primitive-admin 1.0.63 → 1.0.64

package/dist/src/lib/refresh-admin-credentials.js

@@ -37,14 +37,22 @@ export class RefreshError extends Error {
     kind;
     statusCode;
     cause;
-    constructor(message, kind, statusCode, cause) {
+    code;
+    constructor(message, kind, statusCode, cause, 
+    /** The server's machine-readable `code`, when it sent one. */
+    code) {
         super(message);
         this.kind = kind;
         this.statusCode = statusCode;
         this.cause = cause;
+        this.code = code;
         this.name = "RefreshError";
     }
 }
+/** The refresh token's session was revoked (logout or `auth sessions revoke`). */
+export const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
+/** Any other refused refresh. */
+export const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
 /**
  * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
  * `Credentials` object — the caller is responsible for persistence via
@@ -86,7 +94,19 @@ export async function refreshAdminCredentials(credentials) {
         throw new RefreshError(`Network error refreshing token: ${reason}.`, "network", undefined, cause);
     }
     if (!response.ok) {
-        throw new RefreshError("Refresh token expired. Run 'primitive login'.", "unauthorized", response.status);
+        // #3885: a refresh of a revoked session answers 401 with code
+        // SESSION_REVOKED; say so, rather than calling the token expired.
+        let code;
+        try {
+            const body = (await response.json());
+            code = typeof body?.code === "string" ? body.code : undefined;
+        }
+        catch {
+            // Not JSON: no code to report.
+        }
+        throw new RefreshError(code === "SESSION_REVOKED"
+            ? SESSION_REVOKED_MESSAGE
+            : REFRESH_EXPIRED_MESSAGE, "unauthorized", response.status, undefined, code);
     }
     const data = (await response.json());
     const accessToken = data?.accessToken || data?.jwt;

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAJT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,+CAA+C,EAC/C,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAEA;IANT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;IACtB,8DAA8D;IACvD,IAAa;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kDAAkD,CAAC;AAErD,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+CAA+C,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;YAC5C,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,uBAAuB,EAC3B,cAAc,EACd,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/resolve-owner.d.ts

@@ -0,0 +1,19 @@
+/**
+ * One email → userId resolution for every `--owner` flag the CLI carries.
+ *
+ * It lived inside `commands/documents.ts` from #2763 until #3641 gave
+ * `collections create` the same flag. Two copies of a lookup would be two
+ * chances to reintroduce the failure #2763 removed — the old admin-only list
+ * wrapper flattened every error, including a 403, into "no such user" — so it
+ * moved here whole rather than being written a second time.
+ */
+import { ApiClient } from "./api-client.js";
+/**
+ * Resolve a `--owner` value to a userId. A value containing "@" is looked up
+ * by exact email through the member-accessible `users/lookup` endpoint
+ * (issue #2763); anything else is already a user id and is passed through.
+ * Failures throw with the server's own message — a permission problem must
+ * not read as "no such user", which is how the old admin-only lookup
+ * reported it.
+ */
+export declare function resolveOwnerUserId(client: ApiClient, appId: string, owner: string): Promise<string>;

package/dist/src/lib/resolve-owner.js

@@ -0,0 +1,20 @@
+import { info } from "./output.js";
+/**
+ * Resolve a `--owner` value to a userId. A value containing "@" is looked up
+ * by exact email through the member-accessible `users/lookup` endpoint
+ * (issue #2763); anything else is already a user id and is passed through.
+ * Failures throw with the server's own message — a permission problem must
+ * not read as "no such user", which is how the old admin-only lookup
+ * reported it.
+ */
+export async function resolveOwnerUserId(client, appId, owner) {
+    if (!owner.includes("@"))
+        return owner;
+    const lookup = await client.lookupUserByEmail(appId, owner);
+    if (!lookup?.exists || !lookup.user) {
+        throw new Error(`No app user found with email "${owner}" in app ${appId}.`);
+    }
+    info(`Resolved owner email to userId: ${lookup.user.userId}`);
+    return lookup.user.userId;
+}
+//# sourceMappingURL=resolve-owner.js.map

package/dist/src/lib/resolve-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-owner.js","sourceRoot":"","sources":["../../../src/lib/resolve-owner.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAiB,EACjB,KAAa,EACb,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC5B,CAAC"}

package/dist/src/lib/skill-installer.d.ts

@@ -1,7 +1,38 @@
+/**
+ * Skills for Primitive-Labs members only. Not bundled with the CLI — fetched
+ * from the private js-bao-wss repo via `gh`, so repo access is the gate.
+ *
+ * Each entry lists every file the installed skill needs, as (repo path,
+ * path inside the installed skill directory). A skill is installed
+ * all-or-nothing: one missing file and the existing copy is kept.
+ */
+interface FetchedFile {
+    /** Path inside Primitive-Labs/js-bao-wss (main branch). */
+    repoPath: string;
+    /** Path relative to the installed skill directory. */
+    localPath: string;
+}
+interface FetchedSkill {
+    name: string;
+    files: FetchedFile[];
+}
+export declare const FETCHED_SKILLS: FetchedSkill[];
+export declare function getCliVersion(): string | null;
 /**
  * Returns true if the skill is currently installed.
  */
 export declare function isSkillInstalled(): boolean;
+/**
+ * Read one file of the private js-bao-wss repo (main branch) via the GitHub
+ * contents API through `gh`. Returns null if gh is missing, unauthenticated,
+ * or the caller lacks access to the repo — access failure is how non-members
+ * are gated.
+ *
+ * `PRIMITIVE_SKILL_SOURCE_DIR` reads the same repo paths from a local
+ * checkout instead, to try a skill edit before it is merged (and for the
+ * unit tests, which install from this repo's own files).
+ */
+export declare function fetchRepoFile(repoPath: string): Promise<string | null>;
 /**
  * Auto-update an already-installed skill if a newer version is bundled.
  * Called after command execution for non-init, non-skill commands.
@@ -11,15 +42,30 @@ export declare function isSkillInstalled(): boolean;
 export declare function checkSkillStatus(): Promise<void>;
 /**
  * Explicitly install or reinstall the skill. Shows output.
- * Also installs the internal skill when the caller has access to the
- * private repo (Primitive-Labs members); silently skipped otherwise.
+ * Also installs the members' skills (primitive-platform-internal and
+ * file-issue) when the caller has access to the private repo
+ * (Primitive-Labs members); silently skipped otherwise.
  */
 export declare function installSkillExplicit(): Promise<boolean>;
 /**
- * Uninstall the skill (and the internal skill, if present).
+ * Uninstall the skill (and the members' skills, if present).
  */
 export declare function uninstallSkill(): boolean;
+export interface SkillStatusReport {
+    installedHash: string | null;
+    bundledHash: string | null;
+    location: string;
+    /** One entry per members' skill: hash and the CLI version that fetched it, or null when not installed. */
+    fetched: Record<string, {
+        hash: string;
+        cliVersion: string;
+        location: string;
+    } | null>;
+}
+/** The data `skillStatus()` prints; exported so tests can read it directly. */
+export declare function getSkillStatus(): SkillStatusReport;
 /**
  * Show current skill installation status.
  */
 export declare function skillStatus(): void;
+export {};