primitive-admin 1.0.59 → 1.0.61

package/dist/src/commands/sessions.js

@@ -0,0 +1,63 @@
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId } from "../lib/config.js";
+import { error, info, formatTable, formatDate, json, } from "../lib/output.js";
+export function registerSessionsCommands(program) {
+    const sessions = program
+        .command("sessions")
+        .description("Inspect a user's authentication sessions")
+        .addHelpText("after", `
+A session is one sign-in for a user. The ACTIVE column shows whether it has
+expired — an expired session that has not yet been swept still appears, with
+ACTIVE = false. Authentication tokens are never returned.
+
+Examples:
+  $ primitive sessions list --user 01HXY...
+  $ primitive sessions list --user 01HXY... --limit 50
+  $ primitive sessions list --user 01HXY... --json
+`);
+    sessions
+        .command("list")
+        .description("List a user's sessions")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .requiredOption("--user <user-id>", "List sessions for this user")
+        .option("--limit <n>", "Maximum rows to return (default 25, max 100)")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page")
+        .option("--json", "Output as JSON")
+        .action(async (options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        const limit = options.limit ? Number(options.limit) : undefined;
+        if (options.limit !== undefined &&
+            (!Number.isInteger(limit) || limit <= 0)) {
+            error("--limit must be a positive integer.");
+            process.exit(1);
+        }
+        try {
+            const { items, nextCursor } = await client.listSessions(resolvedAppId, options.user, { limit, cursor: options.cursor });
+            if (options.json) {
+                json({ items, nextCursor });
+                return;
+            }
+            if (!items || items.length === 0) {
+                info("No sessions found.");
+                return;
+            }
+            console.log(formatTable(items, [
+                { header: "SESSION", key: "sessionId" },
+                { header: "USER", key: "userId" },
+                { header: "ACTIVE", key: "active" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+                { header: "LAST ACTIVITY", key: "lastActivity", format: formatDate },
+                { header: "EXPIRES", key: "expiresAt", format: formatDate },
+            ]));
+            if (nextCursor) {
+                info(`More results available. Re-run with --cursor ${nextCursor}`);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=sessions.js.map

package/dist/src/commands/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../../src/commands/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,KAAK,EACL,IAAI,EACJ,WAAW,EACX,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,0CAA0C,CAAC;SACvD,WAAW,CACV,OAAO,EACP;;;;;;;;;CASL,CACI,CAAC;IAEJ,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC;SACjE,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IACE,OAAO,CAAC,KAAK,KAAK,SAAS;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,EACpD,CAAC;YACD,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CACrD,aAAa,EACb,OAAO,CAAC,IAAI,EACZ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAClC,CAAC;YAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,KAA8B,EAAE;gBAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACjC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;gBAC3D,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE;gBACpE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/skill.js

@@ -6,8 +6,8 @@ export function registerSkillCommands(program) {
     skill
         .command("install")
         .description("Install or update the Primitive platform skill for Claude Code")
-        .action(() => {
-        if (!installSkillExplicit()) {
+        .action(async () => {
+        if (!(await installSkillExplicit())) {
             process.exitCode = 1;
         }
     });

package/dist/src/commands/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/commands/skill.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9F,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qDAAqD,CAAC,CAAC;IAEtE,KAAK;SACF,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,GAAG,EAAE;QACX,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/commands/skill.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9F,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qDAAqD,CAAC,CAAC;IAEtE,KAAK;SACF,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,GAAG,EAAE;QACX,WAAW,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sync.js

@@ -105,6 +105,15 @@ function canonicalJsonStringify(value) {
     if (Array.isArray(value)) {
         return "[" + value.map((v) => canonicalJsonStringify(v)).join(",") + "]";
     }
+    // Honor `toJSON` before the key walk. A `Date` — or smol-toml's `TomlDate`,
+    // what a TOML datetime literal parses to — has no enumerable own keys, so
+    // the `Object.keys()` walk below would collapse it to "{}" and every
+    // datetime would hash identically (issue #1919). Both implement `toJSON`,
+    // returning the ISO string; recursing on it makes date-like values (nested
+    // ones too) participate in the hash. Matches JSON.stringify's own semantics.
+    if (typeof value.toJSON === "function") {
+        return canonicalJsonStringify(value.toJSON());
+    }
     const keys = Object.keys(value).sort();
     return ("{" +
         keys
@@ -913,6 +922,16 @@ export function serializeWorkflow(workflow, draft, configs, logger) {
             // as a data-loss fallback (issue #1446).
             inputSchema: serializeWorkflowSchemaField(workflow.inputSchema, "inputSchema", workflow.workflowKey, log),
             outputSchema: serializeWorkflowSchemaField(workflow.outputSchema, "outputSchema", workflow.workflowKey, log),
+            // #1972 — declarative run-scoped lock (`[workflow.lock]`, #1518 Phase 3).
+            // The GET response returns `lock` parsed (an object, null when unset —
+            // like `metadataManifest`). Emit the nested `[workflow.lock]` table only
+            // when present so a fresh pull → push round-trips it and an unset lock
+            // doesn't write a noisy empty table (nor a false `sync diff`). Before this
+            // pull dropped the lock entirely, so a pull → push cycle silently cleared
+            // a server-side lock.
+            lock: workflow.lock && typeof workflow.lock === "object"
+                ? workflow.lock
+                : undefined,
         },
         // Use active config steps, fall back to draft
         steps,
@@ -3024,7 +3043,8 @@ Directory Structure:
             // (no more `process.exit` bypass class). The per-loop validators below
             // remain as defense-in-depth but are converted to throws too.
             const preflightValidationErrors = [];
-            // Validate all workflow TOMLs (issue #685 misnested-header check).
+            // Validate all workflow TOMLs (#685 misnested-header check and the
+            // #1447 system + accessRule lint).
             const preflightWorkflowsDir = join(configDir, "workflows");
             if (existsSync(preflightWorkflowsDir)) {
                 for (const file of readdirSync(preflightWorkflowsDir).filter((f) => f.endsWith(".toml"))) {
@@ -4445,10 +4465,12 @@ Directory Structure:
                         info(`  Skipped workflows/${file} — platform-owned workflow "${platformOwnedKey}" (managed by the platform)`);
                         continue;
                     }
-                    // Issue #685: reject misnested headers (e.g.
-                    // [steps.<id>.request]) before pushing. The runtime silently
-                    // ignores fields outside the allowlist, so this is the only
-                    // place to catch the footgun. Validation happens BEFORE the
+                    // Reject misnested headers (#685, e.g. [steps.<id>.request]) and
+                    // the #1447 runAs="system" + accessRule dead-config combo before
+                    // pushing. The runtime silently ignores fields outside the
+                    // allowlist, so this is the only place to catch the footgun, and
+                    // the server rejects a system accessRule (#1258) — flagging it
+                    // here keeps the push all-or-nothing. Validation happens BEFORE the
                     // skip-if-unchanged check so a previously-pushed-but-broken
                     // file gets a clear diagnostic on every push attempt.
                     // Issue #976: validation is now front-loaded before any apply
@@ -4936,6 +4958,28 @@ Directory Structure:
                     const validateExpectedModifiedAt = options.force
                         ? undefined
                         : existingEntry?.modifiedAt;
+                    // Issue #1336 (codex round-1 P1): the final post-push rule content
+                    // of every op this push lands. When the push ALSO changes the
+                    // manifest, the server re-lints child ops against the new manifest;
+                    // forwarding each op's proposed `access`/`params` lets that re-lint
+                    // evaluate the op's post-push form instead of the stale stored row,
+                    // so an atomic manifest-rename + op-rewrite push is not falsely
+                    // rejected. A field is sent as value-or-null (config-as-code: the
+                    // TOML op IS the final state).
+                    const pendingOpUpdates = operations.map((op) => ({
+                        name: op.name,
+                        access: typeof op.access === "string" ? op.access : null,
+                        params: op.params ?? null,
+                    }));
+                    // Issue #1336 (codex round-1 P1/P2): the declared-access manifest
+                    // this push proposes (the parsed object, or null when the type
+                    // declares none / is clearing it). Forwarded as
+                    // `metadataManifestOverride` on the op dry-runs so op-access lints
+                    // run against the manifest the same push is landing, not the stale
+                    // stored one (existing type: a newly-declared key is honored; fresh
+                    // type: an undeclared ref is caught instead of skipped).
+                    const proposedManifest = typeConfig.metadataManifest ??
+                        null;
                     try {
                         // 1. Schema-edit gate (type-config PATCH dry-run) — only when the
                         //    type already exists on the server and we'd actually PATCH a
@@ -4948,13 +4992,53 @@ Directory Structure:
                         //    type-config dry-run at all.
                         if (existingEntry && typeLevelChange) {
                             const validateUpdateData = computeTypeUpdateData();
-                            {
-                                await client.updateDatabaseTypeConfig(resolvedAppId, dbType, pendingOpDeletes.length > 0
-                                    ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
-                                    : validateUpdateData, validateExpectedModifiedAt, {
-                                    dryRun: true,
-                                    acceptWarnings: !!options.acceptWarnings,
-                                });
+                            const baseValidate = pendingOpDeletes.length > 0
+                                ? { ...validateUpdateData, pendingOpDeletes, finalOpNames }
+                                : validateUpdateData;
+                            await client.updateDatabaseTypeConfig(resolvedAppId, dbType, 
+                            // Issue #1336 (P1): forward the pending op rewrites so the
+                            // server's child-op re-lint uses each op's post-push content.
+                            { ...baseValidate, pendingOpUpdates }, validateExpectedModifiedAt, {
+                                dryRun: true,
+                                acceptWarnings: !!options.acceptWarnings,
+                            });
+                        }
+                        else if (!existingEntry) {
+                            // Fresh type: run the config CREATE dry-run (issue #1336, codex
+                            // round-1 P2). Before this, a brand-new type's inline config
+                            // rules (`defaultAccess`, `metadataAccess`, autoPopulatedFields,
+                            // triggers) and its manifest were never dry-run — a malformed
+                            // rule reported a clean `sync push --dry-run` then failed only on
+                            // the real POST. Mirror the apply-path create payload below.
+                            const createDryRunData = { databaseType: dbType };
+                            if (typeConfig.ruleSetId)
+                                createDryRunData.ruleSetId = typeConfig.ruleSetId;
+                            if (typeConfig.triggers)
+                                createDryRunData.triggers = typeConfig.triggers;
+                            if (typeConfig.metadataAccess)
+                                createDryRunData.metadataAccess = typeConfig.metadataAccess;
+                            if (typeConfig.defaultAccess)
+                                createDryRunData.defaultAccess = typeConfig.defaultAccess;
+                            if (typeConfig.autoPopulatedFields)
+                                createDryRunData.autoPopulatedFields =
+                                    typeConfig.autoPopulatedFields;
+                            if (typeConfig.timestamps)
+                                createDryRunData.timestamps = typeConfig.timestamps;
+                            if (typeConfig.schema)
+                                createDryRunData.schema = typeConfig.schema;
+                            if (typeConfig.metadataManifest)
+                                createDryRunData.metadataManifest = typeConfig.metadataManifest;
+                            try {
+                                await client.createDatabaseTypeConfig(resolvedAppId, createDryRunData, { dryRun: true });
+                            }
+                            catch (createErr) {
+                                // A 409 means the type already exists server-side (local sync
+                                // state was lost); the fresh-type inline-rule validation does
+                                // not apply and the real push reconciles separately. Any other
+                                // error is a genuine create-time validation failure — re-throw
+                                // so the catch below reports it.
+                                if (createErr?.statusCode !== 409)
+                                    throw createErr;
                             }
                         }
                         // 2. Op-edit gate (op create/update dry-run) for every op in the
@@ -5012,7 +5096,14 @@ Directory Structure:
                                         access: op.access,
                                         definition: op.definition,
                                         params: op.params,
-                                    }, options.force ? undefined : existingOp.modifiedAt, { dryRun: true, schemaOverride: proposedSchema });
+                                    }, options.force ? undefined : existingOp.modifiedAt, {
+                                        dryRun: true,
+                                        schemaOverride: proposedSchema,
+                                        // Issue #1336 (P1/P2): gate the op-access lint against
+                                        // the manifest THIS push is landing, not the stale
+                                        // stored one.
+                                        metadataManifestOverride: proposedManifest,
+                                    });
                                 }
                                 else {
                                     await client.createDatabaseTypeOperation(resolvedAppId, dbType, {
@@ -5025,6 +5116,10 @@ Directory Structure:
                                     }, {
                                         dryRun: true,
                                         schemaOverride: proposedSchema,
+                                        // Issue #1336 (P1/P2): as above — a fresh-type op dry-run
+                                        // now lints against the proposed manifest instead of
+                                        // skipping the lint entirely.
+                                        metadataManifestOverride: proposedManifest,
                                         // Issue #915 (defect a, follow-up): for a fresh type the
                                         // server has no stored config to read `defaultAccess`
                                         // from, so an op that omits `access` to inherit the
@@ -5209,6 +5304,18 @@ Directory Structure:
                                     // exclusion (see derivation above).
                                     updateData.finalOpNames = finalOpNames;
                                 }
+                                // Issue #1336 (codex round-2 P1): forward the pending op
+                                // rewrites on the REAL mutating PATCH too, mirroring the
+                                // dry-run validate pass above. Without this, when the same
+                                // push replaces a manifest key AND rewrites an op that
+                                // references the old key, the server's child-op re-lint runs
+                                // against the stale stored op → INVALID_RULE → the config
+                                // PATCH aborts before the op PATCH lands. Sending the final
+                                // op forms lets the re-lint evaluate each op's post-push
+                                // content, so the atomic manifest-rename + op-rewrite push
+                                // converges. Sent unconditionally (as the dry-run does); a
+                                // field absent from a claim means "not changed" server-side.
+                                updateData.pendingOpUpdates = pendingOpUpdates;
                                 if (typeLevelChange) {
                                     changes.push({ type: "database-type", action: "update", key: dbType });
                                     const updated = await client.updateDatabaseTypeConfig(resolvedAppId, dbType, updateData, expectedModifiedAt, {