primitive-admin 1.1.0-alpha.3 → 1.1.0-alpha.31

package/dist/src/lib/refresh-admin-credentials.js

@@ -0,0 +1,103 @@
+/**
+ * Shared helper for refreshing the admin access token via the CLI auth API.
+ *
+ * Why this module exists:
+ *
+ *   - `ApiClient.refreshToken()` already POSTs to /admin/api/auth/refresh
+ *     before every API call when the access token is near expiry.
+ *   - `primitive token` (issue #772) now needs the same exchange so it can
+ *     auto-refresh a stale token before printing it.
+ *   - `primitive login --token-stdin` does the same POST a third time to
+ *     bootstrap credentials from a refresh token piped from another CLI.
+ *
+ * Putting the HTTP exchange + response parsing in one place keeps the
+ * response-shape contract in a single spot (server returns both `jwt` and
+ * `accessToken` — see `src/index.ts:2349-2356`) and means future server
+ * changes to that endpoint require touching exactly one CLI file.
+ *
+ * Design notes:
+ *
+ *   - This module **does not** depend on `api-client.ts`. `ApiClient` imports
+ *     it, not the other way around — that prevents the avoidable module cycle
+ *     codex flagged in the design review.
+ *   - It defines its own `RefreshError` so callers can map failures to
+ *     whatever error type (or exit code) makes sense for their surface.
+ *     `ApiClient` translates these to `ApiError`; the `token` command
+ *     translates them to an `error()` + `process.exit(1)`.
+ *   - It **does not save** the refreshed credentials. The caller decides
+ *     whether to persist (the `token` command does; `ApiClient.refreshToken`
+ *     does). Keeping persistence caller-owned matches the existing
+ *     "storage is owned by `credentials-store.ts`" convention.
+ *   - It **does not print anything**. Output (success/failure messaging) is
+ *     the caller's responsibility — important because the `token` command
+ *     must keep stdout clean for piping.
+ */
+import { fetchWithTLS } from "./fetch.js";
+export class RefreshError extends Error {
+    kind;
+    statusCode;
+    cause;
+    constructor(message, kind, statusCode, cause) {
+        super(message);
+        this.kind = kind;
+        this.statusCode = statusCode;
+        this.cause = cause;
+        this.name = "RefreshError";
+    }
+}
+/**
+ * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
+ * `Credentials` object — the caller is responsible for persistence via
+ * `saveCredentials()` (or whatever storage the caller owns).
+ *
+ * Server contract: `POST {serverUrl}/admin/api/auth/refresh` with
+ *   { refreshToken: string }
+ * Response (200):
+ *   { jwt, accessToken, refreshToken, expiresAt }
+ *
+ * We accept `accessToken` as the canonical field and fall back to `jwt` for
+ * forward-compat (the server currently emits both — see issue #772 codex
+ * cleanup #3). Login's legacy `data.token` form is dropped — no server
+ * version that's still in support emits that field.
+ */
+export async function refreshAdminCredentials(credentials) {
+    if (!credentials.refreshToken) {
+        throw new RefreshError("No refresh token available. Please login again.", "missing-refresh-token");
+    }
+    const url = `${credentials.serverUrl}/admin/api/auth/refresh`;
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (credentials.globalAdminAppId) {
+        headers["X-Global-Admin-App-Id"] = credentials.globalAdminAppId;
+    }
+    let response;
+    try {
+        response = await fetchWithTLS(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ refreshToken: credentials.refreshToken }),
+        });
+    }
+    catch (cause) {
+        const reason = cause instanceof Error && cause.message
+            ? cause.message
+            : String(cause);
+        throw new RefreshError(`Network error refreshing token: ${reason}.`, "network", undefined, cause);
+    }
+    if (!response.ok) {
+        throw new RefreshError("Refresh token expired. Run 'primitive login'.", "unauthorized", response.status);
+    }
+    const data = (await response.json());
+    const accessToken = data?.accessToken || data?.jwt;
+    if (!accessToken) {
+        throw new RefreshError("Refresh response did not include an access token. Run 'primitive login'.", "unauthorized", response.status);
+    }
+    return {
+        ...credentials,
+        accessToken,
+        refreshToken: data.refreshToken || credentials.refreshToken,
+        expiresAt: data.expiresAt || new Date(Date.now() + 3600 * 1000).toISOString(),
+    };
+}
+//# sourceMappingURL=refresh-admin-credentials.js.map

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAJT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,+CAA+C,EAC/C,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/skill-installer.js

@@ -0,0 +1,135 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from "fs";
+import { readFile } from "fs/promises";
+import { createHash } from "crypto";
+import { homedir } from "os";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import chalk from "chalk";
+const CLAUDE_DIR = join(homedir(), ".claude");
+const SKILLS_DIR = join(CLAUDE_DIR, "skills");
+const SKILL_DIR = join(SKILLS_DIR, "primitive-platform");
+const SKILL_FILE = join(SKILL_DIR, "SKILL.md");
+const HASH_FILE = join(SKILL_DIR, ".version");
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function getBundledSkillPath() {
+    // In dist: dist/src/lib/skill-installer.js -> ../../../assets/...
+    // In source (tsx): src/lib/skill-installer.ts -> ../../assets/...
+    const distPath = fileURLToPath(new URL("../../../assets/skill/skills/primitive-platform/SKILL.md", import.meta.url));
+    if (existsSync(distPath))
+        return distPath;
+    return fileURLToPath(new URL("../../assets/skill/skills/primitive-platform/SKILL.md", import.meta.url));
+}
+function computeHash(content) {
+    return createHash("sha256").update(content).digest("hex").slice(0, 12);
+}
+function getInstalledHash() {
+    try {
+        if (!existsSync(HASH_FILE))
+            return null;
+        return readFileSync(HASH_FILE, "utf-8").trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Returns true if the skill is currently installed.
+ */
+export function isSkillInstalled() {
+    return getInstalledHash() !== null;
+}
+/**
+ * Auto-update an already-installed skill if a newer version is bundled.
+ * Called after command execution for non-init, non-skill commands.
+ * If the skill is not installed, shows a non-blocking hint instead.
+ * Never throws — fails silently like version-check.
+ */
+export async function checkSkillStatus() {
+    try {
+        const bundledPath = getBundledSkillPath();
+        if (!existsSync(bundledPath))
+            return;
+        if (!existsSync(CLAUDE_DIR))
+            return;
+        const bundledContent = await readFile(bundledPath, "utf-8");
+        const bundledHash = computeHash(bundledContent);
+        const installedHash = getInstalledHash();
+        if (installedHash) {
+            // Already installed — silently auto-update if needed
+            if (installedHash === bundledHash)
+                return;
+            mkdirSync(SKILL_DIR, { recursive: true });
+            writeFileSync(SKILL_FILE, bundledContent);
+            writeFileSync(HASH_FILE, bundledHash);
+            console.log(chalk.dim("Updated Primitive platform skill for Claude Code"));
+        }
+        else {
+            // Not installed — show a non-blocking hint
+            console.log(chalk.dim(`Claude Code skill available — run ${chalk.cyan("primitive skill install")} to set up`));
+        }
+    }
+    catch {
+        // Never let skill check affect CLI operation
+    }
+}
+/**
+ * Explicitly install or reinstall the skill. Shows output.
+ */
+export function installSkillExplicit() {
+    const bundledPath = getBundledSkillPath();
+    if (!existsSync(bundledPath)) {
+        console.error(chalk.red("Skill assets not found. Reinstall the CLI."));
+        return false;
+    }
+    if (!existsSync(CLAUDE_DIR)) {
+        console.error(chalk.red("Claude Code not found (~/.claude does not exist)."));
+        console.error(chalk.dim("Install Claude Code first: https://claude.ai/code"));
+        return false;
+    }
+    const bundledContent = readFileSync(bundledPath, "utf-8");
+    const bundledHash = computeHash(bundledContent);
+    mkdirSync(SKILL_DIR, { recursive: true });
+    writeFileSync(SKILL_FILE, bundledContent);
+    writeFileSync(HASH_FILE, bundledHash);
+    console.log(chalk.green("Primitive platform skill installed for Claude Code."));
+    console.log(chalk.dim(`Location: ${SKILL_FILE}`));
+    console.log(chalk.dim(`Version: ${bundledHash}`));
+    return true;
+}
+/**
+ * Uninstall the skill.
+ */
+export function uninstallSkill() {
+    if (!existsSync(SKILL_DIR)) {
+        console.log(chalk.dim("Skill is not installed."));
+        return true;
+    }
+    rmSync(SKILL_DIR, { recursive: true });
+    console.log(chalk.green("Primitive platform skill uninstalled."));
+    return true;
+}
+/**
+ * Show current skill installation status.
+ */
+export function skillStatus() {
+    const installedHash = getInstalledHash();
+    const bundledPath = getBundledSkillPath();
+    const bundledHash = existsSync(bundledPath)
+        ? computeHash(readFileSync(bundledPath, "utf-8"))
+        : null;
+    if (!installedHash) {
+        console.log(chalk.yellow("Skill is not installed."));
+    }
+    else {
+        console.log(chalk.green("Skill is installed."));
+        console.log(chalk.dim(`  Location: ${SKILL_FILE}`));
+        console.log(chalk.dim(`  Version:  ${installedHash}`));
+    }
+    if (bundledHash) {
+        console.log(chalk.dim(`  Bundled:  ${bundledHash}`));
+        if (installedHash && installedHash !== bundledHash) {
+            console.log(chalk.yellow("  Update available — run: primitive skill install"));
+        }
+    }
+}
+//# sourceMappingURL=skill-installer.js.map

package/dist/src/lib/skill-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.js","sourceRoot":"","sources":["../../../src/lib/skill-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,SAAS,mBAAmB;IAC1B,kEAAkE;IAClE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,0DAA0D,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrH,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,uDAAuD,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QAEzC,IAAI,aAAa,EAAE,CAAC;YAClB,qDAAqD;YACrD,IAAI,aAAa,KAAK,WAAW;gBAAE,OAAO;YAC1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,2CAA2C;YAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAEhD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC1C,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QACzC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,aAAa,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/lib/sync-paths.js

@@ -0,0 +1,102 @@
+/**
+ * Sync data path resolution.
+ *
+ * Per issue #373, sync state is scoped by environment AND by app:
+ *
+ *   <projectRoot>/.primitive/sync/<env>/<appId>/
+ *
+ * This ensures that switching environments (dev -> prod) or apps never
+ * clobbers sync state from another slot. Push to dev and then to prod
+ * see independent "last synced" pointers, so prod won't falsely believe
+ * dev's changes are already in sync.
+ *
+ * When the user still passes `--dir <path>` (the legacy flag) we honor
+ * it and store sync state inside that directory, same as before. This
+ * keeps pre-project-config workflows working.
+ */
+import { existsSync, mkdirSync } from "fs";
+import { join } from "path";
+import { getCurrentEnvironment } from "./env-resolver.js";
+/**
+ * Returns the directory that should hold TOML files + sync state for the
+ * current sync operation.
+ *
+ * Resolution order:
+ *   1. If userDir is set, return it as-is (legacy behavior).
+ *   2. If we're in project mode, return
+ *      <projectRoot>/.primitive/sync/<env>/<appId>
+ *   3. Otherwise fall back to "./config" (the old default).
+ */
+export function resolveSyncDir(options) {
+    if (options.userDir)
+        return options.userDir;
+    const env = safeEnv();
+    if (env) {
+        // Defence-in-depth: appId is expected to be a ULID from the server, but
+        // we must never trust it blindly when building file-system paths. Reject
+        // anything that contains path separators or `..` sequences before
+        // joining it into <projectRoot>/.primitive/sync/...
+        assertSafePathComponent(options.appId, "appId");
+        return join(env.projectRoot, ".primitive", "sync", env.name, options.appId);
+    }
+    return "./config";
+}
+function assertSafePathComponent(value, label) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        /[\\/]/.test(value) ||
+        value.includes("..") ||
+        value === "." ||
+        value === "") {
+        throw new Error(`Invalid ${label} for file path: ${value}`);
+    }
+}
+/**
+ * Returns true if the path we'd use for sync data is the auto-resolved
+ * project-mode path (vs. a user-supplied --dir).
+ */
+export function isAutoResolvedSyncDir(userDir) {
+    if (userDir)
+        return false;
+    return safeEnv() !== null;
+}
+/**
+ * Ensures the sync directory exists, creating it (and parents) if
+ * necessary. Returns the path.
+ */
+export function ensureSyncDir(options) {
+    const dir = resolveSyncDir(options);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    return dir;
+}
+function safeEnv() {
+    try {
+        return getCurrentEnvironment();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Checks whether an old-style sync state file exists at `./config/.primitive-sync.json`
+ * (the pre-project-config default path). Returns a warning message if found and
+ * the current operation is using a different (project-mode) path, or null otherwise.
+ *
+ * Callers can display this once at the start of sync commands so users know
+ * their old sync data won't be picked up automatically.
+ */
+export function checkLegacySyncMigration(currentSyncDir) {
+    const legacySync = join(".", "config", ".primitive-sync.json");
+    if (!existsSync(legacySync))
+        return null;
+    // Only warn if the resolved dir is different from the legacy default.
+    const legacyDir = join(".", "config");
+    if (currentSyncDir === legacyDir)
+        return null;
+    return (`Detected old sync state at ./config/.primitive-sync.json. ` +
+        `Sync data now lives at ${currentSyncDir}. ` +
+        `Run 'primitive sync pull' to re-sync into the new location.`);
+}
+//# sourceMappingURL=sync-paths.js.map

package/dist/src/lib/sync-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-paths.js","sourceRoot":"","sources":["../../../src/lib/sync-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAY1D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAE5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,wEAAwE;QACxE,yEAAyE;QACzE,kEAAkE;QAClE,oDAAoD;QACpD,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAI,CACT,GAAG,CAAC,WAAW,EACf,YAAY,EACZ,MAAM,EACN,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAC3D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA2B;IAC/D,IAAI,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAA8B;IAC1D,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,cAAsB;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CACL,4DAA4D;QAC5D,0BAA0B,cAAc,IAAI;QAC5C,6DAA6D,CAC9D,CAAC;AACJ,CAAC"}