primitive-admin 1.0.40 → 1.0.42

package/dist/src/lib/credentials-store.js

@@ -0,0 +1,307 @@
+/**
+ * Credentials storage with dual-mode support.
+ *
+ * Mode A (project mode): credentials live at
+ *   <projectRoot>/.primitive/credentials.json
+ * with per-environment slots:
+ *   {
+ *     "environments": {
+ *       "dev":  { "accessToken": "...", "refreshToken": "...", ... },
+ *       "prod": { ... }
+ *     }
+ *   }
+ *
+ * Mode B (legacy mode): no .primitive/config.json in scope, so we fall back to
+ *   ~/.primitive/credentials.json
+ * with the flat Credentials shape the CLI has always used.
+ *
+ * The legacy mode is still the "global default" for users who haven't
+ * run `primitive init` yet.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { getCurrentEnvironment, getProjectConfig } from "./env-resolver.js";
+export const PROJECT_LOCAL_DIR = ".primitive";
+export const PROJECT_CREDENTIALS_FILENAME = "credentials.json";
+/**
+ * Resolves the legacy config dir on each call (rather than capturing it
+ * at module load) so tests and environment variables can override it
+ * after the module has already been imported.
+ */
+function getLegacyConfigDir() {
+    return process.env.PRIMITIVE_CONFIG_DIR || join(homedir(), ".primitive");
+}
+function getLegacyCredentialsFile() {
+    return join(getLegacyConfigDir(), PROJECT_CREDENTIALS_FILENAME);
+}
+/** Returns true when a .primitive/config.json is in scope (project mode active). */
+export function isProjectMode() {
+    return getProjectConfig() !== null;
+}
+/**
+ * Returns the path to the credentials file that will be used, based on
+ * whether we're in project mode or legacy mode.
+ */
+export function getCredentialsFilePath() {
+    const env = resolveCurrentEnvironment();
+    if (env) {
+        return join(env.projectRoot, PROJECT_LOCAL_DIR, PROJECT_CREDENTIALS_FILENAME);
+    }
+    return getLegacyCredentialsFile();
+}
+/**
+ * Resolves the current environment. If an environment CAN'T be resolved
+ * (e.g. --env points at an unknown name), this throws — we never silently
+ * fall back to legacy credentials because a typo in the env name must not
+ * cause the CLI to operate against the wrong app/server.
+ *
+ * Returns null only in genuine legacy mode (no project config found at all).
+ */
+function resolveCurrentEnvironment() {
+    return getCurrentEnvironment();
+}
+function ensureDir(dir) {
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function readJsonFile(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const data = readFileSync(path, "utf-8");
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Loads a legacy (global) credentials file. Used for backwards compat.
+ */
+function loadLegacyCredentials() {
+    return readJsonFile(getLegacyCredentialsFile());
+}
+/**
+ * Loads the project credentials file, if present. Never throws — returns
+ * an empty shape when the file is missing or unreadable.
+ */
+function loadProjectCredentialsFile(projectRoot) {
+    const path = join(projectRoot, PROJECT_LOCAL_DIR, PROJECT_CREDENTIALS_FILENAME);
+    const data = readJsonFile(path);
+    if (!data || typeof data !== "object" || !data.environments) {
+        return { environments: {} };
+    }
+    return data;
+}
+function writeProjectCredentialsFile(projectRoot, file) {
+    const dir = join(projectRoot, PROJECT_LOCAL_DIR);
+    ensureDir(dir);
+    const path = join(dir, PROJECT_CREDENTIALS_FILENAME);
+    writeFileSync(path, JSON.stringify(file, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Best-effort on Windows / weird filesystems
+    }
+}
+/**
+ * Reads credentials for the current environment (project mode) or the
+ * legacy global file. Returns the standard Credentials shape so existing
+ * callers don't need to change.
+ *
+ * In project mode, we blend the per-env stored creds with the serverUrl
+ * and appId from .primitive/config.json to produce the Credentials the rest of
+ * the CLI expects.
+ */
+export function loadCredentialsStore() {
+    const env = resolveCurrentEnvironment();
+    if (!env) {
+        return loadLegacyCredentials();
+    }
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    const stored = file.environments[env.name];
+    if (!stored)
+        return null;
+    return {
+        serverUrl: env.config.apiUrl,
+        accessToken: stored.accessToken,
+        refreshToken: stored.refreshToken,
+        expiresAt: stored.expiresAt,
+        adminId: stored.adminId,
+        email: stored.email,
+        role: stored.role,
+        name: stored.name,
+        // Prefer the project-level appId (canonical); fall back to the stored
+        // per-session current app for compatibility.
+        currentAppId: env.config.appId || stored.currentAppId,
+        currentAppName: env.config.appName || stored.currentAppName,
+        globalAdminAppId: stored.globalAdminAppId,
+    };
+}
+/**
+ * Saves credentials. In project mode, writes to the per-env slot in the
+ * project credentials file. In legacy mode, writes the global file.
+ *
+ * The serverUrl on the incoming Credentials is used as-is for legacy
+ * mode, and ignored in project mode (the env's apiUrl is canonical).
+ */
+export function saveCredentialsStore(credentials) {
+    const env = resolveCurrentEnvironment();
+    if (!env) {
+        ensureDir(getLegacyConfigDir());
+        writeFileSync(getLegacyCredentialsFile(), JSON.stringify(credentials, null, 2), {
+            mode: 0o600,
+        });
+        try {
+            chmodSync(getLegacyCredentialsFile(), 0o600);
+        }
+        catch {
+            // Best-effort
+        }
+        return;
+    }
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    file.environments[env.name] = {
+        accessToken: credentials.accessToken,
+        refreshToken: credentials.refreshToken,
+        expiresAt: credentials.expiresAt,
+        adminId: credentials.adminId,
+        email: credentials.email,
+        role: credentials.role,
+        name: credentials.name,
+        globalAdminAppId: credentials.globalAdminAppId,
+        // Only persist currentAppId/Name when they're NOT already declared
+        // in .primitive/config.json — otherwise the project config is the source of
+        // truth.
+        currentAppId: env.config.appId ? undefined : credentials.currentAppId,
+        currentAppName: env.config.appName ? undefined : credentials.currentAppName,
+    };
+    writeProjectCredentialsFile(env.projectRoot, file);
+}
+/**
+ * Clears credentials for the current environment (project mode) or
+ * deletes the legacy file (legacy mode).
+ */
+export function clearCredentialsStore() {
+    const env = resolveCurrentEnvironment();
+    if (!env) {
+        try {
+            if (existsSync(getLegacyCredentialsFile())) {
+                unlinkSync(getLegacyCredentialsFile());
+            }
+        }
+        catch {
+            // Ignore
+        }
+        return;
+    }
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    delete file.environments[env.name];
+    writeProjectCredentialsFile(env.projectRoot, file);
+}
+/**
+ * Removes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `env remove` so stale tokens from a
+ * previously-removed environment can never be silently re-used if the same
+ * name is later added back. Never throws.
+ */
+export function clearCredentialsForEnvInProject(projectRoot, envName) {
+    try {
+        const file = loadProjectCredentialsFile(projectRoot);
+        if (file.environments[envName]) {
+            delete file.environments[envName];
+            writeProjectCredentialsFile(projectRoot, file);
+        }
+    }
+    catch {
+        // Best-effort — removal is not a hard requirement for env removal to succeed.
+    }
+}
+/**
+ * Lists all environments that have stored credentials in project mode.
+ * Returns an empty array in legacy mode.
+ */
+export function listAuthenticatedEnvironments() {
+    const env = resolveCurrentEnvironment();
+    if (!env)
+        return [];
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    return Object.keys(file.environments);
+}
+/**
+ * Updates the "current app" in credential storage. In project mode with a
+ * project-level appId this is a no-op (the project config is canonical).
+ */
+export function setCurrentAppStore(appId, appName) {
+    const env = resolveCurrentEnvironment();
+    if (!env) {
+        // Legacy mode — mutate the global credentials file directly.
+        const creds = loadLegacyCredentials();
+        if (!creds) {
+            throw new Error("Not logged in. Run 'primitive login' first.");
+        }
+        creds.currentAppId = appId;
+        creds.currentAppName = appName;
+        ensureDir(getLegacyConfigDir());
+        writeFileSync(getLegacyCredentialsFile(), JSON.stringify(creds, null, 2), {
+            mode: 0o600,
+        });
+        return;
+    }
+    // Project mode: if the env already has an appId in .primitive/config.json, we
+    // don't overwrite it here (use `primitive env use` or edit .primitive/config.json
+    // to change the project binding). We *do* store a per-session override
+    // in credentials for environments without a declared appId.
+    if (env.config.appId) {
+        // No-op: env is bound to a specific appId in .primitive/config.json
+        return;
+    }
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    const slot = file.environments[env.name];
+    if (!slot) {
+        throw new Error(`Not logged in to environment "${env.name}". Run 'primitive login --env ${env.name}' first.`);
+    }
+    slot.currentAppId = appId;
+    slot.currentAppName = appName;
+    writeProjectCredentialsFile(env.projectRoot, file);
+}
+/**
+ * Clears the "current app" for the current environment.
+ */
+export function clearCurrentAppStore() {
+    const env = resolveCurrentEnvironment();
+    if (!env) {
+        const creds = loadLegacyCredentials();
+        if (!creds)
+            return;
+        delete creds.currentAppId;
+        delete creds.currentAppName;
+        ensureDir(getLegacyConfigDir());
+        writeFileSync(getLegacyCredentialsFile(), JSON.stringify(creds, null, 2), {
+            mode: 0o600,
+        });
+        return;
+    }
+    if (env.config.appId) {
+        // Can't clear a project-bound app; the user should edit .primitive/config.json.
+        return;
+    }
+    const file = loadProjectCredentialsFile(env.projectRoot);
+    const slot = file.environments[env.name];
+    if (!slot)
+        return;
+    delete slot.currentAppId;
+    delete slot.currentAppName;
+    writeProjectCredentialsFile(env.projectRoot, file);
+}
+/**
+ * Returns the legacy credentials file, if one exists. Used by migration
+ * prompts that want to detect a pre-project-config install.
+ */
+export function peekLegacyCredentials() {
+    return loadLegacyCredentials();
+}
+//# sourceMappingURL=credentials-store.js.map

package/dist/src/lib/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/lib/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAE/D;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAClE,CAAC;AA0BD,oFAAoF;AACpF,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,wBAAwB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB;IAChC,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAI,IAAY;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB;IAC5B,OAAO,YAAY,CAAc,wBAAwB,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,WAAmB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,YAAY,CAAyB,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5D,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B,CAClC,WAAmB,EACnB,IAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;QAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,sEAAsE;QACtE,6CAA6C;QAC7C,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;QACrD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc;QAC3D,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAwB;IAC3D,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAChC,aAAa,CAAC,wBAAwB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YAC9E,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACH,SAAS,CAAC,wBAAwB,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG;QAC5B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,mEAAmE;QACnE,4EAA4E;QAC5E,SAAS;QACT,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY;QACrE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc;KAC5E,CAAC;IACF,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;gBAC3C,UAAU,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,WAAmB,EACnB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAClC,2BAA2B,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAAgB;IAChE,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,6DAA6D;QAC7D,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC;QAC/B,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAChC,aAAa,CAAC,wBAAwB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACxE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,kFAAkF;IAClF,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,oEAAoE;QACpE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,CAAC,IAAI,iCAAiC,GAAG,CAAC,IAAI,UAAU,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,OAAO,KAAK,CAAC,YAAY,CAAC;QAC1B,OAAO,KAAK,CAAC,cAAc,CAAC;QAC5B,SAAS,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAChC,aAAa,CAAC,wBAAwB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACxE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,gFAAgF;QAChF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IACzB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,2BAA2B,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC"}

package/dist/src/lib/env-resolver.js

@@ -0,0 +1,121 @@
+/**
+ * Environment resolution.
+ *
+ * Decides which named environment the CLI is currently targeting. The
+ * resolution order is:
+ *
+ *   1. Explicit --env <name> flag (set via setCurrentEnvName from bin/primitive.ts)
+ *   2. PRIMITIVE_ENV environment variable
+ *   3. The project config's defaultEnvironment
+ *   4. If the project has exactly one environment, that one
+ *   5. null (legacy mode — fall back to ~/.primitive/credentials.json)
+ *
+ * Commands read the resolved environment once via getCurrentEnvironment().
+ * The resolution is cached for the lifetime of the process.
+ */
+import { loadProjectConfig, findProjectConfigPath, findProjectRoot, PROJECT_CONFIG_DISPLAY_NAME, } from "./project-config.js";
+/** Process-lifetime cache for resolution results. */
+let cachedResolution;
+let explicitEnvName = null;
+let cachedProjectConfig;
+/**
+ * Called by bin/primitive.ts when the user passes --env <name> on the command
+ * line. Must be called before any command code runs so subsequent calls to
+ * getCurrentEnvironment() see the override.
+ */
+export function setCurrentEnvName(name) {
+    explicitEnvName = name;
+    // Invalidate any cached resolution so the next getCurrentEnvironment()
+    // picks up the new override.
+    cachedResolution = undefined;
+}
+/**
+ * Forces the resolver to re-read the project config on the next call.
+ * Used by tests and by commands that mutate the project config.
+ */
+export function resetEnvResolver() {
+    cachedResolution = undefined;
+    cachedProjectConfig = undefined;
+}
+/**
+ * Loads and caches the project config. Returns null if no
+ * .primitive/config.json is present. Throws ProjectConfigError on a broken config.
+ */
+export function getProjectConfig() {
+    if (cachedProjectConfig === undefined) {
+        cachedProjectConfig = loadProjectConfig();
+    }
+    return cachedProjectConfig ?? null;
+}
+/**
+ * Resolves the current environment, or returns null if we're running in
+ * legacy mode (no .primitive/config.json present).
+ *
+ * This never throws for a missing project config — that's legitimate
+ * "legacy mode" usage. It DOES throw if the project config exists but the
+ * requested environment doesn't.
+ */
+export function getCurrentEnvironment() {
+    if (cachedResolution !== undefined)
+        return cachedResolution;
+    const project = getProjectConfig();
+    if (!project) {
+        cachedResolution = null;
+        return null;
+    }
+    const configPath = findProjectConfigPath();
+    const projectRoot = findProjectRoot();
+    // Determine the environment name.
+    const requested = explicitEnvName ??
+        process.env.PRIMITIVE_ENV ??
+        project.defaultEnvironment ??
+        null;
+    let name;
+    if (requested) {
+        if (!project.environments[requested]) {
+            const available = Object.keys(project.environments).join(", ") || "(none)";
+            throw new Error(`Environment "${requested}" is not defined in ${PROJECT_CONFIG_DISPLAY_NAME}. Available: ${available}`);
+        }
+        name = requested;
+    }
+    else {
+        const names = Object.keys(project.environments);
+        if (names.length === 1) {
+            name = names[0];
+        }
+        else if (names.length === 0) {
+            throw new Error(`${PROJECT_CONFIG_DISPLAY_NAME} has no environments defined. Run 'primitive env add <name>' or 'primitive init'.`);
+        }
+        else {
+            throw new Error(`No environment selected. Set "defaultEnvironment" in ${PROJECT_CONFIG_DISPLAY_NAME}, pass --env <name>, or export PRIMITIVE_ENV. Available: ${names.join(", ")}`);
+        }
+    }
+    cachedResolution = {
+        name,
+        config: project.environments[name],
+        projectConfigPath: configPath,
+        projectRoot,
+    };
+    return cachedResolution;
+}
+/**
+ * Returns the current environment name for display purposes (e.g. in status
+ * headers). Returns null in legacy mode. Swallows resolution errors so the
+ * header never crashes the CLI.
+ */
+export function getCurrentEnvNameSafe() {
+    try {
+        return getCurrentEnvironment()?.name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Returns the explicit name set via setCurrentEnvName(), for commands that
+ * need to know whether the user passed --env vs. relying on defaults.
+ */
+export function getExplicitEnvName() {
+    return explicitEnvName;
+}
+//# sourceMappingURL=env-resolver.js.map

package/dist/src/lib/env-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-resolver.js","sourceRoot":"","sources":["../../../src/lib/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,2BAA2B,GAG5B,MAAM,qBAAqB,CAAC;AAa7B,qDAAqD;AACrD,IAAI,gBAAwD,CAAC;AAC7D,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,mBAAqD,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,eAAe,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,6BAA6B;IAC7B,gBAAgB,GAAG,SAAS,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,gBAAgB,GAAG,SAAS,CAAC;IAC7B,mBAAmB,GAAG,SAAS,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,mBAAmB,GAAG,iBAAiB,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,mBAAmB,IAAI,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IAE5D,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,EAAG,CAAC;IAC5C,MAAM,WAAW,GAAG,eAAe,EAAG,CAAC;IAEvC,kCAAkC;IAClC,MAAM,SAAS,GACb,eAAe;QACf,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,CAAC,kBAAkB;QAC1B,IAAI,CAAC;IAEP,IAAI,IAAY,CAAC;IACjB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC3E,MAAM,IAAI,KAAK,CACb,gBAAgB,SAAS,uBAAuB,2BAA2B,gBAAgB,SAAS,EAAE,CACvG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,GAAG,2BAA2B,mFAAmF,CAClH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,wDAAwD,2BAA2B,4DAA4D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB,GAAG;QACjB,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;QAClC,iBAAiB,EAAE,UAAU;QAC7B,WAAW;KACZ,CAAC;IACF,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,OAAO,qBAAqB,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/paginate.js

@@ -0,0 +1,42 @@
+/**
+ * Cursor-pagination helper used by the CLI's API client.
+ *
+ * The server exposes cursor-paginated endpoints (e.g. GET /admin/api/admins/me/apps)
+ * that return `{ items, nextCursor? }` pages. Callers historically only fetched
+ * the first page, silently truncating results (see issue #436). This helper
+ * walks every page and aggregates the items in order.
+ *
+ * Exported separately so the looping contract can be unit-tested without
+ * stubbing the full ApiClient.
+ */
+/**
+ * Walk every cursor page from `fetchPage` and return the concatenated items.
+ *
+ * Detects two failure modes that would otherwise hang the CLI:
+ *   - A cursor that repeats (server returned the same `nextCursor` twice).
+ *   - A cursor chain longer than `maxPages` (default 1000).
+ * Both throw so the caller fails loudly rather than looping forever.
+ */
+export async function paginateAll(fetchPage, options = {}) {
+    const maxPages = options.maxPages ?? 1000;
+    const all = [];
+    const seenCursors = new Set();
+    let cursor;
+    for (let page = 0; page < maxPages; page++) {
+        const resp = await fetchPage(cursor);
+        if (Array.isArray(resp.items)) {
+            all.push(...resp.items);
+        }
+        const next = resp.nextCursor ?? undefined;
+        if (!next) {
+            return all;
+        }
+        if (seenCursors.has(next)) {
+            throw new Error(`Pagination cursor did not advance (cursor ${next} repeated); aborting to avoid an infinite loop.`);
+        }
+        seenCursors.add(next);
+        cursor = next;
+    }
+    throw new Error(`Pagination exceeded ${maxPages} pages without terminating; server cursor may not be advancing.`);
+}
+//# sourceMappingURL=paginate.js.map

package/dist/src/lib/paginate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginate.js","sourceRoot":"","sources":["../../../src/lib/paginate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkBH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAyB,EACzB,UAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,MAA0B,CAAC;IAE/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,iDAAiD,CACnG,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,uBAAuB,QAAQ,iEAAiE,CACjG,CAAC;AACJ,CAAC"}