primitive-admin 1.0.62 → 1.0.64

package/dist/src/lib/init-ios-links.js

@@ -109,6 +109,27 @@ export function stampCallbackScheme(clientDir, scheme) {
     writeFileSync(plistPath, text.slice(0, dictStart) + rewritten + text.slice(dictEnd));
     return { outcome: "stamped" };
 }
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * `--app-id` (#3152), and refuses a name the config already has. Every
+ * environment anyone reads this about already exists (init wrote `dev`; `prod`
+ * was added when the app was deployed), so the instruction for those has to be
+ * the file, which is also what the docs describe as the way to edit one. The
+ * flag is worth naming only where a new environment is being created — and
+ * there it is shown with the flags the command will refuse to run without.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export function setWebUrlInstruction(origin, indent = "  ") {
+    return [
+        `${indent}add "webUrl": "${origin}" to that environment in primitive/config.json`,
+        `${indent}(\`primitive env add <name> --api-url … --app-id … --web-url <origin>\` does this only for an`,
+        `${indent}environment it CREATES — it cannot edit one that already exists).`,
+    ];
+}
 /**
  * What init prints about email sign-in on the iOS path: it already works, and
  * this is the one opt-in that adds the link.
@@ -128,7 +149,11 @@ export function linkOptInGuidance(scheme, options = {}) {
     const redirectUri = iosMagicLinkRedirectUri(scheme);
     return [
         "Email sign-in works now: the email carries a 6-digit code and needs no app settings.",
-        `To ALSO send a sign-in link that opens this app, add "${redirectUri}" to the existing`,
+        "When this app gets a web client, prefer the https link: set the environment's `webUrl` —",
+        ...setWebUrlInstruction("https://<your-web-domain>"),
+        "  The email then carries that origin's /oauth/callback instead — one link that opens this",
+        "  app where it is installed and signs in through the browser anywhere else.",
+        `Until then, to ALSO send a sign-in link that opens this app, add "${redirectUri}" to the existing`,
         "  [auth].emailRedirectUris array in config/app.toml (merge it in — run",
         "  `primitive config pull --only app` first if that file is not there yet), then run",
         "  `primitive config push --only app` and set `authManager.sendsEmailSignInLink = true`.",
@@ -140,6 +165,47 @@ export function linkOptInGuidance(scheme, options = {}) {
         "  authentication.md docs page — 'Make the emailed sign-in link open your app'.",
     ];
 }
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export function universalLinkGuidance(options = {}) {
+    const lines = [
+        "This app has both an iOS and a web client, so its sign-in email carries ONE https link:",
+        "  the web app's /oauth/callback. Tapped where the iOS app is installed it opens the app;",
+        "  anywhere else it is an ordinary web sign-in. The 6-digit code still works everywhere.",
+    ];
+    if (options.webOrigin) {
+        lines.push(`In dev that link is ${options.webOrigin}/oauth/callback — seeded as the environment's`, "  `webUrl`, and allow-listed on the app. Nothing to do.");
+    }
+    else if (options.unverifiedDevCallback) {
+        const origin = options.unverifiedDevCallback.replace(/\/oauth\/callback$/, "");
+        lines.push("The link is NOT on yet in dev: this app already existed, and its sign-in link allow-list", `  does not (or could not be checked to) carry ${options.unverifiedDevCallback}. Nothing was`, "  changed — the email stays code-only, which works. To turn the link on:", `  1. Merge "${options.unverifiedDevCallback}" into the existing [auth].emailRedirectUris`, "     array in config/app.toml (run `primitive config pull --only app` first if that file is", "     not there yet), then `primitive config push --only app`.", `  2. Then ${setWebUrlInstruction(origin, "")[0]}`, "     — the same edit the production steps below describe.");
+    }
+    else {
+        lines.push("Set `webUrl` on this app's environment to turn it on (this run did not write the", "  project config):", ...setWebUrlInstruction("https://<your-web-domain>"), "  Allow-list that origin's /oauth/callback in [auth].emailRedirectUris too.");
+    }
+    lines.push("For production, once the web app is deployed:", "  1. Set that environment's `webUrl` to the deployed origin —", ...setWebUrlInstruction("https://<your-web-domain>", "     "), "  2. Merge \"https://<your-web-domain>/oauth/callback\" into the existing", "     [auth].emailRedirectUris array in config/app.toml (run `primitive config pull --only app`", "     first if that file is not there yet), then `primitive config push --only app`.", "  3. Add `\"iosAppId\": \"ABCDE12345.com.example.app\"` beside that same environment's `webUrl`", "     — the iOS client's Application Identifier Prefix (10 characters, usually your Team ID;", "     verify it against the signed app's application-identifier entitlement) and its bundle id", "     for THAT environment. `pnpm cf-deploy` generates the apple-app-site-association document", "     from it per deploy, so each environment serves its own app id and none serves another's.", "  4. Deploy, then verify: `curl -i https://<your-web-domain>/.well-known/apple-app-site-association`", "     must return 200, application/json and the JSON body — HTML means the SPA fallback answered.", "  5. Only then enable the `applinks:<your-web-domain>` entitlement in the iOS client's", "     project.yml (it needs a real DEVELOPMENT_TEAM) and reinstall the app.", "  Full checklist: the web client's public/.well-known/README.md, or the authentication", "  docs page — 'Make the emailed sign-in link open your app'.");
+    return lines;
+}
 /** What init says when the template predates the `PrimitiveAuth` URL type. */
 export function missingUrlTypeGuidance(scheme) {
     return [

package/dist/src/lib/init-ios-links.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-ios-links.js","sourceRoot":"","sources":["../../../src/lib/init-ios-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,SAAiB;IAClE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,KAAa,EACb,aAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,MAAM,GACV,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAChD,KAAK,CAAC;IACR,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,4BAA4B,WAAW,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAExD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEnF,MAAM,cAAc,GAClB,0EAA0E,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;IACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,sFAAsF;QACtF,yDAAyD,WAAW,mBAAmB;QACvF,wEAAwE;QACxE,qFAAqF;QACrF,yFAAyF;QACzF,UAAU;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,eAAe,MAAM,iEAAiE;kBACpF,QAAQ,4BAA4B,gDAAgD;QAC1F,kFAAkF;QAClF,gFAAgF;KACjF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO;QACL,mDAAmD,4BAA4B,mBAAmB;QAClG,aAAa,MAAM,qEAAqE;QACxF,wCAAwC,4BAA4B,gCAAgC;QACpG,mFAAmF;QACnF,gEAAgE;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"init-ios-links.js","sourceRoot":"","sources":["../../../src/lib/init-ios-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,SAAiB;IAClE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,KAAa,EACb,aAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,MAAM,GACV,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAChD,KAAK,CAAC;IACR,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,4BAA4B,WAAW,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAExD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEnF,MAAM,cAAc,GAClB,0EAA0E,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;IACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAM,GAAG,IAAI;IAChE,OAAO;QACL,GAAG,MAAM,kBAAkB,MAAM,gDAAgD;QACjF,GAAG,MAAM,+FAA+F;QACxG,GAAG,MAAM,mEAAmE;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,sFAAsF;QACtF,0FAA0F;QAC1F,GAAG,oBAAoB,CAAC,2BAA2B,CAAC;QACpD,2FAA2F;QAC3F,6EAA6E;QAC7E,qEAAqE,WAAW,mBAAmB;QACnG,wEAAwE;QACxE,qFAAqF;QACrF,yFAAyF;QACzF,UAAU;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,eAAe,MAAM,iEAAiE;kBACpF,QAAQ,4BAA4B,gDAAgD;QAC1F,kFAAkF;QAClF,gFAAgF;KACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkE,EAAE;IAEpE,MAAM,KAAK,GAAG;QACZ,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;KAC1F,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,uBAAuB,OAAO,CAAC,SAAS,+CAA+C,EACvF,yDAAyD,CAC1D,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CACR,0FAA0F,EAC1F,iDAAiD,OAAO,CAAC,qBAAqB,eAAe,EAC7F,0EAA0E,EAC1E,eAAe,OAAO,CAAC,qBAAqB,8CAA8C,EAC1F,6FAA6F,EAC7F,+DAA+D,EAC/D,aAAa,oBAAoB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,kFAAkF,EAClF,oBAAoB,EACpB,GAAG,oBAAoB,CAAC,2BAA2B,CAAC,EACpD,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,+CAA+C,EAC/C,+DAA+D,EAC/D,GAAG,oBAAoB,CAAC,2BAA2B,EAAE,OAAO,CAAC,EAC7D,2EAA2E,EAC3E,gGAAgG,EAChG,qFAAqF,EACrF,iGAAiG,EACjG,6FAA6F,EAC7F,+FAA+F,EAC/F,+FAA+F,EAC/F,+FAA+F,EAC/F,sGAAsG,EACtG,kGAAkG,EAClG,wFAAwF,EACxF,4EAA4E,EAC5E,wFAAwF,EACxF,8DAA8D,CAC/D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO;QACL,mDAAmD,4BAA4B,mBAAmB;QAClG,aAAa,MAAM,qEAAqE;QACxF,wCAAwC,4BAA4B,gCAAgC;QACpG,mFAAmF;QACnF,gEAAgE;KACjE,CAAC;AACJ,CAAC"}

package/dist/src/lib/init-plan.d.ts

@@ -12,7 +12,7 @@ export interface InitPlan {
     /** The directory holding the ONE `.primitive/` for this app. */
     projectRoot: string;
     /**
-     * Whether this run writes `.primitive/config.json` and seeds the
+     * Whether this run writes `primitive/config.json` and seeds the
      * environment's credential slot. False when adopting: the config is already
      * there and is not this run's to rewrite.
      */

package/dist/src/lib/init-plan.js

@@ -11,7 +11,7 @@
  *   multi-client — several clients, no surrounding project. Each client gets a
  *                  platform-named subdirectory; the project config, the git
  *                  repository and the canonical schema live at the root.
- *   add-client   — an ancestor `.primitive/config.json` already exists. The run
+ *   add-client   — an ancestor `primitive/config.json` already exists. The run
  *                  ADOPTS it: no nested project config, no nested git
  *                  repository, no app creation, no commit. This is the path the
  *                  issue opens with — running init in a subdirectory used to

package/dist/src/lib/init-xcode.d.ts

@@ -1,7 +1,8 @@
 /**
- * Retargets one `$(SRCROOT)`-relative build-phase path, in `project.yml` and in
- * every checked-in Xcode project. Both spell the path the same way, so one
- * literal substitution covers the declared inputs and outputs alike.
+ * Retargets one `$(SRCROOT)`-relative build-phase path, in `project.yml`, in
+ * every checked-in Xcode project, and in the committed codegen file lists. They
+ * all spell the path the same way, so one literal substitution covers the
+ * declared inputs and outputs alike.
  *
  * Returns the files it rewrote.
  */
@@ -17,11 +18,11 @@ export declare function retargetXcodePath(clientDir: string, fromRelative: strin
  */
 export declare function xcodePathsLeftBehind(clientDir: string, fromRelative: string, toRelative: string): string[];
 /**
- * Points the Xcode build phases at the app's `.primitive/config.json` when it
+ * Points the Xcode build phases at the app's `primitive/config.json` when it
  * lives above the client.
  *
  * Without this an Xcode build has no readable config: the phase declares
- * `$(SRCROOT)/.primitive/config.json`, which a composed client does not have,
+ * `$(SRCROOT)/primitive/config.json`, which a composed client does not have,
  * and the sandbox denies everything undeclared. A fresh clone (where
  * `primitive.json` is gitignored) then cannot build at all, and a working copy
  * that still has one keeps whichever environment generated it — so

package/dist/src/lib/init-xcode.js

@@ -6,7 +6,7 @@
  * CHECKED IN — that is what Xcode's Run button, a bare `xcodebuild` and a fresh
  * clone all compile. A composed repository moves two files the Xcode build
  * phases declare out of the client: the model schema (up to `models/` at the
- * root) and `.primitive/config.json` (which the whole app shares). Rewriting
+ * root) and `primitive/config.json` (which the whole app shares). Rewriting
  * only `project.yml` would leave the shipped project declaring paths that are
  * no longer there — a build input error naming a file, with nothing saying the
  * schema moved — so every rewrite here lands in both places.
@@ -17,15 +17,38 @@
  */
 import { existsSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { join, relative, sep } from "path";
+import { LOCAL_STATE_FILENAME, PROJECT_CONFIG_FILENAME, PROJECT_LOCAL_STATE_DIR, PROJECT_TREE_DIR, } from "./env-resolver-core.js";
+/**
+ * The committed Xcode files that spell a `$(SRCROOT)/`-relative path, beyond
+ * the spec and the checked-in project.
+ *
+ * The codegen phase declares its config-dependent inputs and outputs through
+ * these two lists (#3078), refreshed by `scripts/codegen.sh` on every build. A
+ * composed client's lists would otherwise ship naming a schema this run just
+ * removed — self-healed on the first build, but wrong in the committed tree
+ * until then, and invisible to the check that refuses to strand a declaration.
+ */
+const XCODE_FILE_LISTS = [
+    join("scripts", "codegen-inputs.xcfilelist"),
+    join("scripts", "codegen-outputs.xcfilelist"),
+];
 /** The build phase inputs that name the project config, relative to a client. */
 const PROJECT_CONFIG_INPUTS = [
-    join(".primitive", "config.json"),
-    join(".primitive", "local.json"),
+    join(PROJECT_TREE_DIR, PROJECT_CONFIG_FILENAME),
+    join(PROJECT_LOCAL_STATE_DIR, LOCAL_STATE_FILENAME),
 ];
 /** A POSIX-style path from `fromDir` to `toPath`, for a build-setting string. */
 function posixRelative(fromDir, toPath) {
     return relative(fromDir, toPath).split(sep).join("/");
 }
+/** Every file in `clientDir` that can declare a `$(SRCROOT)/`-relative path. */
+function declaringFiles(clientDir) {
+    return [
+        join(clientDir, "project.yml"),
+        ...findPbxprojFiles(clientDir),
+        ...XCODE_FILE_LISTS.map((rel) => join(clientDir, rel)),
+    ];
+}
 /** Every checked-in `project.pbxproj` beside the client's sources. */
 function findPbxprojFiles(clientDir) {
     let entries;
@@ -41,9 +64,10 @@ function findPbxprojFiles(clientDir) {
         .filter((path) => existsSync(path));
 }
 /**
- * Retargets one `$(SRCROOT)`-relative build-phase path, in `project.yml` and in
- * every checked-in Xcode project. Both spell the path the same way, so one
- * literal substitution covers the declared inputs and outputs alike.
+ * Retargets one `$(SRCROOT)`-relative build-phase path, in `project.yml`, in
+ * every checked-in Xcode project, and in the committed codegen file lists. They
+ * all spell the path the same way, so one literal substitution covers the
+ * declared inputs and outputs alike.
  *
  * Returns the files it rewrote.
  */
@@ -53,7 +77,7 @@ export function retargetXcodePath(clientDir, fromRelative, toRelative) {
     if (from === to)
         return [];
     const rewritten = [];
-    for (const path of [join(clientDir, "project.yml"), ...findPbxprojFiles(clientDir)]) {
+    for (const path of declaringFiles(clientDir)) {
         if (!existsSync(path))
             continue;
         const before = readFileSync(path, "utf-8");
@@ -80,7 +104,7 @@ export function xcodePathsLeftBehind(clientDir, fromRelative, toRelative) {
     if (from === to)
         return [];
     const stranded = [];
-    for (const path of [join(clientDir, "project.yml"), ...findPbxprojFiles(clientDir)]) {
+    for (const path of declaringFiles(clientDir)) {
         if (!existsSync(path))
             continue;
         const retargeted = readFileSync(path, "utf-8").split(from).join(to);
@@ -90,11 +114,11 @@ export function xcodePathsLeftBehind(clientDir, fromRelative, toRelative) {
     return stranded;
 }
 /**
- * Points the Xcode build phases at the app's `.primitive/config.json` when it
+ * Points the Xcode build phases at the app's `primitive/config.json` when it
  * lives above the client.
  *
  * Without this an Xcode build has no readable config: the phase declares
- * `$(SRCROOT)/.primitive/config.json`, which a composed client does not have,
+ * `$(SRCROOT)/primitive/config.json`, which a composed client does not have,
  * and the sandbox denies everything undeclared. A fresh clone (where
  * `primitive.json` is gitignored) then cannot build at all, and a working copy
  * that still has one keeps whichever environment generated it — so

package/dist/src/lib/init-xcode.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-xcode.js","sourceRoot":"","sources":["../../../src/lib/init-xcode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3C,iFAAiF;AACjF,MAAM,qBAAqB,GAAG;IAC5B,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;IACjC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF,iFAAiF;AACjF,SAAS,aAAa,CAAC,OAAe,EAAE,MAAc;IACpD,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;SACzD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,UAAkB;IAElB,MAAM,IAAI,GAAG,cAAc,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,MAAM;YAAE,SAAS;QAC/B,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,YAAoB,EACpB,UAAkB;IAElB,MAAM,IAAI,GAAG,cAAc,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,WAAmB;IAEnB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAClE,SAAS,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"init-xcode.js","sourceRoot":"","sources":["../../../src/lib/init-xcode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG;IACvB,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC;CAC9C,CAAC;AAEF,iFAAiF;AACjF,MAAM,qBAAqB,GAAG;IAC5B,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAC/C,IAAI,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;CACpD,CAAC;AAEF,iFAAiF;AACjF,SAAS,aAAa,CAAC,OAAe,EAAE,MAAc;IACpD,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO;QACL,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QAC9B,GAAG,gBAAgB,CAAC,SAAS,CAAC;QAC9B,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;SACzD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,UAAkB;IAElB,MAAM,IAAI,GAAG,cAAc,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,MAAM;YAAE,SAAS;QAC/B,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,YAAoB,EACpB,UAAkB;IAElB,MAAM,IAAI,GAAG,cAAc,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,cAAc,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,WAAmB;IAEnB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAClE,SAAS,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/lib/integration-selector.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolve the identifier the `integrations tests` verbs take (issue #3000).
+ *
+ * The block-testing endpoints key on the composite `integration#<blockId>` and
+ * never check that the block exists, so an identifier that names no
+ * integration came back as an empty page rather than a 404: `tests list`
+ * printed "No test cases found." and `tests run-all` printed
+ * `Total Tests: 0 / Failed: 0` and exited 0. That is success-shaped in CI and
+ * indistinguishable from an integration that genuinely has no cases, so a
+ * typo, an integration KEY, or an ID from another app all read as "nothing to
+ * run".
+ *
+ * Resolving here — against the app's own integration list — is what makes
+ * `Total Tests: 0` mean "this integration exists and has no cases". The list
+ * is the one call that can answer both halves: it maps a key to its ID (keys
+ * are stored lowercased, so the match is case-insensitive) and it proves the
+ * identifier belongs to THIS app. Archived integrations are included, because
+ * their cases stay inspectable.
+ */
+export interface ResolvedIntegration {
+    integrationId: string;
+    /** The integration's key, when the summary carries one. */
+    integrationKey?: string;
+}
+/** The one method this resolver needs from `ApiClient`. */
+export interface IntegrationLister {
+    listIntegrations(appId: string, params?: {
+        status?: string;
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: any[];
+        nextCursor?: string | null;
+    }>;
+}
+/**
+ * Map an integration ID or key to its integration ID.
+ *
+ * Throws — naming the identifier — when nothing in the app matches, so the
+ * caller's existing catch prints the message and exits non-zero.
+ */
+export declare function resolveIntegrationSelector(client: IntegrationLister, appId: string, selector: string): Promise<ResolvedIntegration>;

package/dist/src/lib/integration-selector.js

@@ -0,0 +1,46 @@
+/**
+ * Resolve the identifier the `integrations tests` verbs take (issue #3000).
+ *
+ * The block-testing endpoints key on the composite `integration#<blockId>` and
+ * never check that the block exists, so an identifier that names no
+ * integration came back as an empty page rather than a 404: `tests list`
+ * printed "No test cases found." and `tests run-all` printed
+ * `Total Tests: 0 / Failed: 0` and exited 0. That is success-shaped in CI and
+ * indistinguishable from an integration that genuinely has no cases, so a
+ * typo, an integration KEY, or an ID from another app all read as "nothing to
+ * run".
+ *
+ * Resolving here — against the app's own integration list — is what makes
+ * `Total Tests: 0` mean "this integration exists and has no cases". The list
+ * is the one call that can answer both halves: it maps a key to its ID (keys
+ * are stored lowercased, so the match is case-insensitive) and it proves the
+ * identifier belongs to THIS app. Archived integrations are included, because
+ * their cases stay inspectable.
+ */
+import { paginateAll } from "./paginate.js";
+/**
+ * Map an integration ID or key to its integration ID.
+ *
+ * Throws — naming the identifier — when nothing in the app matches, so the
+ * caller's existing catch prints the message and exits non-zero.
+ */
+export async function resolveIntegrationSelector(client, appId, selector) {
+    const identifier = (selector ?? "").trim();
+    if (!identifier) {
+        throw new Error("An integration ID or key is required.");
+    }
+    const items = await paginateAll((cursor) => client.listIntegrations(appId, cursor ? { cursor } : {}));
+    const lowered = identifier.toLowerCase();
+    const match = items.find((item) => item?.integrationId === identifier) ??
+        items.find((item) => typeof item?.integrationKey === "string" &&
+            item.integrationKey.toLowerCase() === lowered);
+    if (!match) {
+        throw new Error(`No integration '${identifier}' in app ${appId}. ` +
+            `Pass an integration key or ID from 'primitive integrations list'.`);
+    }
+    return {
+        integrationId: match.integrationId ?? identifier,
+        ...(match.integrationKey ? { integrationKey: match.integrationKey } : {}),
+    };
+}
+//# sourceMappingURL=integration-selector.js.map

package/dist/src/lib/integration-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-selector.js","sourceRoot":"","sources":["../../../src/lib/integration-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAyB,EACzB,KAAa,EACb,QAAgB;IAEhB,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAM,CAAC,MAAM,EAAE,EAAE,CAC9C,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD,CAAC;IAEF,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,UAAU,CAAC;QACxD,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ;YACxC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,OAAO,CAChD,CAAC;IAEJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,mBAAmB,UAAU,YAAY,KAAK,IAAI;YAChD,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU;QAChD,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC"}

package/dist/src/lib/ios-app-id.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The iOS client's Apple app identifier, per environment (#3081).
+ *
+ * Apple matches an association document against
+ * `<Application Identifier Prefix>.<Bundle Identifier>` — the prefix is ten
+ * alphanumerics, and it is USUALLY the Team ID but a legacy app's can differ
+ * (TN2311). Every message below therefore says "Application Identifier Prefix"
+ * and points at the signed app's `application-identifier` entitlement: a
+ * well-formed identifier with the wrong prefix produces a document that PARSES,
+ * so Apple caches it and both universal links and passkeys fail with nothing to
+ * read.
+ *
+ * One value per environment, because an app with alpha and production has one
+ * bundle id each. It is declared beside `webUrl` (#2982) — that pair is one
+ * cross-client link, the origin and the app it vouches for — and the Vue
+ * template's `scripts/deploy.mjs` generates the association document from it at
+ * deploy time.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateWebUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt. `deploy.mjs` duplicates the
+ * shape rule (it is self-contained, node builtins only) but not these messages.
+ */
+/**
+ * Validates an Apple app identifier. Returns `true` when valid, otherwise the
+ * message to show the user.
+ */
+export declare function validateIosAppId(value: string): string | true;
+/**
+ * The stored form of an already-validated identifier: trimmed, and otherwise
+ * byte-for-byte what Apple matches. Case is NOT folded — a bundle id is
+ * case-sensitive to Apple, and the prefix is uppercase already.
+ */
+export declare function normalizeIosAppId(value: string): string;

package/dist/src/lib/ios-app-id.js

@@ -0,0 +1,69 @@
+/**
+ * The iOS client's Apple app identifier, per environment (#3081).
+ *
+ * Apple matches an association document against
+ * `<Application Identifier Prefix>.<Bundle Identifier>` — the prefix is ten
+ * alphanumerics, and it is USUALLY the Team ID but a legacy app's can differ
+ * (TN2311). Every message below therefore says "Application Identifier Prefix"
+ * and points at the signed app's `application-identifier` entitlement: a
+ * well-formed identifier with the wrong prefix produces a document that PARSES,
+ * so Apple caches it and both universal links and passkeys fail with nothing to
+ * read.
+ *
+ * One value per environment, because an app with alpha and production has one
+ * bundle id each. It is declared beside `webUrl` (#2982) — that pair is one
+ * cross-client link, the origin and the app it vouches for — and the Vue
+ * template's `scripts/deploy.mjs` generates the association document from it at
+ * deploy time.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateWebUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt. `deploy.mjs` duplicates the
+ * shape rule (it is self-contained, node builtins only) but not these messages.
+ */
+/** The example every message ends with, so a rejection is actionable. */
+const SHAPE = "e.g. ABCDE12345.com.example.app";
+/** Where the authoritative value is, when the Team ID is not the prefix. */
+const VERIFY = "verify it against the signed app's application-identifier entitlement";
+/** `<Application Identifier Prefix>.<Bundle Identifier>`, after trimming. */
+const IOS_APP_ID = /^[A-Z0-9]{10}\.[A-Za-z0-9.-]+$/;
+/** The placeholder the template's `.example` document ships with. */
+const PLACEHOLDER_PREFIX = "TEAMID";
+/**
+ * Validates an Apple app identifier. Returns `true` when valid, otherwise the
+ * message to show the user.
+ */
+export function validateIosAppId(value) {
+    if (typeof value !== "string" || !value.trim()) {
+        return `iOS app id cannot be empty — ${SHAPE}`;
+    }
+    const trimmed = value.trim();
+    const dot = trimmed.indexOf(".");
+    if (dot === -1) {
+        return `iOS app id must be <Application Identifier Prefix>.<bundle id> — ${SHAPE}`;
+    }
+    const prefix = trimmed.slice(0, dot);
+    const bundleId = trimmed.slice(dot + 1);
+    if (prefix === PLACEHOLDER_PREFIX || bundleId === "BUNDLEID") {
+        return `iOS app id is still the "${PLACEHOLDER_PREFIX}.BUNDLEID" placeholder — replace it with this environment's Application Identifier Prefix (usually your Team ID; ${VERIFY}) and the iOS client's bundle id (${SHAPE})`;
+    }
+    if (!/^[A-Z0-9]{10}$/.test(prefix)) {
+        return `iOS app id must start with the 10-character Application Identifier Prefix (usually your Team ID; ${VERIFY}), not "${prefix}" — ${SHAPE}`;
+    }
+    if (!bundleId) {
+        return `iOS app id has no bundle id after the Application Identifier Prefix — ${SHAPE}`;
+    }
+    if (!IOS_APP_ID.test(trimmed)) {
+        return `iOS app id's bundle id may only contain letters, digits, dots and dashes — ${SHAPE}`;
+    }
+    return true;
+}
+/**
+ * The stored form of an already-validated identifier: trimmed, and otherwise
+ * byte-for-byte what Apple matches. Case is NOT folded — a bundle id is
+ * case-sensitive to Apple, and the prefix is uppercase already.
+ */
+export function normalizeIosAppId(value) {
+    return value.trim();
+}
+//# sourceMappingURL=ios-app-id.js.map

package/dist/src/lib/ios-app-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ios-app-id.js","sourceRoot":"","sources":["../../../src/lib/ios-app-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,yEAAyE;AACzE,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAEhD,4EAA4E;AAC5E,MAAM,MAAM,GACV,uEAAuE,CAAC;AAE1E,6EAA6E;AAC7E,MAAM,UAAU,GAAG,gCAAgC,CAAC;AAEpD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,gCAAgC,KAAK,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,oEAAoE,KAAK,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,kBAAkB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAO,4BAA4B,kBAAkB,oHAAoH,MAAM,qCAAqC,KAAK,GAAG,CAAC;IAC/N,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,oGAAoG,MAAM,WAAW,MAAM,OAAO,KAAK,EAAE,CAAC;IACnJ,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,yEAAyE,KAAK,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,8EAA8E,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/src/lib/list-options.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The `--limit` / `--cursor` pair every paged `list` verb declares (#3646).
+ *
+ * Pagination is a property of the route, not of the verb that happens to have
+ * needed it first: a `list` backed by a paged server route carries both flags,
+ * prints exactly one page and reports the page boundary in its envelope; a
+ * `list` backed by an unpaged route carries neither. Declaring the pair from
+ * one place keeps the help text — and therefore the command manifest the docs
+ * gate reads — identical across the thirty-odd verbs that page.
+ *
+ * `cli/tests/unit/list-envelope-uniform-3646.test.ts` walks the manifest and
+ * fails a `list` that declares one of the two without the other.
+ */
+import { Option } from "commander";
+/** `--limit <n>`, for a list whose route pages. */
+export declare function pageLimitOption(): Option;
+/** `--cursor <cursor>`, for a list whose route pages. */
+export declare function pageCursorOption(): Option;
+/**
+ * Read `--limit` as a positive integer, or exit naming the flag.
+ *
+ * Refuses before the action asks anything of the server, so a typo costs a
+ * message rather than a page of rows the caller did not ask for.
+ *
+ * Only an absent flag means "the route's own default": an empty value is a
+ * value, and `--limit "$LIMIT"` with `LIMIT` unset is the ordinary way a script
+ * supplies one. Reading it as an omission would answer a malformed request with
+ * a page the caller never asked for, so it takes the same refusal as `--limit
+ * zero`.
+ */
+export declare function parsePageLimit(raw: unknown): number | undefined;
+/** A page as the human-readable half of a `list` verb reads it. */
+interface PageBoundary {
+    nextCursor?: string;
+}
+/**
+ * A cursor as it must appear after `--cursor` in a printed hint.
+ *
+ * A list cursor is the server's keyset position run through `JSON.stringify`
+ * (`encodeListCursor`, `src/app-api/helpers/list-params.ts`), so the token a
+ * page hands back is routinely `{"documentId":"01HXY…"}` — braces and quotes
+ * that a shell eats. The hint exists to be copied verbatim, so anything but a
+ * bare word is single-quoted POSIX-style (an embedded `'` closes, escapes and
+ * reopens the quoting).
+ */
+export declare function quoteCursorArg(cursor: string): string;
+/**
+ * The "there is another page" hint, printed only when there is one.
+ *
+ * The counterpart of the envelope's `nextCursor` for a reader who is not
+ * parsing JSON: the same token, spelled as the argument that fetches the next
+ * page.
+ */
+export declare function printPageHint(page: PageBoundary): void;
+/**
+ * The empty state for one page.
+ *
+ * An empty page is not the same thing as an empty listing: several routes cut
+ * the page from an index and filter it afterwards — `withoutFunctionOwned` and
+ * the status filter on webhooks, the bounded index scans — so a page can come
+ * back with no rows and a cursor pointing at matches further along. Before
+ * #3646 the draining readers hid that; now that a `list` prints one page,
+ * "No <subject> found." would be a lie in exactly that case, so it is said
+ * only when the server reported no next page, and the continuation is printed
+ * either way.
+ */
+export declare function printEmptyPage(page: PageBoundary, subject: string, emptyListing?: string): void;
+export {};

package/dist/src/lib/list-options.js

@@ -0,0 +1,89 @@
+/**
+ * The `--limit` / `--cursor` pair every paged `list` verb declares (#3646).
+ *
+ * Pagination is a property of the route, not of the verb that happens to have
+ * needed it first: a `list` backed by a paged server route carries both flags,
+ * prints exactly one page and reports the page boundary in its envelope; a
+ * `list` backed by an unpaged route carries neither. Declaring the pair from
+ * one place keeps the help text — and therefore the command manifest the docs
+ * gate reads — identical across the thirty-odd verbs that page.
+ *
+ * `cli/tests/unit/list-envelope-uniform-3646.test.ts` walks the manifest and
+ * fails a `list` that declares one of the two without the other.
+ */
+import { Option } from "commander";
+import { error, info } from "./output.js";
+/** `--limit <n>`, for a list whose route pages. */
+export function pageLimitOption() {
+    return new Option("--limit <n>", "Maximum rows in one page (the route's own default when omitted)");
+}
+/** `--cursor <cursor>`, for a list whose route pages. */
+export function pageCursorOption() {
+    return new Option("--cursor <cursor>", "Page to resume from: the `nextCursor` of a previous page");
+}
+/**
+ * Read `--limit` as a positive integer, or exit naming the flag.
+ *
+ * Refuses before the action asks anything of the server, so a typo costs a
+ * message rather than a page of rows the caller did not ask for.
+ *
+ * Only an absent flag means "the route's own default": an empty value is a
+ * value, and `--limit "$LIMIT"` with `LIMIT` unset is the ordinary way a script
+ * supplies one. Reading it as an omission would answer a malformed request with
+ * a page the caller never asked for, so it takes the same refusal as `--limit
+ * zero`.
+ */
+export function parsePageLimit(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    const limit = Number(raw);
+    if (!Number.isInteger(limit) || limit <= 0) {
+        error("--limit must be a positive integer.");
+        process.exit(1);
+    }
+    return limit;
+}
+/**
+ * A cursor as it must appear after `--cursor` in a printed hint.
+ *
+ * A list cursor is the server's keyset position run through `JSON.stringify`
+ * (`encodeListCursor`, `src/app-api/helpers/list-params.ts`), so the token a
+ * page hands back is routinely `{"documentId":"01HXY…"}` — braces and quotes
+ * that a shell eats. The hint exists to be copied verbatim, so anything but a
+ * bare word is single-quoted POSIX-style (an embedded `'` closes, escapes and
+ * reopens the quoting).
+ */
+export function quoteCursorArg(cursor) {
+    if (/^[A-Za-z0-9._:/=+-]+$/.test(cursor))
+        return cursor;
+    return `'${cursor.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * The "there is another page" hint, printed only when there is one.
+ *
+ * The counterpart of the envelope's `nextCursor` for a reader who is not
+ * parsing JSON: the same token, spelled as the argument that fetches the next
+ * page.
+ */
+export function printPageHint(page) {
+    if (!page.nextCursor)
+        return;
+    info(`More results available. Re-run with --cursor ${quoteCursorArg(page.nextCursor)}`);
+}
+/**
+ * The empty state for one page.
+ *
+ * An empty page is not the same thing as an empty listing: several routes cut
+ * the page from an index and filter it afterwards — `withoutFunctionOwned` and
+ * the status filter on webhooks, the bounded index scans — so a page can come
+ * back with no rows and a cursor pointing at matches further along. Before
+ * #3646 the draining readers hid that; now that a `list` prints one page,
+ * "No <subject> found." would be a lie in exactly that case, so it is said
+ * only when the server reported no next page, and the continuation is printed
+ * either way.
+ */
+export function printEmptyPage(page, subject, emptyListing = `No ${subject} found.`) {
+    info(page.nextCursor ? `No ${subject} on this page.` : emptyListing);
+    printPageHint(page);
+}
+//# sourceMappingURL=list-options.js.map

package/dist/src/lib/list-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-options.js","sourceRoot":"","sources":["../../../src/lib/list-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE1C,mDAAmD;AACnD,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,MAAM,CACf,aAAa,EACb,iEAAiE,CAClE,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,MAAM,CACf,mBAAmB,EACnB,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACxD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO;IAC7B,IAAI,CACF,gDAAgD,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAClF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkB,EAClB,OAAe,EACf,YAAY,GAAG,MAAM,OAAO,SAAS;IAErC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrE,aAAa,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}