primitive-admin 1.0.63 → 1.0.64

package/dist/src/lib/config-payload.js

@@ -12,7 +12,7 @@
  * They read the same `ConfigTable`, so they cannot disagree about which fields
  * exist — which is the whole point.
  */
-import { isEmptyForEmit, writableFieldNames, } from "./generated-config-surfaces.js";
+import { isEmptyForEmit, tomlGroupsOf, writableFieldNames, } from "./generated-config-surfaces.js";
 /**
  * Project a server record onto its TOML table, using the definition's field
  * list and `emit` semantics.
@@ -29,8 +29,13 @@ import { isEmptyForEmit, writableFieldNames, } from "./generated-config-surfaces
  * empty JSON Schema `{}` is a real, distinct value ("accepts anything"), so a
  * generic "an empty object is unset" would drop it on pull and the next push
  * would clear it server-side.
+ *
+ * `tomlGroup` (#3798) names the block a field authored under SEVERAL blocks is
+ * written into — the prompt's kind, for the model settings chat and agent
+ * share. A field declaring one block ignores it; with none named, a
+ * multi-block field goes to its first block.
  */
-export function projectRecordToToml(table, record, values = {}) {
+export function projectRecordToToml(table, record, values = {}, { tomlGroup } = {}) {
     const out = {};
     for (const field of table.fields) {
         const produce = values[field.field];
@@ -44,6 +49,20 @@ export function projectRecordToToml(table, record, values = {}) {
         }
         if (value === undefined)
             continue;
+        // #3626 — a grouped field is written inside its sub-table
+        // (`[configs.chat].systemPrompt`). The group itself is created lazily, so a
+        // group none of whose fields emit is simply absent from the pulled file
+        // rather than an empty `[configs.chat]` header the next diff would have to
+        // equate with nothing.
+        const groups = tomlGroupsOf(field);
+        if (groups.length > 0) {
+            const name = tomlGroup !== undefined && groups.includes(tomlGroup)
+                ? tomlGroup
+                : groups[0];
+            const group = (out[name] ??= {});
+            group[field.tomlKey] = value;
+            continue;
+        }
         out[field.tomlKey] = value;
     }
     return out;
@@ -61,15 +80,41 @@ export function projectRecordToToml(table, record, values = {}) {
 export function buildPayloadFromToml(table, tomlTable, { mode, values = {} }) {
     const source = tomlTable && typeof tomlTable === "object" ? tomlTable : {};
     const payload = {};
+    /**
+     * #3626 — where the field is authored. A grouped field is read ONLY from its
+     * sub-table: the same key at the table root is not a second spelling, it is
+     * an unknown key `acceptedTomlKeys` already refused (SO3626-013). The nine
+     * deprecated flat chat keys reach the group through
+     * `hoistDeprecatedChatKeys`, which runs before this.
+     *
+     * #3798 — a field authored under several blocks is read from the first of
+     * them the entry carries a value in. An entry carrying two blocks is the kind
+     * rule's refusal (`promptKindFileErrors`), decided before any payload is sent.
+     */
+    const readAt = (field) => {
+        const groups = tomlGroupsOf(field);
+        if (groups.length === 0)
+            return source[field.tomlKey];
+        for (const name of groups) {
+            const group = source[name];
+            if (group &&
+                typeof group === "object" &&
+                !Array.isArray(group) &&
+                group[field.tomlKey] !== undefined) {
+                return group[field.tomlKey];
+            }
+        }
+        return undefined;
+    };
     for (const field of table.fields) {
         if (!field.writableOn.includes(mode))
             continue;
         const produce = values[field.field];
         if (produce) {
-            payload[field.field] = produce(source[field.tomlKey], mode, source);
+            payload[field.field] = produce(readAt(field), mode, source);
             continue;
         }
-        const value = source[field.tomlKey];
+        const value = readAt(field);
         // #2880 DSO-002 — the file is the source of truth (#1567), so an absent key
         // means the field's DECLARED default rather than "leave whatever the server
         // has". Sending it is what makes the comparison's reading of that absence

package/dist/src/lib/config-payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-payload.js","sourceRoot":"","sources":["../../../src/lib/config-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,cAAc,EACd,kBAAkB,GAGnB,MAAM,gCAAgC,CAAC;AAqBxC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,MAAW,EACX,SAAoC,EAAE;IAEtC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;QACtD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB,EAClB,SAAc,EACd,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAA0D;IAE7E,MAAM,MAAM,GAAG,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAClB,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;gBACtD,CAAC,CAAC,KAAK,CAAC,aAAa;gBACrB,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,MAAW,EACX,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAA0D;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO;YAC5B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAc,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAE7D,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"config-payload.js","sourceRoot":"","sources":["../../../src/lib/config-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,kBAAkB,GAGnB,MAAM,gCAAgC,CAAC;AAqBxC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,MAAW,EACX,SAAoC,EAAE,EACtC,EAAE,SAAS,KAA6B,EAAE;IAE1C,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;QACtD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,0DAA0D;QAC1D,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,uBAAuB;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GACR,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACnD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB,EAClB,SAAc,EACd,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAA0D;IAE7E,MAAM,MAAM,GAAG,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC;;;;;;;;;;OAUG;IACH,MAAM,MAAM,GAAG,CAAC,KAAkB,EAAO,EAAE;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrB,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAClC,CAAC;gBACD,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YAClB,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;gBACtD,CAAC,CAAC,KAAK,CAAC,aAAa;gBACrB,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,MAAW,EACX,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAA0D;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO;YAC5B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;YAC5C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAc,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;AAE7D,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/src/lib/config-surface.d.ts

@@ -15,8 +15,9 @@
  *     trip is therefore loud-and-lossy — push omits what it does not know, so
  *     the server keeps its stored values — never silently destructive.
  */
-import { retiredConfigKey, type ConfigObjectSurface, type ConfigField, type ConfigTable } from "./generated-config-surfaces.js";
+import { findUnknownGroupedTomlKeys, retiredConfigKey, type ConfigObjectSurface, type ConfigField, type ConfigTable } from "./generated-config-surfaces.js";
 export { retiredConfigKey };
+export { findUnknownGroupedTomlKeys };
 /** A surface by label. Throws rather than silently skipping checks. */
 export declare function requireConfigSurface(label: string): ConfigObjectSurface;
 /** A table by label and TOML path. Throws rather than silently skipping checks. */
@@ -30,6 +31,7 @@ export declare const WEBHOOK_TABLE: ConfigTable;
 export declare const CRON_TRIGGER_TABLE: ConfigTable;
 export declare const BLOB_BUCKET_TABLE: ConfigTable;
 export declare const EMAIL_TEMPLATE_TABLE: ConfigTable;
+export declare const SERVER_FUNCTION_TABLE: ConfigTable;
 export declare const DATABASE_TYPE_TABLE: ConfigTable;
 export declare const RULE_SET_TABLE: ConfigTable;
 export declare const GROUP_TYPE_CONFIG_TABLE: ConfigTable;
@@ -47,6 +49,15 @@ export declare const METADATA_CATEGORY_CONFIG_TABLE: ConfigTable;
 export declare const TEST_CASE_TABLE: ConfigTable;
 /** The `test-case` surface itself, for the sidecars' document-shape check. */
 export declare const TEST_CASE_SURFACE: ConfigObjectSurface;
+/**
+ * The value a create materializes when the file omits `field`, as the
+ * definition records it — or `undefined` when the field has no such default.
+ *
+ * Read rather than repeated, so a caller that omits a value BECAUSE the server
+ * would assign it anyway (#3201's `[[configs]] status`) can never disagree
+ * with the default push sends for the same absent key.
+ */
+export declare function fieldServerDefault(table: ConfigTable, field: string): ConfigField["serverDefault"];
 /**
  * Does this field's declared type genuinely admit more than one spelling
  * (#2880 criterion 5)?

package/dist/src/lib/config-surface.js

@@ -15,11 +15,15 @@
  *     trip is therefore loud-and-lossy — push omits what it does not know, so
  *     the server keeps its stored values — never silently destructive.
  */
-import { GENERATED_CONFIG_MODEL_FIELDS, acceptedTomlKeys, retiredConfigKey, findMisshapenTomlTables, findUnknownTomlDocumentKeys, getConfigSurface, getConfigTable, recognizedResponseKeys, } from "./generated-config-surfaces.js";
+import { GENERATED_CONFIG_MODEL_FIELDS, acceptedTomlKeys, findUnknownGroupedTomlKeys, tomlGroupsOf, retiredConfigKey, findMisshapenTomlTables, findUnknownTomlDocumentKeys, getConfigSurface, getConfigTable, recognizedResponseKeys, } from "./generated-config-surfaces.js";
 // #2645/#2803 — the guidance for a key a definition deliberately RETIRED. Its
 // text is vendored with the definitions so `config push` and the server's
 // create/update handlers say the same thing about the same key.
 export { retiredConfigKey };
+// #3626 — keys inside a `[configs.<group>]` block that no field declares
+// under it. Re-exported beside `findUnknownTomlKeys` so a caller checking a
+// table's keys needs one import for both halves of the same question.
+export { findUnknownGroupedTomlKeys };
 /** A surface by label. Throws rather than silently skipping checks. */
 export function requireConfigSurface(label) {
     const surface = getConfigSurface(label);
@@ -56,6 +60,12 @@ export const BLOB_BUCKET_TABLE = requireConfigTable("blob-bucket", ["bucket"]);
 export const EMAIL_TEMPLATE_TABLE = requireConfigTable("email-template", [
     "template",
 ]);
+// #3179 — the `[function]` table. One table over the HEADER model; the three
+// version-carried keys (`entry`, `mode`, `limits`) are declared beside `key`
+// in its `tomlOnlyKeys`, because an author writes a function, never a version.
+export const SERVER_FUNCTION_TABLE = requireConfigTable("function", [
+    "function",
+]);
 // The five structured objects (#2644 phase 3). Their authored sub-trees —
 // `[rules]`, `[models.*]`, `[triggers]`, the `[metadata]` manifest — keep the
 // validators that already own them; these tables are the scalar surface.
@@ -78,6 +88,17 @@ export const METADATA_CATEGORY_CONFIG_TABLE = requireConfigTable("metadata-categ
 export const TEST_CASE_TABLE = requireConfigTable("test-case", ["test"]);
 /** The `test-case` surface itself, for the sidecars' document-shape check. */
 export const TEST_CASE_SURFACE = requireConfigSurface("test-case");
+/**
+ * The value a create materializes when the file omits `field`, as the
+ * definition records it — or `undefined` when the field has no such default.
+ *
+ * Read rather than repeated, so a caller that omits a value BECAUSE the server
+ * would assign it anyway (#3201's `[[configs]] status`) can never disagree
+ * with the default push sends for the same absent key.
+ */
+export function fieldServerDefault(table, field) {
+    return table.fields.find((f) => f.field === field)?.serverDefault;
+}
 /**
  * Does this field's declared type genuinely admit more than one spelling
  * (#2880 criterion 5)?
@@ -159,6 +180,22 @@ function valueMatchesDeclaredType(field, value) {
             return true;
     }
 }
+/** The value as a TOML table, or `undefined` when it is not one. */
+function readTomlTable(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * Is `key` a spelling this table still accepts but has superseded (#3626)?
+ *
+ * The nine flat chat keys are the first: declared in `tomlOnlyKeys` with
+ * `kind: "deprecated"` so an unmigrated prompt file keeps pushing, while the
+ * field itself is authored inside `[configs.chat]`.
+ */
+function isDeprecatedTomlKey(table, key) {
+    return table.tomlOnlyKeys?.[key]?.kind === "deprecated";
+}
 /**
  * Every value in `tomlData` whose spelling does not match the type its field
  * declares (#2880 criterion 5).
@@ -185,10 +222,41 @@ export function configDeclaredTypeErrors(filePath, tomlData, table) {
         if (!entry.value || typeof entry.value !== "object")
             continue;
         for (const field of table.fields) {
-            const value = entry.value[field.tomlKey];
+            // #3626 — a grouped field is read at its group path and LABELLED with it
+            // (`configs[0].chat.temperature`), so the message names where the value
+            // actually is. A group that is not a table has no value to type-check;
+            // `findUnknownGroupedTomlKeys` reports that shape.
+            //
+            // #3798 — a field several blocks share is read in the first of its
+            // blocks that holds a value, and labelled with that block, so a
+            // mistyped `[configs.agent].temperature` names `agent`.
+            const groups = tomlGroupsOf(field);
+            const groupName = groups.find((name) => readTomlTable(entry.value[name])?.[field.tomlKey] !== undefined) ?? groups[0];
+            let container = readTomlTable(groupName
+                ? entry.value[groupName]
+                : entry.value);
+            let label = groupName ? `${entry.label}.${groupName}` : entry.label;
+            // #3626, CR3626-003 — a grouped key whose FLAT spelling the table still
+            // accepts as DEPRECATED is read where the file actually wrote it. The
+            // grouping moved the reader into the sub-table, which silently took the
+            // declared-type check away from every unmigrated file: a flat
+            // `temperature = "hot"` passed the preflight it used to fail and was
+            // hoisted into the payload unread. Accepting the old spelling has to mean
+            // accepting it on the same terms, so the root value is checked — and
+            // labelled at the root, because that is the line the author has to fix.
+            if (groupName &&
+                container?.[field.tomlKey] === undefined &&
+                isDeprecatedTomlKey(table, field.tomlKey) &&
+                entry.value[field.tomlKey] !== undefined) {
+                container = entry.value;
+                label = entry.label;
+            }
+            if (!container)
+                continue;
+            const value = container[field.tomlKey];
             if (valueMatchesDeclaredType(field, value))
                 continue;
-            errors.push(`${filePath}: ${entry.label}.${field.tomlKey} — expected a ` +
+            errors.push(`${filePath}: ${label}.${field.tomlKey} — expected a ` +
                 `${declaredTypeName(field.type)}, found ${foundSpelling(value)}. ` +
                 "The declared type is the contract: `config diff` and `config push` " +
                 "both read it this way and neither converts it for you.");

package/dist/src/lib/config-surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-surface.js","sourceRoot":"","sources":["../../../src/lib/config-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GAIvB,MAAM,gCAAgC,CAAC;AAExC,8EAA8E;AAC9E,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,KAAK;YAC9C,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAA2B;IAE3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACtE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE;IACjE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,cAAc,EAAE;IACnE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,gBAAgB,EAAE;IACvE,UAAU;CACX,CAAC,CAAC;AAEH,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,mBAAmB,EAAE;IAC7E,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAC5D,wBAAwB,EACxB,CAAC,sBAAsB,CAAC,CACzB,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAC9D,0BAA0B,EAC1B,CAAC,wBAAwB,CAAC,CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAkB;IAC7D,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+DAA+D;AAC/D,SAAS,gBAAgB,CAAC,IAAyB;IACjD,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,OAAO,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,KAAkB,EAClB,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,iEAAiE;YACjE,wEAAwE;YACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QAChE,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3C,uEAAuE;YACvE,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,SAAS;gBAC/B,OAAO,KAAK,KAAK,QAAQ;gBACzB,mBAAmB,CAAC,KAAK,CAAC,CAC3B,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,QAAiB,EACjB,KAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC7D,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAyC,KAAK,CAAC,QAAQ;QAClE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAU,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;YAChE,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG;YAC9C,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAI,KAAK,CAAC,KAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtE,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YACrD,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,gBAAgB;gBAC1D,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,KAAK,CAAC,IAAI;gBAClE,qEAAqE;gBACrE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkB,EAClB,KAAkB;IAElB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC;SACrD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,KAAkB;IAElB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,uEAAuE;QACvE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,IAAI,KAAK,CACb,kDAAkD,KAAK,CAAC,KAAK,KAAK;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC;SACnD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,gBAAgB,IAAI,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC1E,wCAAwC,KAAK,IAAI;QACjD,sDAAsD;QACtD,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,KAAkB,EAClB,IAAY,EACZ,MAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CACjC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,IAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CACL,GAAG,IAAI,iCAAiC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACxE,GAAG,KAAK,kEAAkE;QAC1E,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,GAAW,EACX,QAAqC;IAErC,OAAO,QAAQ,KAAK,iBAAiB;QACnC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,6CAA6C,GAAG,QAAQ;YACvE,uBAAuB;QAC3B,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,iCAAiC,GAAG,cAAc;YACjE,kBAAkB,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,GAAG,IAAI,qBAAqB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;QAC9D,IAAI,MAAM,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM;QACxE,uDAAuD,CACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config-surface.js","sourceRoot":"","sources":["../../../src/lib/config-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GAIvB,MAAM,gCAAgC,CAAC;AAExC,8EAA8E;AAC9E,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,KAAK;YAC9C,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAA2B;IAE3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACtE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE;IACjE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,cAAc,EAAE;IACnE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,gBAAgB,EAAE;IACvE,UAAU;CACX,CAAC,CAAC;AACH,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,UAAU,EAAE;IAClE,UAAU;CACX,CAAC,CAAC;AAEH,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,mBAAmB,EAAE;IAC7E,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAC5D,wBAAwB,EACxB,CAAC,sBAAsB,CAAC,CACzB,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAC9D,0BAA0B,EAC1B,CAAC,wBAAwB,CAAC,CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAAa;IAEb,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,aAAa,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAkB;IAC7D,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+DAA+D;AAC/D,SAAS,gBAAgB,CAAC,IAAyB;IACjD,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,OAAO,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,KAAkB,EAClB,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,iEAAiE;YACjE,wEAAwE;YACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QAChE,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3C,uEAAuE;YACvE,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,SAAS;gBAC/B,OAAO,KAAK,KAAK,QAAQ;gBACzB,mBAAmB,CAAC,KAAK,CAAC,CAC3B,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAkB,EAAE,GAAW;IAC1D,OAAO,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,QAAiB,EACjB,KAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC7D,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAyC,KAAK,CAAC,QAAQ;QAClE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAU,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;YAChE,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG;YAC9C,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,mDAAmD;YACnD,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CACP,aAAa,CACV,KAAK,CAAC,KAAiC,CAAC,IAAI,CAAC,CAC/C,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,SAAS,GAAG,aAAa,CAC3B,SAAS;gBACP,CAAC,CAAE,KAAK,CAAC,KAAiC,CAAC,SAAS,CAAC;gBACrD,CAAC,CAAC,KAAK,CAAC,KAAK,CAChB,CAAC;YACF,IAAI,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,8DAA8D;YAC9D,qEAAqE;YACrE,0EAA0E;YAC1E,qEAAqE;YACrE,wEAAwE;YACxE,IACE,SAAS;gBACT,SAAS,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;gBACxC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;gBACxC,KAAK,CAAC,KAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EACrE,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC,KAAgC,CAAC;gBACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YACrD,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,gBAAgB;gBACpD,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,KAAK,CAAC,IAAI;gBAClE,qEAAqE;gBACrE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkB,EAClB,KAAkB;IAElB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC;SACrD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,KAAkB;IAElB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,uEAAuE;QACvE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,IAAI,KAAK,CACb,kDAAkD,KAAK,CAAC,KAAK,KAAK;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC;SACnD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,gBAAgB,IAAI,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC1E,wCAAwC,KAAK,IAAI;QACjD,sDAAsD;QACtD,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,KAAkB,EAClB,IAAY,EACZ,MAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CACjC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,IAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CACL,GAAG,IAAI,iCAAiC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACxE,GAAG,KAAK,kEAAkE;QAC1E,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,GAAW,EACX,QAAqC;IAErC,OAAO,QAAQ,KAAK,iBAAiB;QACnC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,6CAA6C,GAAG,QAAQ;YACvE,uBAAuB;QAC3B,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,iCAAiC,GAAG,cAAc;YACjE,kBAAkB,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,GAAG,IAAI,qBAAqB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;QAC9D,IAAI,MAAM,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM;QACxE,uDAAuD,CACxD,CAAC;AACJ,CAAC"}

package/dist/src/lib/config.d.ts

@@ -5,7 +5,7 @@
  * ~/.primitive/credentials.json and a handful of helpers here. After the
  * project-config overhaul (issue #373) credentials live per-environment
  * inside `<projectRoot>/.primitive/credentials.json` when a
- * .primitive/config.json is in scope, and fall back to the legacy global
+ * primitive/config.json is in scope, and fall back to the legacy global
  * file otherwise.
  *
  * The rest of the CLI continues to import from this module, so we keep
@@ -18,15 +18,39 @@ export declare function saveCredentials(credentials: Credentials): void;
 export declare function clearCredentials(): void;
 export declare function isTokenExpired(credentials: Credentials): boolean;
 export declare function isTokenExpiringSoon(credentials: Credentials): boolean;
-export declare function setCurrentApp(appId: string, appName?: string): void;
-export declare function clearCurrentApp(): void;
-export declare function getCurrentAppId(): string | undefined;
+/**
+ * The app this invocation runs against: the resolved environment's, and only
+ * ever that (#3152).
+ *
+ * It never answers "none" (#3154). Outside a project there is no environment,
+ * and therefore no app — but there is also no configuration tree, no server
+ * and no credentials, so "which app?" is not a question with a quieter answer
+ * than the others. `requireCurrentEnvironment()` gives the one refusal, which
+ * is what retired the "No app specified" branch and its five local copies.
+ */
+export declare function getCurrentApp(): {
+    appId: string;
+    appName?: string;
+};
+export declare function getCurrentAppId(): string;
+/**
+ * The app a command acts on: an explicit one where the command still takes
+ * one (`users`, `apps`, `admins`, the database data verbs), otherwise the
+ * environment's.
+ *
+ * The explicit forms are checked FIRST and short-circuit, so a cross-app read
+ * still works with no environment able to name that app — that is the whole
+ * reason `--app` survives on those commands (intent §Decisions).
+ */
 export declare function resolveAppId(appId: string | undefined, options: {
     app?: string;
 }): string;
 /**
- * Returns the API base URL for the active environment (project mode) or
- * the serverUrl saved in the legacy credentials file.
+ * The API base URL for the active environment.
+ *
+ * The credentials-file fallback is gone (#3154): a `serverUrl` left in
+ * `~/.primitive/credentials.json` by whatever the last `login` targeted was a
+ * second source for the one thing an environment exists to say.
  */
 export declare function getServerUrl(): string;
 /**
@@ -39,15 +63,9 @@ export declare function getServerUrl(): string;
  *   - Project mode → the active environment's `apiUrl` (canonical). Lets
  *     getCurrentEnvironment() throw on an unresolvable env (ambiguous/unknown
  *     --env) so the caller can fail loudly instead of silently targeting prod.
- *   - Legacy mode (no .primitive/config.json) → DEFAULT_SERVER_URL, which
+ *   - Legacy mode (no primitive/config.json) → DEFAULT_SERVER_URL, which
  *     honors the PRIMITIVE_SERVER_URL escape hatch (constants.ts).
  *
  * The trailing slash is stripped so callers can build `${url}/admin/api/...`.
  */
 export declare function getConfiguredServerUrl(): string;
-/**
- * Exposed so commands can check whether there's a pre-project-config
- * credentials file at ~/.primitive/credentials.json (used by migration
- * prompts).
- */
-export declare function legacyCredentialsExist(): boolean;

package/dist/src/lib/config.js

@@ -5,16 +5,15 @@
  * ~/.primitive/credentials.json and a handful of helpers here. After the
  * project-config overhaul (issue #373) credentials live per-environment
  * inside `<projectRoot>/.primitive/credentials.json` when a
- * .primitive/config.json is in scope, and fall back to the legacy global
+ * primitive/config.json is in scope, and fall back to the legacy global
  * file otherwise.
  *
  * The rest of the CLI continues to import from this module, so we keep
  * the original public API (loadCredentials, saveCredentials, etc.) and
  * just delegate to the new stores.
  */
-import { clearCredentialsStore, clearCurrentAppStore, loadCredentialsStore, peekLegacyCredentials, saveCredentialsStore, setCurrentAppStore, } from "./credentials-store.js";
-import { getCurrentEnvironment, getCurrentEnvNameSafe, } from "./env-resolver.js";
-import { PROJECT_CONFIG_DISPLAY_NAME } from "./project-config.js";
+import { clearCredentialsStore, loadCredentialsStore, saveCredentialsStore, } from "./credentials-store.js";
+import { getCurrentEnvironment, requireCurrentEnvironment, } from "./env-resolver.js";
 import { DEFAULT_SERVER_URL } from "./constants.js";
 export function loadCredentials() {
     return loadCredentialsStore();
@@ -41,71 +40,44 @@ export function isTokenExpiringSoon(credentials) {
     // Consider expiring soon if less than 5 minutes remaining
     return expiresAt - now < 5 * 60 * 1000;
 }
-export function setCurrentApp(appId, appName) {
-    setCurrentAppStore(appId, appName);
-}
-export function clearCurrentApp() {
-    clearCurrentAppStore();
+/**
+ * The app this invocation runs against: the resolved environment's, and only
+ * ever that (#3152).
+ *
+ * It never answers "none" (#3154). Outside a project there is no environment,
+ * and therefore no app — but there is also no configuration tree, no server
+ * and no credentials, so "which app?" is not a question with a quieter answer
+ * than the others. `requireCurrentEnvironment()` gives the one refusal, which
+ * is what retired the "No app specified" branch and its five local copies.
+ */
+export function getCurrentApp() {
+    const env = requireCurrentEnvironment(); // may throw on an unresolvable env
+    return { appId: env.config.appId, appName: env.config.appName };
 }
 export function getCurrentAppId() {
-    // In project mode, the appId may come from .primitive/config.json (via
-    // loadCredentialsStore), which is what we want. In legacy mode it comes
-    // from the global credentials file.
-    const credentials = loadCredentials();
-    return credentials?.currentAppId;
+    return getCurrentApp().appId;
 }
+/**
+ * The app a command acts on: an explicit one where the command still takes
+ * one (`users`, `apps`, `admins`, the database data verbs), otherwise the
+ * environment's.
+ *
+ * The explicit forms are checked FIRST and short-circuit, so a cross-app read
+ * still works with no environment able to name that app — that is the whole
+ * reason `--app` survives on those commands (intent §Decisions).
+ */
 export function resolveAppId(appId, options) {
-    const resolved = appId || options.app || getCurrentAppId();
-    if (!resolved) {
-        // When the active env declares an `appId` in .primitive/config.json but
-        // has no credentials slot, loadCredentialsStore() returns null (its
-        // null == unauthenticated contract), so getCurrentAppId() yields nothing
-        // even though an appId IS configured. In that case the accurate problem
-        // is that the user isn't authenticated for this env — not that no app was
-        // specified. (A creds slot would have blended in env.config.appId and made
-        // `resolved` truthy, so reaching here with a configured appId can only mean
-        // missing credentials.)
-        let env = null;
-        try {
-            env = getCurrentEnvironment();
-        }
-        catch {
-            // Env resolution failed (ambiguous/unknown env) — fall back to the
-            // original "No app specified." message below.
-        }
-        if (env && env.config.appId) {
-            console.error(`Not logged in to environment "${env.name}". An appId is configured in ${PROJECT_CONFIG_DISPLAY_NAME} but you're not authenticated. Run 'primitive -e ${env.name} login'.`);
-            process.exit(1);
-        }
-        const envName = getCurrentEnvNameSafe();
-        const hint = envName
-            ? `(current environment: ${envName}). Set 'appId' in .primitive/config.json, pass --app, or run 'primitive use <app-id>'.`
-            : `Use <app-id>, --app, or 'primitive use <app-id>' to set context.`;
-        console.error(`No app specified. ${hint}`);
-        process.exit(1);
-    }
-    return resolved;
+    return appId || options.app || getCurrentAppId();
 }
 /**
- * Returns the API base URL for the active environment (project mode) or
- * the serverUrl saved in the legacy credentials file.
+ * The API base URL for the active environment.
+ *
+ * The credentials-file fallback is gone (#3154): a `serverUrl` left in
+ * `~/.primitive/credentials.json` by whatever the last `login` targeted was a
+ * second source for the one thing an environment exists to say.
  */
 export function getServerUrl() {
-    // Project mode takes priority — the project config is the source of
-    // truth for the API URL, even if we haven't logged in yet.
-    try {
-        const env = getCurrentEnvironment();
-        if (env)
-            return env.config.apiUrl;
-    }
-    catch (err) {
-        // Env resolution failed — fall through to credentials-based lookup.
-    }
-    const credentials = loadCredentials();
-    if (!credentials?.serverUrl) {
-        throw new Error("Not logged in. Run 'primitive login' first.");
-    }
-    return credentials.serverUrl;
+    return requireCurrentEnvironment().config.apiUrl;
 }
 /**
  * Resolves the API base URL to authenticate against, used by `primitive login`
@@ -117,7 +89,7 @@ export function getServerUrl() {
  *   - Project mode → the active environment's `apiUrl` (canonical). Lets
  *     getCurrentEnvironment() throw on an unresolvable env (ambiguous/unknown
  *     --env) so the caller can fail loudly instead of silently targeting prod.
- *   - Legacy mode (no .primitive/config.json) → DEFAULT_SERVER_URL, which
+ *   - Legacy mode (no primitive/config.json) → DEFAULT_SERVER_URL, which
  *     honors the PRIMITIVE_SERVER_URL escape hatch (constants.ts).
  *
  * The trailing slash is stripped so callers can build `${url}/admin/api/...`.
@@ -126,12 +98,4 @@ export function getConfiguredServerUrl() {
     const env = getCurrentEnvironment(); // may throw on an unresolvable env
     return (env ? env.config.apiUrl : DEFAULT_SERVER_URL).replace(/\/$/, "");
 }
-/**
- * Exposed so commands can check whether there's a pre-project-config
- * credentials file at ~/.primitive/credentials.json (used by migration
- * prompts).
- */
-export function legacyCredentialsExist() {
-    return peekLegacyCredentials() !== null;
-}
 //# sourceMappingURL=config.js.map

package/dist/src/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,UAAU,eAAe;IAC7B,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,qBAAqB,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAgB;IAC3D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,uEAAuE;IACvE,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,OAAO,WAAW,EAAE,YAAY,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,OAAyB;IAEzB,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,GAAG,GAA6C,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,8CAA8C;QAChD,CAAC;QACD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,iCAAiC,GAAG,CAAC,IAAI,gCAAgC,2BAA2B,oDAAoD,GAAG,CAAC,IAAI,UAAU,CAC3K,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,yBAAyB,OAAO,wFAAwF;YAC1H,CAAC,CAAC,kEAAkE,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,oEAAoE;IACpE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC,CAAC,mCAAmC;IACxE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,EAAE,KAAK,IAAI,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,UAAU,eAAe;IAC7B,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,qBAAqB,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC,CAAC,mCAAmC;IAC5E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,EAAE,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,OAAyB;IAEzB,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,yBAAyB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC,CAAC,mCAAmC;IACxE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/src/lib/credentials-store.d.ts

@@ -1,6 +1,10 @@
 /**
  * Credentials storage with dual-mode support.
  *
+ * Credentials are tokens and who they belong to, and nothing else: the app an
+ * invocation runs against is the resolved environment's `appId` (#3152), never
+ * a slot in this file.
+ *
  * Mode A (project mode): credentials live at
  *   <projectRoot>/.primitive/credentials.json
  * with per-environment slots:
@@ -11,30 +15,58 @@
  *     }
  *   }
  *
- * Mode B (legacy mode): no .primitive/config.json in scope, so we fall back to
+ * Mode B (global mode): no primitive/config.json in scope, so we fall back to
  *   ~/.primitive/credentials.json
  * with the flat Credentials shape the CLI has always used.
  *
- * The legacy mode is still the "global default" for users who haven't
- * run `primitive init` yet.
+ * Mode B is NOT a default any more (#3154, intent criterion 5). It used to be
+ * the silent answer for every command run outside a project, which is how an
+ * app-scoped command could quietly operate against whatever server the last
+ * `login` happened to target. Now a command has to say out loud that it may
+ * work outside a project, by calling `allowGlobalCredentials()` in its own
+ * action; every other command gets `missing-config` here instead of a file.
+ *
+ * Exactly four commands say it: `login`, which creates the file; `logout`,
+ * which is the only way to clear what login wrote; `init`, which must call the
+ * API before a project can exist; and `bootstrap`, which creates the first
+ * super-admin on an empty no-OAuth database and therefore cannot be inside a
+ * project either. The last two are the divergence from the intent's "login and
+ * init and nothing else", adjudicated on #3154 as finding F1.
+ *
+ * The opt-in is per ACTION, not per argv: `primitive --env prod login` and
+ * `primitive login` reach the same line, so there is no flag shape for a
+ * pre-parse to miss. And it only PERMITS the global file — inside a project
+ * all four still use the per-environment slots.
  */
 import type { Credentials } from "../types/index.js";
 export declare const PROJECT_LOCAL_DIR = ".primitive";
 export declare const PROJECT_CREDENTIALS_FILENAME = "credentials.json";
-/** Returns true when a .primitive/config.json is in scope (project mode active). */
+/** Returns true when a primitive/config.json is in scope (project mode active). */
 export declare function isProjectMode(): boolean;
 /**
  * Returns the path to the credentials file that will be used, based on
  * whether we're in project mode or legacy mode.
  */
 export declare function getCredentialsFilePath(): string;
+/**
+ * Declare that THIS command may fall back to `~/.primitive/credentials.json`
+ * when no project is in scope. Called at the top of `login`, `logout`, `init`
+ * and `bootstrap`, and nowhere else.
+ */
+export declare function allowGlobalCredentials(): void;
+/**
+ * Drop the declaration again. One invocation runs one command, so nothing in
+ * the CLI calls this — it exists so a test file can exercise both sides of the
+ * boundary in one process, the way `resetEnvResolver()` does for the resolver.
+ */
+export declare function resetGlobalCredentialsAllowance(): void;
 /**
  * Reads credentials for the current environment (project mode) or the
  * legacy global file. Returns the standard Credentials shape so existing
  * callers don't need to change.
  *
  * In project mode, we blend the per-env stored creds with the serverUrl
- * and appId from .primitive/config.json to produce the Credentials the rest of
+ * and appId from primitive/config.json to produce the Credentials the rest of
  * the CLI expects.
  */
 export declare function loadCredentialsStore(): Credentials | null;
@@ -63,9 +95,6 @@ export declare function clearCredentialsForEnvInProject(projectRoot: string, env
  * project's credentials file. Used by `primitive init` to carry the session
  * it just authenticated into the freshly scaffolded project, so the first
  * in-project CLI command works without a second `primitive login`.
- *
- * Does not persist currentAppId/Name — the project's .primitive/config.json
- * is the source of truth for those (same rule as saveCredentialsStore).
  */
 export declare function seedCredentialsForEnvInProject(projectRoot: string, envName: string, credentials: Credentials): void;
 /**
@@ -73,17 +102,3 @@ export declare function seedCredentialsForEnvInProject(projectRoot: string, envN
  * Returns an empty array in legacy mode.
  */
 export declare function listAuthenticatedEnvironments(): string[];
-/**
- * Updates the "current app" in credential storage. In project mode with a
- * project-level appId this is a no-op (the project config is canonical).
- */
-export declare function setCurrentAppStore(appId: string, appName?: string): void;
-/**
- * Clears the "current app" for the current environment.
- */
-export declare function clearCurrentAppStore(): void;
-/**
- * Returns the legacy credentials file, if one exists. Used by migration
- * prompts that want to detect a pre-project-config install.
- */
-export declare function peekLegacyCredentials(): Credentials | null;