primcli 1.75.0 → 3.0.0-preview.10

package/dist/{cli-config-B80p0pLk.js → cli-config-Ms_0vNjq.js}

@@ -391,6 +391,7 @@ var LegacyApiKeyCredentialFormatError = class extends Error {
 };
 function parseCredentials(raw) {
 	if (!isRecord$1(raw)) throw new Error(`Stored Primitive CLI credentials are malformed: expected a JSON object. ${MALFORMED_CREDENTIALS_HINT}`);
+	if (raw.auth_method === "user_grant") return parseUserGrantCredentials(raw);
 	if (raw.auth_method !== "oauth") {
 		if (typeof raw.api_key === "string" || typeof raw.key_id === "string" || typeof raw.base_url === "string") throw new LegacyApiKeyCredentialFormatError();
 		throw new Error(`Stored Primitive CLI credentials are malformed: auth_method must be oauth. ${MALFORMED_CREDENTIALS_HINT}`);
@@ -412,6 +413,63 @@ function parseCredentials(raw) {
 		created_at: requireString(raw, "created_at")
 	};
 }
+function malformed(detail) {
+	return /* @__PURE__ */ new Error(`Stored Primitive CLI credentials are malformed: ${detail}. ${MALFORMED_CREDENTIALS_HINT}`);
+}
+function requireText(value, key, options = {}) {
+	const raw = value[key];
+	if (typeof raw !== "string" || !options.allowEmpty && raw.trim().length === 0) throw malformed(`${key} must be a non-empty string`);
+	return raw;
+}
+function nullableText(value, key) {
+	const raw = value[key];
+	if (raw === void 0 || raw === null) return null;
+	if (typeof raw !== "string") throw malformed(`${key} must be a string or null`);
+	return raw;
+}
+function parseOrgToken(raw) {
+	if (!isRecord$1(raw)) throw malformed("user_grant.org_tokens entries must be objects");
+	return {
+		access_token: requireText(raw, "access_token"),
+		expires_at: requireText(raw, "expires_at"),
+		oauth_grant_id: requireText(raw, "oauth_grant_id"),
+		org_id: requireText(raw, "org_id"),
+		org_name: nullableText(raw, "org_name"),
+		role: nullableText(raw, "role")
+	};
+}
+function parseUserGrantCredentials(raw) {
+	const grantRaw = raw.user_grant;
+	if (!isRecord$1(grantRaw)) throw malformed("user_grant must be an object");
+	if (raw.token_type !== "Bearer") throw malformed("token_type must be Bearer");
+	const tokensRaw = grantRaw.org_tokens ?? {};
+	if (!isRecord$1(tokensRaw)) throw malformed("user_grant.org_tokens must be an object");
+	const orgTokens = {};
+	for (const [orgId, token] of Object.entries(tokensRaw)) orgTokens[orgId] = parseOrgToken(token);
+	const orgId = requireText(raw, "org_id", { allowEmpty: true });
+	return {
+		access_token: requireText(raw, "access_token", { allowEmpty: true }),
+		api_base_url: readStoredApiBaseUrl(raw),
+		auth_method: "user_grant",
+		created_at: requireText(raw, "created_at"),
+		expires_at: requireText(raw, "expires_at"),
+		oauth_client_id: requireText(raw, "oauth_client_id"),
+		oauth_grant_id: requireText(raw, "oauth_grant_id", { allowEmpty: true }),
+		org_id: orgId,
+		org_name: nullableText(raw, "org_name"),
+		refresh_token: requireText(raw, "refresh_token"),
+		token_type: "Bearer",
+		user_grant: {
+			access_token: requireText(grantRaw, "access_token"),
+			expires_at: requireText(grantRaw, "expires_at"),
+			org_role: nullableText(grantRaw, "org_role"),
+			org_tokens: orgTokens,
+			requested_grant: nullableText(grantRaw, "requested_grant"),
+			user_grant_id: requireText(grantRaw, "user_grant_id"),
+			user_id: requireText(grantRaw, "user_id")
+		}
+	};
+}
 function credentialsPath(configDir) {
 	return join(configDir, CREDENTIALS_FILE);
 }
@@ -674,21 +732,6 @@ function detectPrimitiveKeyEnvMisname(env = process.env) {
 	if ((primitiveKey?.length ?? 0) > 0 && (primitiveApiKey?.length ?? 0) === 0) return "PRIMITIVE_KEY is set but the CLI reads PRIMITIVE_API_KEY. Rename your env var, or re-run with PRIMITIVE_API_KEY=$PRIMITIVE_KEY.";
 	return null;
 }
-/**
-* True when a usable OAuth login session is saved on disk. Used by `pay-email`
-* to decide whether it can safely ignore an env-only `PRIMITIVE_API_KEY` in
-* favor of the payer's logged-in account (which owns the inbound challenge
-* inbox). Returns false when nothing is stored or the stored credential is
-* unreadable/legacy, so the caller falls back to whatever key did resolve
-* rather than silently dropping the user's only auth.
-*/
-function hasStoredCliLogin(configDir) {
-	try {
-		return loadCliCredentials(configDir) !== null;
-	} catch {
-		return false;
-	}
-}
 function resolveCliAuth(params) {
 	const apiKey = params.apiKey?.trim();
 	const apiBaseUrl = normalizeApiBaseUrl(params.apiBaseUrl);
@@ -903,4 +946,4 @@ function redactCliEnvironment(environment) {
 		...headers ? { headers } : {}
 	};
 }
-export { saveActiveChatState as A, parseConnectedAgentProfile as B, resolveCliAuth as C, deleteChatState as D, chatStatePath as E, agentProfileName as F, PrimitiveApiClient as G, profileAlreadyConnectedMessage as H, agentProfilesDirectory as I, connectedAgentIdentity as L, AGENT_PROFILE_ENV as M, AgentConnectionSetupError as N, loadActiveChatState as O, agentProfileDirectory as P, connectedApiBaseUrl as R, normalizeApiBaseUrl as S, saveSignupCredentials as T, requireDefaultLoginProfile as U, parseOwnerMemberAddress as V, saveConnectedAgentProfile as W, deleteCliCredentials as _, normalizeCliEnvironmentName as a, hasStoredCliLogin as b, resolveConfigEnvironment as c, validateCliHeaderName as d, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, AGENT_ADDRESS_ENV as j, loadChatConversationByLocalId as k, saveCliConfig as l, cliAccessTokenExpiresAt as m, deleteCliConfig as n, redactCliEnvironment as o, acquireCliCredentialsLock as p, emptyCliConfig as r, removeCliEnvironment as s, DEFAULT_ENVIRONMENT as t, upsertCliEnvironment as u, deleteCliCredentialsLock as v, saveCliCredentials as w, loadCliCredentials as x, detectPrimitiveKeyEnvMisname as y, loadConnectedAgentProfile as z };
+export { AGENT_ADDRESS_ENV as A, parseOwnerMemberAddress as B, saveCliCredentials as C, loadActiveChatState as D, deleteChatState as E, agentProfilesDirectory as F, requireDefaultLoginProfile as H, connectedAgentIdentity as I, connectedApiBaseUrl as L, AgentConnectionSetupError as M, agentProfileDirectory as N, loadChatConversationByLocalId as O, agentProfileName as P, loadConnectedAgentProfile as R, resolveCliAuth as S, chatStatePath as T, saveConnectedAgentProfile as U, profileAlreadyConnectedMessage as V, PrimitiveApiClient as W, deleteCliCredentials as _, normalizeCliEnvironmentName as a, loadCliCredentials as b, resolveConfigEnvironment as c, validateCliHeaderName as d, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, AGENT_PROFILE_ENV as j, saveActiveChatState as k, saveCliConfig as l, cliAccessTokenExpiresAt as m, deleteCliConfig as n, redactCliEnvironment as o, acquireCliCredentialsLock as p, emptyCliConfig as r, removeCliEnvironment as s, DEFAULT_ENVIRONMENT as t, upsertCliEnvironment as u, deleteCliCredentialsLock as v, saveSignupCredentials as w, normalizeApiBaseUrl as x, detectPrimitiveKeyEnvMisname as y, parseConnectedAgentProfile as z };

package/dist/{json-output-BzSBR-KX.js → json-output-ch756TXV.js}

@@ -1,3 +1,4 @@
+import { Flags } from "@oclif/core";
 import { format } from "node:util";
 // src/oclif/json-output.ts
 /**
@@ -22,6 +23,11 @@ import { format } from "node:util";
 * line per result on stdout, and on failure one more JSON line carrying
 * `error` and `exit_code`.
 */
+/**
+* The `--json` flag for a hand-rolled command whose output is already JSON.
+* Declaring it is enough: the registry guards every command that has it.
+*/
+const JSON_OUTPUT_FLAG = Flags.boolean({ description: "Print exactly one JSON document on stdout, on success and on failure, and nothing on stderr. A failure prints the error with exit_code." });
 const GUARDED = Symbol.for("primitive.cli.jsonOutputGuard");
 /** True when `--json` appears before any `--` separator. */
 function jsonOutputRequested(argv) {
@@ -139,11 +145,18 @@ function errorExitCode(error) {
 function isExitSignal(error) {
 	return error?.code === "EEXIT";
 }
+/**
+* The `error` a `--json` document carries for a thrown error: its message,
+* and its `code` and `details` when it has them (a refusal the CLI makes in
+* an API error's shape, such as a send without mail:send).
+*/
 function thrownErrorBody(error) {
 	if (error instanceof Error) {
 		const body = { message: error.message };
 		const code = error.code;
 		if (typeof code === "string" && code !== "EEXIT") body.code = code;
+		const details = error.details;
+		if (isPlainObject(details)) body.details = details;
 		return body;
 	}
 	return { message: String(error) };
@@ -318,4 +331,4 @@ function guardJsonOutputCommands(commands) {
 		if (flags && "json" in flags || enableJsonFlag === true) guardJsonOutput(command);
 	}
 }
-export { jsonOutputRequested as n, runStreamingJson as r, guardJsonOutputCommands as t };
+export { thrownErrorBody as a, runStreamingJson as i, guardJsonOutputCommands as n, jsonOutputRequested as r, JSON_OUTPUT_FLAG as t };