primitive-admin 1.0.61 → 1.0.63

package/dist/src/lib/init-adopt.js

@@ -0,0 +1,34 @@
+/**
+ * Reading the app identity out of the project a run is adopting (#2890).
+ *
+ * `getCurrentEnvironment()` resolves from the process's working directory,
+ * which is not necessarily inside the project being adopted — `primitive init
+ * ../ios` resolves against the TARGET, not the cwd. This resolves the same
+ * precedence order (`--env` -> `PRIMITIVE_ENV` -> this machine's selection ->
+ * the committed default -> the sole environment) against an explicit root.
+ */
+import { join } from "path";
+import { readLocalSelection, selectEnvironmentName } from "./env-resolver-core.js";
+import { PROJECT_CONFIG_DIR, PROJECT_CONFIG_FILENAME, loadProjectConfigFromPath, } from "./project-config.js";
+/**
+ * Resolves the environment `init` adopts from the project rooted at `root`.
+ * Throws whatever the loader or the selector throws — a broken or ambiguous
+ * project config must stop the run, not be guessed around.
+ */
+export function resolveAdoptedEnvironment(root, options = {}) {
+    const projectConfigPath = join(root, PROJECT_CONFIG_DIR, PROJECT_CONFIG_FILENAME);
+    const projectConfig = loadProjectConfigFromPath(projectConfigPath);
+    const { name } = selectEnvironmentName(projectConfig, {
+        explicitEnvName: options.explicitEnvName ?? null,
+        envVarName: options.envVarName ?? null,
+        localSelection: readLocalSelection(projectConfigPath),
+        configPath: projectConfigPath,
+    });
+    return {
+        name,
+        config: projectConfig.environments[name],
+        projectConfig,
+        projectConfigPath,
+    };
+}
+//# sourceMappingURL=init-adopt.js.map

package/dist/src/lib/init-adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-adopt.js","sourceRoot":"","sources":["../../../src/lib/init-adopt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,GAG1B,MAAM,qBAAqB,CAAC;AAS7B;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,UAA2E,EAAE;IAE7E,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,aAAoB,EAAE;QAC3D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QAChD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,cAAc,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;QACrD,UAAU,EAAE,iBAAiB;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC;QACxC,aAAa;QACb,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/src/lib/init-assets.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The files `primitive init` writes at the ROOT of a repository that holds
+ * several clients of one Primitive app (#2890).
+ *
+ * These are app-wide, not client-wide: each client's own `AGENTS.md`,
+ * `package.json`, runtime config and dependencies ship with its template. What
+ * belongs here is only what the clients share — which is exactly the part a
+ * team otherwise has to reverse-engineer.
+ */
+import type { Platform } from "./resolve-platform.js";
+/** Human label for a platform, used in generated prose and summaries. */
+export declare function platformLabel(platform: Platform): string;
+/**
+ * The header prepended to the canonical `models/models.toml`.
+ *
+ * The schema is not client state: its TOML keys are the wire field names, so a
+ * second copy that drifts orphans the first one's records. Saying so in the
+ * file is the cheapest place for a reader to find that rule.
+ */
+export declare const CANONICAL_SCHEMA_HEADER = "# The model schema for this app \u2014 ONE copy, shared by every client.\n#\n# The TOML keys here are the wire field names, so a second copy that drifts\n# orphans the other one's records. Every client reads THIS file:\n#   - the web client's codegen input points at it, and its generated barrel\n#     imports it directly\n#   - the Swift client names it in `bao-codegen.json` beside its sources\n# Add or change a model here, then re-run each client's codegen.\n";
+/**
+ * A starter schema for the rare composition that has no template starter to
+ * adopt. The scaffolded clients normally supply their own, which is what a
+ * composed repo promotes to the root.
+ */
+export declare const FALLBACK_STARTER_SCHEMA = "[models.user_prefs.fields.id]\ntype = \"id\"\nauto_assign = true\nindexed = true\nrequired = true\n\n[models.user_prefs.fields.key]\ntype = \"string\"\nindexed = true\nunique = true\n\n[models.user_prefs.fields.value]\ntype = \"string\"\n";
+/**
+ * The app-wide `AGENTS.md` for a repository with several clients.
+ *
+ * Written only when there is no `AGENTS.md` at the root already — a client's
+ * own file is never replaced by init.
+ */
+export declare function rootAgentsMarkdown(input: {
+    appName: string;
+    clients: Array<{
+        platform: Platform;
+        dir: string;
+    }>;
+}): string;

package/dist/src/lib/init-assets.js

@@ -0,0 +1,97 @@
+/** Human label for a platform, used in generated prose and summaries. */
+export function platformLabel(platform) {
+    return platform === "ios" ? "iOS (SwiftUI)" : "Web (Vue)";
+}
+/**
+ * The header prepended to the canonical `models/models.toml`.
+ *
+ * The schema is not client state: its TOML keys are the wire field names, so a
+ * second copy that drifts orphans the first one's records. Saying so in the
+ * file is the cheapest place for a reader to find that rule.
+ */
+export const CANONICAL_SCHEMA_HEADER = `# The model schema for this app — ONE copy, shared by every client.
+#
+# The TOML keys here are the wire field names, so a second copy that drifts
+# orphans the other one's records. Every client reads THIS file:
+#   - the web client's codegen input points at it, and its generated barrel
+#     imports it directly
+#   - the Swift client names it in \`bao-codegen.json\` beside its sources
+# Add or change a model here, then re-run each client's codegen.
+`;
+/**
+ * A starter schema for the rare composition that has no template starter to
+ * adopt. The scaffolded clients normally supply their own, which is what a
+ * composed repo promotes to the root.
+ */
+export const FALLBACK_STARTER_SCHEMA = `[models.user_prefs.fields.id]
+type = "id"
+auto_assign = true
+indexed = true
+required = true
+
+[models.user_prefs.fields.key]
+type = "string"
+indexed = true
+unique = true
+
+[models.user_prefs.fields.value]
+type = "string"
+`;
+/**
+ * The app-wide `AGENTS.md` for a repository with several clients.
+ *
+ * Written only when there is no `AGENTS.md` at the root already — a client's
+ * own file is never replaced by init.
+ */
+export function rootAgentsMarkdown(input) {
+    const rows = input.clients
+        .map((client) => `- \`${client.dir}/\` — ${platformLabel(client.platform)} client`)
+        .join("\n");
+    return `# ${input.appName}
+
+One Primitive app, several clients. The app is the shared thing: one app ID,
+one set of environments, one exported server config, one model schema. Each
+client is an independent project in its own directory — there is no workspace
+file and no root \`package.json\`.
+
+## Layout
+
+- \`.primitive/config.json\` — the Primitive environments (backend URL + app ID
+  per environment). The single source of truth, for every client.
+- \`.primitive/sync/<env>/<appId>/\` — the exported server config (workflows,
+  database type configs, app settings) that \`primitive config diff\` and
+  \`primitive config push\` read and write.
+- \`models/models.toml\` — the model schema. ONE copy: its keys are the wire
+  field names, so a second copy that drifts orphans the other's records. Each
+  client's codegen reads this file in place; never copy it into a client.
+${rows}
+
+## Per app vs per client
+
+| Per app (here, at the root) | Per client (in its directory) |
+| --- | --- |
+| Environments and app ID | Generated code |
+| Exported server config | Dependencies and build config |
+| Model schema | Runtime connection settings |
+| Secrets | Deploy configuration |
+| — | Its own \`AGENTS.md\` |
+
+## Running commands
+
+Every \`primitive\` command walks up to this directory's \`.primitive/config.json\`,
+so it resolves the same app from any client directory and needs no path flag.
+\`primitive env use <name>\` selects the environment every command in this
+repository targets — it is an app-wide selection, not a per-client one.
+
+## Adding another client
+
+\`\`\`sh
+primitive init <dir> --platform <web|ios>
+\`\`\`
+
+Run from inside this repository, that adds a client to THIS app: it reuses this
+config, wires the new client to \`models/models.toml\`, and creates no second
+\`.primitive/\` and no second git repository.
+`;
+}
+//# sourceMappingURL=init-assets.js.map

package/dist/src/lib/init-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-assets.js","sourceRoot":"","sources":["../../../src/lib/init-assets.ts"],"names":[],"mappings":"AAWA,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,QAAkB;IAC9C,OAAO,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;CAQtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;CAatC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,SAAS,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;SAClF,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,KAAK,KAAK,CAAC,OAAO;;;;;;;;;;;;;;;;;EAiBzB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BL,CAAC;AACF,CAAC"}

package/dist/src/lib/init-client-platforms.d.ts

@@ -0,0 +1,14 @@
+import type { Platform } from "./resolve-platform.js";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export declare function detectClientPlatform(dir: string): Platform | null;
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export declare function discoverClientPlatforms(projectRoot: string): Platform[];
+/** Whether the app ends up with an iOS client AND a web client. */
+export declare function appHasBothPlatforms(planned: Platform[], discovered: Platform[]): boolean;

package/dist/src/lib/init-client-platforms.js

@@ -0,0 +1,71 @@
+/**
+ * Which client platforms an app HAS — the ones this run scaffolds plus the
+ * ones already in the repository (#2982).
+ *
+ * An app with both an iOS and a web client gets the universal-link wiring: the
+ * emailed sign-in link becomes the web deployment's https callback, which
+ * opens the installed app and still signs in from any browser. So "does this
+ * app have both?" decides whether init seeds a `webUrl` and prints the
+ * activation checklist.
+ *
+ * The existing clients are found by the signals the templates ship — a Swift
+ * package or Xcode project, a Vite project — so a `functions/` directory with
+ * a `package.json` is not mistaken for a client. They are looked for in child
+ * directories AND at the project root: `primitive init` still produces the
+ * flat single-client layout where the client IS the repository root, and
+ * adding the second platform to such a repository is exactly the case this
+ * feature exists for (DSO-2982-013).
+ */
+import { existsSync, readdirSync } from "fs";
+import { join } from "path";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export function detectClientPlatform(dir) {
+    let hasXcodeProject = false;
+    try {
+        hasXcodeProject = readdirSync(dir).some((name) => name.endsWith(".xcodeproj"));
+    }
+    catch {
+        return null;
+    }
+    if (existsSync(join(dir, "Package.swift")) || hasXcodeProject)
+        return "ios";
+    if (existsSync(join(dir, "package.json")) && existsSync(join(dir, "vite.config.ts"))) {
+        return "web";
+    }
+    return null;
+}
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export function discoverClientPlatforms(projectRoot) {
+    const found = new Set();
+    const atRoot = detectClientPlatform(projectRoot);
+    if (atRoot)
+        found.add(atRoot);
+    let entries;
+    try {
+        entries = readdirSync(projectRoot, { withFileTypes: true });
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name.startsWith("."))
+            continue;
+        const platform = detectClientPlatform(join(projectRoot, entry.name));
+        if (platform)
+            found.add(platform);
+    }
+    return ["web", "ios"].filter((platform) => found.has(platform));
+}
+/** Whether the app ends up with an iOS client AND a web client. */
+export function appHasBothPlatforms(planned, discovered) {
+    const platforms = new Set([...planned, ...discovered]);
+    return platforms.has("ios") && platforms.has("web");
+}
+//# sourceMappingURL=init-client-platforms.js.map

package/dist/src/lib/init-client-platforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-client-platforms.js","sourceRoot":"","sources":["../../../src/lib/init-client-platforms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAY,CAAC;IAElC,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAQ,CAAC,KAAK,EAAE,KAAK,CAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,OAAmB,EACnB,UAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAW,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/src/lib/init-config.d.ts

@@ -1,7 +1,15 @@
 export declare const INIT_CONFIG_FILENAME = ".primitive-init.toml";
 export interface InitConfig {
-    /** Whether to create a new app or use an existing one */
-    action: "create" | "use-existing";
+    /**
+     * What this run does with the app:
+     *   - `create`       — make a new app (needs `app_name`)
+     *   - `use-existing` — scaffold against an app that already exists (needs `app_id`)
+     *   - `add-client`   — add another client to the Primitive app the surrounding
+     *     project already targets (#2890). The app comes from the selected
+     *     environment of the nearest ancestor `.primitive/config.json`, so this
+     *     action names no app of its own.
+     */
+    action: "create" | "use-existing" | "add-client";
     /** App name (required for action = "create") */
     app_name?: string;
     /** Existing app ID (required for action = "use-existing") */
@@ -14,7 +22,11 @@ export interface InitConfig {
     dev_port?: number;
     /** Whether to skip npm install */
     skip_install?: boolean;
-    /** Custom server URL */
+    /**
+     * Custom server URL. Behaves like the `-s/--server` flag: the app is created
+     * on this server and the scaffolded project config records it. The flag wins
+     * when both are given. (#2376)
+     */
     server?: string;
     /** Email addresses to invite (for invite-only mode) */
     invite_emails?: string[];
@@ -22,8 +34,17 @@ export interface InitConfig {
     allowed_domains?: string[];
     /** Whether to overwrite a non-empty target directory (default: false) */
     overwrite?: boolean;
-    /** Target platform for the scaffolded app */
-    platform?: "web" | "ios";
+    /**
+     * Target platform(s) for the scaffolded client(s): `"web"`, `"ios"`, a
+     * comma-separated string, or a TOML array (`platform = ["web", "ios"]`).
+     */
+    platform?: string | string[];
+    /**
+     * Non-interactive consent to move an existing single-client repo's model
+     * schema to `<project root>/models/models.toml` so both clients read one copy
+     * (#2890). Valid only with `action = "add-client"`.
+     */
+    promote_schema?: boolean;
 }
 export interface ValidationResult {
     valid: boolean;
@@ -42,6 +63,24 @@ export interface ValidationResult {
  * should create a new app).
  */
 export declare function resolveUseExistingAppId(flag: string | undefined, initConfig: InitConfig | null): string | undefined;
+/** Where the resolved "skip dependency install" decision came from. */
+export type SkipInstallSource = "flag" | "config" | "default";
+export interface ResolvedSkipInstall {
+    skipInstall: boolean;
+    source: SkipInstallSource;
+}
+/**
+ * Resolves whether `primitive init` skips the dependency install, from the two
+ * places it can be requested: the `--skip-install` flag (highest precedence)
+ * or `skip_install = true` in the init-config TOML.
+ *
+ * `init` used to read only the flag, so a config's `skip_install` was silently
+ * ignored and CI runs installed anyway (#2720). Precedence matches #2376's
+ * `server` fix: the flag wins. Because `--skip-install` is a boolean flag it
+ * can only ever request a skip, so an explicit `skip_install = false` in the
+ * config cannot un-skip a run that passed the flag.
+ */
+export declare function resolveSkipInstall(flag: boolean | undefined, initConfig: InitConfig | null): ResolvedSkipInstall;
 /**
  * Parses a TOML string into an InitConfig object.
  * Throws if the string contains invalid TOML.

package/dist/src/lib/init-config.js

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
 import { parseConfigToml } from "./config-toml.js";
+import { PROJECT_CONFIG_DISPLAY_NAME } from "./project-config.js";
+import { parsePlatformList } from "./resolve-platform.js";
+import { validateServerUrl } from "./server-url.js";
 export const INIT_CONFIG_FILENAME = ".primitive-init.toml";
 /**
  * Resolves the "use an existing app" app id from the two places it can be
@@ -21,6 +24,27 @@ export function resolveUseExistingAppId(flag, initConfig) {
         return initConfig.app_id;
     return undefined;
 }
+/**
+ * Resolves whether `primitive init` skips the dependency install, from the two
+ * places it can be requested: the `--skip-install` flag (highest precedence)
+ * or `skip_install = true` in the init-config TOML.
+ *
+ * `init` used to read only the flag, so a config's `skip_install` was silently
+ * ignored and CI runs installed anyway (#2720). Precedence matches #2376's
+ * `server` fix: the flag wins. Because `--skip-install` is a boolean flag it
+ * can only ever request a skip, so an explicit `skip_install = false` in the
+ * config cannot un-skip a run that passed the flag.
+ */
+export function resolveSkipInstall(flag, initConfig) {
+    if (flag)
+        return { skipInstall: true, source: "flag" };
+    // Strict `=== true`: a non-boolean that slipped past validation must not
+    // skip the install by truthiness (`skip_install = "false"` reads as a skip).
+    if (initConfig?.skip_install === true) {
+        return { skipInstall: true, source: "config" };
+    }
+    return { skipInstall: false, source: "default" };
+}
 /**
  * Parses a TOML string into an InitConfig object.
  * Throws if the string contains invalid TOML.
@@ -49,11 +73,12 @@ export function loadInitConfig(dir) {
 export function validateInitConfig(config) {
     const errors = [];
     // action is required
+    const ACTIONS = ["create", "use-existing", "add-client"];
     if (!config.action) {
-        errors.push('Missing required field: "action" (must be "create" or "use-existing")');
+        errors.push(`Missing required field: "action" (must be ${ACTIONS.map((a) => `"${a}"`).join(", ")})`);
     }
-    else if (config.action !== "create" && config.action !== "use-existing") {
-        errors.push('"action" must be "create" or "use-existing"');
+    else if (!ACTIONS.includes(config.action)) {
+        errors.push(`"action" must be ${ACTIONS.map((a) => `"${a}"`).join(", ")}`);
     }
     else {
         // Validate action-specific required fields
@@ -63,6 +88,24 @@ export function validateInitConfig(config) {
         if (config.action === "use-existing" && !config.app_id) {
             errors.push('"app_id" is required when action is "use-existing"');
         }
+        // `add-client` takes its app — and therefore its access mode and its
+        // invitations — from the environment it adopts. Naming any of them here
+        // would describe a second app this run is not allowed to touch.
+        if (config.action === "add-client") {
+            for (const key of [
+                "app_name",
+                "app_id",
+                "access_mode",
+                "invite_emails",
+                "allowed_domains",
+            ]) {
+                const value = config[key];
+                const present = Array.isArray(value) ? value.length > 0 : value !== undefined;
+                if (present) {
+                    errors.push(`"${key}" is not allowed with action = "add-client": the app comes from the selected environment of the existing ${PROJECT_CONFIG_DISPLAY_NAME}.`);
+                }
+            }
+        }
     }
     // Validate access_mode if provided
     if (config.access_mode) {
@@ -74,12 +117,42 @@ export function validateInitConfig(config) {
             errors.push('"allowed_domains" is required when access_mode is "domain"');
         }
     }
-    // Validate platform if provided. Only "web" and "ios" are supported
-    // (`macos` is intentionally rejected until the macOS template is ready).
+    // Validate platform if provided. A string or an array of strings; only "web"
+    // and "ios" are supported (`macos` is intentionally rejected until the macOS
+    // template is ready), and each may be named once (#2890).
     if (config.platform !== undefined) {
-        if (config.platform !== "web" && config.platform !== "ios") {
-            errors.push('"platform" must be "web" or "ios"');
+        if (typeof config.platform !== "string" && !Array.isArray(config.platform)) {
+            errors.push('"platform" must be a string or an array of strings');
         }
+        else {
+            const parsed = parsePlatformList(config.platform);
+            if (!parsed.ok)
+                errors.push(`"platform": ${parsed.error}`);
+        }
+    }
+    // `promote_schema` is consent for a move that only the add-client path can
+    // make; anywhere else it would silently do nothing.
+    if (config.promote_schema !== undefined) {
+        if (typeof config.promote_schema !== "boolean") {
+            errors.push('"promote_schema" must be a boolean (true or false)');
+        }
+        else if (config.action !== "add-client") {
+            errors.push('"promote_schema" is only valid with action = "add-client"');
+        }
+    }
+    // Validate server if provided. An unusable value must fail here rather than
+    // fall through to the current server, which is how #2376 went unnoticed.
+    if (config.server !== undefined) {
+        const serverValidation = validateServerUrl(config.server);
+        if (serverValidation !== true) {
+            errors.push(`"server" must be a valid URL (e.g., https://primitiveapi.com): ${serverValidation}`);
+        }
+    }
+    // Validate skip_install if provided. The TOML is cast to InitConfig without
+    // runtime narrowing, so a non-boolean has to be rejected here rather than
+    // reach the resolver, where anything truthy would skip the install.
+    if (config.skip_install !== undefined && typeof config.skip_install !== "boolean") {
+        errors.push('"skip_install" must be a boolean (true or false)');
     }
     // Validate dev_port if provided
     if (config.dev_port !== undefined) {

package/dist/src/lib/init-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-config.js","sourceRoot":"","sources":["../../../src/lib/init-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAkC3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAwB,EACxB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,UAAU,EAAE,MAAM,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,+EAA+E;IAC/E,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;YAChI,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mEAAmE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"init-config.js","sourceRoot":"","sources":["../../../src/lib/init-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAuD3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAwB,EACxB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,UAAU,EAAE,MAAM,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAyB,EACzB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,UAAU,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,+EAA+E;IAC/E,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,qBAAqB;IACrB,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,6CAA6C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC;IACJ,CAAC;SAAM,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI;gBAChB,UAAU;gBACV,QAAQ;gBACR,aAAa;gBACb,eAAe;gBACf,iBAAiB;aACT,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;gBAC9E,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CACT,IAAI,GAAG,4GAA4G,2BAA2B,GAAG,CAClJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CACT,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,kEAAkE,gBAAgB,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAClE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;YAChI,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mEAAmE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/src/lib/init-email-redirect-uris.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+export type EmailRedirectUriMerge = {
+    action: "already-listed";
+} | {
+    action: "merge";
+    uris: string[];
+} | {
+    action: "leave-alone";
+    reason: string;
+};
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export declare function planEmailRedirectUriMerge(existing: unknown, callbackUri: string): EmailRedirectUriMerge;

package/dist/src/lib/init-email-redirect-uris.js

@@ -0,0 +1,46 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export function planEmailRedirectUriMerge(existing, callbackUri) {
+    if (!Array.isArray(existing)) {
+        return {
+            action: "leave-alone",
+            reason: "this app has no emailRedirectUris list of its own, and writing one would replace the allow-list it behaves by today",
+        };
+    }
+    const uris = existing.filter((value) => typeof value === "string");
+    if (uris.length === 0) {
+        return {
+            action: "leave-alone",
+            reason: "this app's emailRedirectUris list is empty, which is a deliberate 'reject every link target'",
+        };
+    }
+    if (uris.includes(callbackUri))
+        return { action: "already-listed" };
+    return { action: "merge", uris: [...uris, callbackUri] };
+}
+//# sourceMappingURL=init-email-redirect-uris.js.map

package/dist/src/lib/init-email-redirect-uris.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-email-redirect-uris.js","sourceRoot":"","sources":["../../../src/lib/init-email-redirect-uris.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC"}