessionStart",
   on_session_end: "SessionEnd",
@@ -19,6 +20,22 @@ var HERMES_EVENT_MAP = {
   subagent_stop: "SubagentStop"
 };
 function normalizeEnvelope(parsed, agent) {
+  if (agent === "codex") {
+    const event = parsed.hook_event_name;
+    if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
+      const stableToolIdentity = JSON.stringify([
+        parsed.session_id ?? null,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ]);
+      return {
+        ...parsed,
+        tool_use_id: `codex:fallback:v1:${createHash("sha256").update(stableToolIdentity).digest("hex")}`
+      };
+    }
+    return parsed;
+  }
   if (agent !== "hermes") {
     return parsed;
   }

package/dist/chunk-XGADQPCI.js

@@ -0,0 +1,26 @@
+// src/ingest-response.ts
+var IngestAcknowledgementError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IngestAcknowledgementError";
+  }
+};
+function requireDurableIngestAcknowledgement(value, expected) {
+  if (typeof value !== "object" || value === null) {
+    throw new IngestAcknowledgementError("ingest response was not an object");
+  }
+  const response = value;
+  if (response.disposition !== "persisted") {
+    throw new IngestAcknowledgementError("ingest response did not confirm persistence");
+  }
+  if (response.acknowledged !== expected) {
+    throw new IngestAcknowledgementError(
+      `ingest acknowledged ${String(response.acknowledged)} of ${String(expected)} moves`
+    );
+  }
+  return value;
+}
+
+export {
+  requireDurableIngestAcknowledgement
+};

package/dist/{chunk-UN5O5SYG.js → chunk-YWO7O6QG.js}

@@ -1,6 +1,11 @@
 import {
   getSiteUrl
-} from "./chunk-RTLFE6EZ.js";
+} from "./chunk-Z7YPFWAZ.js";
+import {
+  jwtOrganizationId,
+  primConfigDirectory,
+  resolveAuthCredential
+} from "./chunk-3EEFL6NJ.js";
 
 // src/journal.ts
 import {
@@ -15,9 +20,8 @@ import {
   readSync,
   readdirSync
 } from "fs";
-import { homedir } from "os";
 import { dirname, join } from "path";
-var JOURNAL_DIR = join(homedir(), ".config", "prim", "moves");
+var JOURNAL_DIR = join(primConfigDirectory(), "moves");
 var UNBOUND_BUCKET = "_unbound";
 var JOURNAL_BASENAME = "journal.ndjson";
 var JOURNAL_STATS_SAMPLE_BYTES = 64 * 1024;
@@ -139,7 +143,9 @@ function sampleJournalFile(path, maxBytes = JOURNAL_STATS_SAMPLE_BYTES) {
 function parseFlushingPid(name) {
   const segments = name.slice(FLUSHING_PREFIX.length).split(".");
   const last = segments.length >= 2 ? segments[segments.length - 1] : void 0;
-  return last !== void 0 && /^[0-9]+$/.test(last) ? Number(last) : void 0;
+  if (last === void 0 || !/^[0-9]+$/.test(last)) return void 0;
+  const pid = Number(last);
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
 }
 function listFlushingInDir(dir, bucket, options = {}) {
   if (!existsSync(dir)) {
@@ -253,18 +259,10 @@ function pendingJournalStats() {
 
 // src/binding.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
 import { dirname as dirname2, join as join2 } from "path";
-var PRIM_CONFIG_DIR = join2(homedir2(), ".config", "prim");
-var TOKEN_PATH = join2(PRIM_CONFIG_DIR, "token");
+var PRIM_CONFIG_DIR = primConfigDirectory();
 var SESSIONS_DIR = join2(PRIM_CONFIG_DIR, "sessions");
 var WORKSPACE_FILE = ".prim/workspace.json";
-var JWT_PARTS = 3;
-var BASE64_PAD_4 = 4;
-var ENV_TOKEN_LINE = /^\s*PRIM_TOKEN\s*=\s*(.*)$/m;
-var SURROUNDING_QUOTES = /^["']|["']$/g;
-var BASE64URL_MINUS = /-/g;
-var BASE64URL_UNDERSCORE = /_/g;
 function readJsonSafe(path) {
   if (!existsSync2(path)) {
     return;
@@ -296,46 +294,9 @@ function fromWorkspaceFile(startDir) {
     dir = parent;
   }
 }
-function readToken(cwd) {
-  const fromEnv = process.env.PRIM_TOKEN;
-  if (fromEnv) {
-    return fromEnv.trim();
-  }
-  if (existsSync2(TOKEN_PATH)) {
-    return readFileSync2(TOKEN_PATH, "utf-8").trim();
-  }
-  const envLocal = join2(cwd, ".env.local");
-  if (existsSync2(envLocal)) {
-    const match = readFileSync2(envLocal, "utf-8").match(ENV_TOKEN_LINE);
-    if (match) {
-      return match[1].trim().replace(SURROUNDING_QUOTES, "");
-    }
-  }
-  return;
-}
-function base64UrlDecode(s) {
-  const padded = s.padEnd(
-    s.length + (BASE64_PAD_4 - s.length % BASE64_PAD_4) % BASE64_PAD_4,
-    "="
-  );
-  const normalized = padded.replace(BASE64URL_MINUS, "+").replace(BASE64URL_UNDERSCORE, "/");
-  return Buffer.from(normalized, "base64").toString("utf-8");
-}
-function fromDefaultOrg(cwd) {
-  const token = readToken(cwd);
-  if (!token) {
-    return;
-  }
-  const parts = token.split(".");
-  if (parts.length !== JWT_PARTS) {
-    return;
-  }
-  try {
-    const claims = JSON.parse(base64UrlDecode(parts[1]));
-    return claims.org_id;
-  } catch {
-    return;
-  }
+function fromDefaultOrg(_cwd) {
+  const credential = resolveAuthCredential();
+  return credential ? jwtOrganizationId(credential.token) : void 0;
 }
 function resolveOrg(args) {
   const fromSession = fromSessionMarker(args.sessionId);