primitive-admin 1.1.0-alpha.4 → 1.1.0-alpha.40

package/dist/src/lib/generated-allowlist.d.ts

@@ -0,0 +1,28 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the server step runners in `src/workflows/steps/*.ts` and
+ * the universal `BaseStepDefinition` shape in
+ * `src/workflows/runner/types.ts`.
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-allowlist.mjs       (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-allowlist.mjs --check`, also asserted
+ * by `cli/tests/unit/workflow-toml-validator-drift-guard.test.ts`) fails if this
+ * committed artifact does not match a fresh scan — see issue #998.
+ *
+ * Two exports:
+ *   - `GENERATED_ALLOWLISTED_FIELDS` — the union of universal step fields,
+ *     per-kind fields each runner READS (not what the type declares), and the
+ *     `collect` `step` structural pass-through. The validator accepts these as
+ *     top-level step fields for KNOWN kinds.
+ *   - `GENERATED_KNOWN_KINDS` — the step kinds the server registers. The
+ *     validator skips the per-field check for an UNKNOWN kind (an old CLI
+ *     against a newer server) while still running the kind-agnostic
+ *     misnested-header footgun detector (#685).
+ */
+/** Top-level step fields the validator accepts for a known kind (#998). */
+export declare const GENERATED_ALLOWLISTED_FIELDS: readonly string[];
+/** Step kinds the server registers (`defaultRegistry`). Unknown kinds skip the per-field check (#998). */
+export declare const GENERATED_KNOWN_KINDS: readonly string[];

package/dist/src/lib/generated-allowlist.js

@@ -0,0 +1,213 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the server step runners in `src/workflows/steps/*.ts` and
+ * the universal `BaseStepDefinition` shape in
+ * `src/workflows/runner/types.ts`.
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-allowlist.mjs       (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-allowlist.mjs --check`, also asserted
+ * by `cli/tests/unit/workflow-toml-validator-drift-guard.test.ts`) fails if this
+ * committed artifact does not match a fresh scan — see issue #998.
+ *
+ * Two exports:
+ *   - `GENERATED_ALLOWLISTED_FIELDS` — the union of universal step fields,
+ *     per-kind fields each runner READS (not what the type declares), and the
+ *     `collect` `step` structural pass-through. The validator accepts these as
+ *     top-level step fields for KNOWN kinds.
+ *   - `GENERATED_KNOWN_KINDS` — the step kinds the server registers. The
+ *     validator skips the per-field check for an UNKNOWN kind (an old CLI
+ *     against a newer server) while still running the kind-agnostic
+ *     misnested-header footgun detector (#685).
+ */
+/** Top-level step fields the validator accepts for a known kind (#998). */
+export const GENERATED_ALLOWLISTED_FIELDS = [
+    "_testInputSchema",
+    "_testSteps",
+    "action",
+    "aliasKey",
+    "appId",
+    "as",
+    "asBase64",
+    "attachments",
+    "blobId",
+    "blockKey",
+    "blockType",
+    "bodyMode",
+    "bucketId",
+    "bucketKey",
+    "cacheTtlSeconds",
+    "cases",
+    "collectionId",
+    "concurrency",
+    "configId",
+    "content",
+    "contentBase64",
+    "contentType",
+    "context",
+    "continueOnError",
+    "create",
+    "cursor",
+    "cursorField",
+    "data",
+    "databaseId",
+    "default",
+    "description",
+    "direction",
+    "documentAlias",
+    "documentId",
+    "dryRun",
+    "durationMs",
+    "email",
+    "events",
+    "expiresInSeconds",
+    "feature",
+    "filename",
+    "filter",
+    "filters",
+    "forEach",
+    "forward",
+    "groupBy",
+    "groupId",
+    "groupType",
+    "htmlBody",
+    "id",
+    "includeRoot",
+    "includeUserDetails",
+    "input",
+    "integrationKey",
+    "itemsField",
+    "iterationName",
+    "kind",
+    "limit",
+    "limits",
+    "maxItems",
+    "maxPages",
+    "message",
+    "messages",
+    "metrics",
+    "model",
+    "modelName",
+    "modelOverride",
+    "ms",
+    "multipartFields",
+    "name",
+    "onConflict",
+    "onPartialFailure",
+    "operationName",
+    "options",
+    "output",
+    "ownerOnly",
+    "page",
+    "pageSize",
+    "params",
+    "payload",
+    "perUser",
+    "permission",
+    "plugins",
+    "prompt",
+    "promptKey",
+    "query",
+    "queryType",
+    "recordId",
+    "ref",
+    "request",
+    "route",
+    "runIf",
+    "saveAs",
+    "schema",
+    "scope",
+    "selector",
+    "skipWhenSkipped",
+    "sort",
+    "source",
+    "step",
+    "strict",
+    "strictParams",
+    "subject",
+    "successWhen",
+    "systemBypass",
+    "tag",
+    "tags",
+    "temperature",
+    "templateType",
+    "textBody",
+    "thinkingLevel",
+    "timeout",
+    "title",
+    "to",
+    "toUserId",
+    "tool_choice",
+    "tools",
+    "top_p",
+    "type",
+    "user",
+    "userId",
+    "userUlid",
+    "variables",
+    "version",
+    "windowDays",
+    "with",
+    "workflowKey",
+];
+/** Step kinds the server registers (`defaultRegistry`). Unknown kinds skip the per-field check (#998). */
+export const GENERATED_KNOWN_KINDS = [
+    "analytics.query",
+    "analytics.write",
+    "analytics.writeForUser",
+    "blob.download",
+    "blob.signedUrl",
+    "blob.upload",
+    "block.call",
+    "collect",
+    "create",
+    "database.aggregate",
+    "database.applyToQuery",
+    "database.count",
+    "database.mutate",
+    "database.pipeline",
+    "database.query",
+    "database.syncIndexes",
+    "delay",
+    "document.count",
+    "document.delete",
+    "document.getForUser",
+    "document.getOrCreateWithAliasForUser",
+    "document.getRootForUser",
+    "document.listForCollection",
+    "document.listForGroup",
+    "document.listForUser",
+    "document.patch",
+    "document.query",
+    "document.queryOne",
+    "document.resolveAlias",
+    "document.resolveAliasForUser",
+    "document.save",
+    "email.send",
+    "event.wait",
+    "gemini.countTokens",
+    "gemini.generate",
+    "gemini.generateRaw",
+    "group.addMember",
+    "group.checkMembership",
+    "group.listMembers",
+    "group.listUserMemberships",
+    "group.removeAll",
+    "group.removeMember",
+    "hash",
+    "integration.call",
+    "iterate-users",
+    "llm.chat",
+    "noop",
+    "prompt.execute",
+    "render",
+    "script",
+    "switch",
+    "transform",
+    "user.get",
+    "user.resolve",
+    "workflow.call",
+];
+//# sourceMappingURL=generated-allowlist.js.map

package/dist/src/lib/generated-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-allowlist.js","sourceRoot":"","sources":["../../../src/lib/generated-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kBAAkB;IAClB,YAAY;IACZ,QAAQ;IACR,UAAU;IACV,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,cAAc;IACd,aAAa;IACb,UAAU;IACV,SAAS;IACT,eAAe;IACf,aAAa;IACb,SAAS;IACT,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,MAAM;IACN,YAAY;IACZ,SAAS;IACT,aAAa;IACb,WAAW;IACX,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,WAAW;IACX,UAAU;IACV,IAAI;IACJ,aAAa;IACb,oBAAoB;IACpB,OAAO;IACP,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;IACT,OAAO;IACP,WAAW;IACX,eAAe;IACf,IAAI;IACJ,iBAAiB;IACjB,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,SAAS;IACT,QAAQ;IACR,WAAW;IACX,MAAM;IACN,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,KAAK;IACL,SAAS;IACT,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,iBAAiB;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,cAAc;IACd,SAAS;IACT,aAAa;IACb,cAAc;IACd,KAAK;IACL,MAAM;IACN,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IACf,SAAS;IACT,OAAO;IACP,IAAI;IACJ,UAAU;IACV,aAAa;IACb,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,WAAW;IACX,SAAS;IACT,YAAY;IACZ,MAAM;IACN,aAAa;CACd,CAAC;AAEF,0GAA0G;AAC1G,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,iBAAiB;IACjB,iBAAiB;IACjB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,oBAAoB;IACpB,uBAAuB;IACvB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,OAAO;IACP,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,sCAAsC;IACtC,yBAAyB;IACzB,4BAA4B;IAC5B,uBAAuB;IACvB,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,8BAA8B;IAC9B,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,mBAAmB;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,oBAAoB;IACpB,MAAM;IACN,kBAAkB;IAClB,eAAe;IACf,UAAU;IACV,MAAM;IACN,gBAAgB;IAChB,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,eAAe;CAChB,CAAC"}

package/dist/src/lib/init-config.d.ts

@@ -0,0 +1,59 @@
+export declare const INIT_CONFIG_FILENAME = ".primitive-init.toml";
+export interface InitConfig {
+    /** Whether to create a new app or use an existing one */
+    action: "create" | "use-existing";
+    /** App name (required for action = "create") */
+    app_name?: string;
+    /** Existing app ID (required for action = "use-existing") */
+    app_id?: string;
+    /** Project directory name */
+    dir?: string;
+    /** Access mode for the app */
+    access_mode?: "public" | "domain" | "invite-only";
+    /** Port for local dev server */
+    dev_port?: number;
+    /** Whether to skip npm install */
+    skip_install?: boolean;
+    /** Custom server URL */
+    server?: string;
+    /** Email addresses to invite (for invite-only mode) */
+    invite_emails?: string[];
+    /** Allowed email domains (for domain mode) */
+    allowed_domains?: string[];
+    /** Whether to overwrite a non-empty target directory (default: false) */
+    overwrite?: boolean;
+    /** Target platform for the scaffolded app */
+    platform?: "web" | "ios";
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Resolves the "use an existing app" app id from the two places it can be
+ * specified: the `--use-existing-app-id` CLI flag (highest precedence) or an
+ * init-config TOML with `action = "use-existing"` + `app_id`.
+ *
+ * Before this existed, `init` only read the flag, so a `use-existing` TOML fell
+ * through to the create-app branch and interactively prompted for an app name —
+ * hanging non-interactive (`--config`) runs. (See js-bao-wss #1217.)
+ *
+ * Returns `undefined` when neither source selects an existing app (i.e. the run
+ * should create a new app).
+ */
+export declare function resolveUseExistingAppId(flag: string | undefined, initConfig: InitConfig | null): string | undefined;
+/**
+ * Parses a TOML string into an InitConfig object.
+ * Throws if the string contains invalid TOML.
+ */
+export declare function parseInitConfigToml(content: string): InitConfig;
+/**
+ * Loads and parses a .primitive-init.toml file from the given directory.
+ * Returns null if the file does not exist.
+ * Throws if the file exists but contains invalid TOML.
+ */
+export declare function loadInitConfig(dir: string): InitConfig | null;
+/**
+ * Validates an InitConfig object. Returns a ValidationResult with any errors.
+ */
+export declare function validateInitConfig(config: InitConfig): ValidationResult;

package/dist/src/lib/init-config.js

@@ -0,0 +1,113 @@
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import * as TOML from "@iarna/toml";
+export const INIT_CONFIG_FILENAME = ".primitive-init.toml";
+/**
+ * Resolves the "use an existing app" app id from the two places it can be
+ * specified: the `--use-existing-app-id` CLI flag (highest precedence) or an
+ * init-config TOML with `action = "use-existing"` + `app_id`.
+ *
+ * Before this existed, `init` only read the flag, so a `use-existing` TOML fell
+ * through to the create-app branch and interactively prompted for an app name —
+ * hanging non-interactive (`--config`) runs. (See js-bao-wss #1217.)
+ *
+ * Returns `undefined` when neither source selects an existing app (i.e. the run
+ * should create a new app).
+ */
+export function resolveUseExistingAppId(flag, initConfig) {
+    if (flag)
+        return flag;
+    if (initConfig?.action === "use-existing")
+        return initConfig.app_id;
+    return undefined;
+}
+/**
+ * Parses a TOML string into an InitConfig object.
+ * Throws if the string contains invalid TOML.
+ */
+export function parseInitConfigToml(content) {
+    const parsed = TOML.parse(content);
+    // The cast is safe because validateInitConfig() is always called after parsing
+    return parsed;
+}
+/**
+ * Loads and parses a .primitive-init.toml file from the given directory.
+ * Returns null if the file does not exist.
+ * Throws if the file exists but contains invalid TOML.
+ */
+export function loadInitConfig(dir) {
+    const configPath = join(dir, INIT_CONFIG_FILENAME);
+    if (!existsSync(configPath)) {
+        return null;
+    }
+    const content = readFileSync(configPath, "utf-8");
+    return parseInitConfigToml(content);
+}
+/**
+ * Validates an InitConfig object. Returns a ValidationResult with any errors.
+ */
+export function validateInitConfig(config) {
+    const errors = [];
+    // action is required
+    if (!config.action) {
+        errors.push('Missing required field: "action" (must be "create" or "use-existing")');
+    }
+    else if (config.action !== "create" && config.action !== "use-existing") {
+        errors.push('"action" must be "create" or "use-existing"');
+    }
+    else {
+        // Validate action-specific required fields
+        if (config.action === "create" && !config.app_name) {
+            errors.push('"app_name" is required when action is "create"');
+        }
+        if (config.action === "use-existing" && !config.app_id) {
+            errors.push('"app_id" is required when action is "use-existing"');
+        }
+    }
+    // Validate access_mode if provided
+    if (config.access_mode) {
+        const validModes = ["public", "domain", "invite-only"];
+        if (!validModes.includes(config.access_mode)) {
+            errors.push('"access_mode" must be "public", "domain", or "invite-only"');
+        }
+        else if (config.access_mode === "domain" && (!config.allowed_domains || config.allowed_domains.length === 0)) {
+            errors.push('"allowed_domains" is required when access_mode is "domain"');
+        }
+    }
+    // Validate platform if provided. Only "web" and "ios" are supported
+    // (`macos` is intentionally rejected until the macOS template is ready).
+    if (config.platform !== undefined) {
+        if (config.platform !== "web" && config.platform !== "ios") {
+            errors.push('"platform" must be "web" or "ios"');
+        }
+    }
+    // Validate dev_port if provided
+    if (config.dev_port !== undefined) {
+        if (typeof config.dev_port !== "number" || !Number.isInteger(config.dev_port) || config.dev_port < 1 || config.dev_port > 65535) {
+            errors.push('"dev_port" must be an integer between 1 and 65535');
+        }
+    }
+    // Validate invite_emails format if provided
+    if (config.invite_emails && Array.isArray(config.invite_emails)) {
+        for (const email of config.invite_emails) {
+            if (!email.includes("@")) {
+                errors.push(`Invalid email in invite_emails: "${email}"`);
+            }
+        }
+    }
+    // Warn about fields ignored for use-existing action
+    if (config.action === "use-existing") {
+        const ignoredFields = [];
+        if (config.access_mode)
+            ignoredFields.push("access_mode");
+        if (config.invite_emails && config.invite_emails.length > 0)
+            ignoredFields.push("invite_emails");
+        if (config.allowed_domains && config.allowed_domains.length > 0)
+            ignoredFields.push("allowed_domains");
+        if (ignoredFields.length > 0) {
+            errors.push(`The following fields are ignored when action is "use-existing": ${ignoredFields.join(", ")}. Remove them to avoid confusion.`);
+        }
+    }
+    return { valid: errors.length === 0, errors };
+}
+//# sourceMappingURL=init-config.js.map

package/dist/src/lib/init-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-config.js","sourceRoot":"","sources":["../../../src/lib/init-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAkC3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAwB,EACxB,UAA6B;IAE7B,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,UAAU,EAAE,MAAM,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,+EAA+E;IAC/E,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,2CAA2C;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,yEAAyE;IACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC;YAChI,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,WAAW;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mEAAmE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/src/lib/migration-nag.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Legacy-mode migration nag.
+ *
+ * Prints a one-time, opt-out, rate-limited startup warning that points
+ * users still on the legacy `~/.primitive/credentials.json` config at the
+ * project-scoped `primitive env add` migration path. The warning is purely
+ * informational — it never mutates anything other than the small
+ * `~/.primitive/migration-nag.json` cache used for the 24h rate-limit.
+ *
+ * Detection signal (warn iff ALL of):
+ *   1. `peekLegacyCredentials()` is non-null (legacy creds file present).
+ *   2. `findProjectConfigPath()` is null (no project config in scope).
+ *   3. `./config/.primitive-sync.json` exists in CWD (strong signal the
+ *      user has actually run `primitive sync` here — the population at
+ *      risk from #548).
+ *
+ * Suppression (skip if ANY of):
+ *   - `PRIMITIVE_NO_MIGRATE_NAG=1`
+ *   - `CI` env var set (non-empty)
+ *   - `!process.stdout.isTTY`
+ *   - argv contains `--help` / `-h` / `--version` / `-V` / `--json`
+ *   - Subcommand is `env *`, `init`, `login`, `logout`, or `token`
+ *   - `now - lastWarnedAt < 24h`
+ *
+ * Modeled on `cli/src/lib/version-check.ts`: the whole body is wrapped
+ * in try/catch that swallows every error so a corrupt cache file or any
+ * other unexpected failure can never break the CLI.
+ *
+ * TODO(#auto-migration): When we ship an interactive auto-migration flow
+ * (separate issue from #552), it should either delete this nag cache or
+ * bump `lastWarnedAt` far into the future so freshly-migrated users
+ * don't see the nag again. The cache lives at `${PRIMITIVE_CONFIG_DIR ||
+ * ~/.primitive}/migration-nag.json`.
+ */
+export interface MaybeWarnLegacyMigrationOptions {
+    argv: string[];
+    /**
+     * Override the working directory used for project-shape detection and
+     * the upward `.primitive/config.json` search. Defaults to
+     * `process.cwd()`. Exists so unit tests (which run in worker threads
+     * that disallow `process.chdir()`) can point at a tmpdir.
+     */
+    cwd?: string;
+}
+/**
+ * Print the legacy-mode migration nag if the detection signal matches
+ * and no suppression condition applies. Never throws.
+ */
+export declare function maybeWarnLegacyMigration(options: MaybeWarnLegacyMigrationOptions): void;

package/dist/src/lib/migration-nag.js

@@ -0,0 +1,163 @@
+/**
+ * Legacy-mode migration nag.
+ *
+ * Prints a one-time, opt-out, rate-limited startup warning that points
+ * users still on the legacy `~/.primitive/credentials.json` config at the
+ * project-scoped `primitive env add` migration path. The warning is purely
+ * informational — it never mutates anything other than the small
+ * `~/.primitive/migration-nag.json` cache used for the 24h rate-limit.
+ *
+ * Detection signal (warn iff ALL of):
+ *   1. `peekLegacyCredentials()` is non-null (legacy creds file present).
+ *   2. `findProjectConfigPath()` is null (no project config in scope).
+ *   3. `./config/.primitive-sync.json` exists in CWD (strong signal the
+ *      user has actually run `primitive sync` here — the population at
+ *      risk from #548).
+ *
+ * Suppression (skip if ANY of):
+ *   - `PRIMITIVE_NO_MIGRATE_NAG=1`
+ *   - `CI` env var set (non-empty)
+ *   - `!process.stdout.isTTY`
+ *   - argv contains `--help` / `-h` / `--version` / `-V` / `--json`
+ *   - Subcommand is `env *`, `init`, `login`, `logout`, or `token`
+ *   - `now - lastWarnedAt < 24h`
+ *
+ * Modeled on `cli/src/lib/version-check.ts`: the whole body is wrapped
+ * in try/catch that swallows every error so a corrupt cache file or any
+ * other unexpected failure can never break the CLI.
+ *
+ * TODO(#auto-migration): When we ship an interactive auto-migration flow
+ * (separate issue from #552), it should either delete this nag cache or
+ * bump `lastWarnedAt` far into the future so freshly-migrated users
+ * don't see the nag again. The cache lives at `${PRIMITIVE_CONFIG_DIR ||
+ * ~/.primitive}/migration-nag.json`.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { warn } from "./output.js";
+import { peekLegacyCredentials } from "./credentials-store.js";
+import { findProjectConfigPath } from "./project-config.js";
+const NAG_INTERVAL_MS = 24 * 60 * 60 * 1000;
+/** Resolved per-call so tests can override PRIMITIVE_CONFIG_DIR at runtime. */
+function getConfigDir() {
+    return process.env.PRIMITIVE_CONFIG_DIR || join(homedir(), ".primitive");
+}
+function getNagCacheFile() {
+    return join(getConfigDir(), "migration-nag.json");
+}
+function ensureConfigDir() {
+    const dir = getConfigDir();
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function loadNagCache() {
+    try {
+        const file = getNagCacheFile();
+        if (!existsSync(file))
+            return null;
+        const raw = JSON.parse(readFileSync(file, "utf-8"));
+        if (!raw || typeof raw !== "object")
+            return null;
+        if (typeof raw.lastWarnedAt !== "number")
+            return null;
+        return { lastWarnedAt: raw.lastWarnedAt };
+    }
+    catch {
+        return null;
+    }
+}
+function saveNagCache(cache) {
+    try {
+        ensureConfigDir();
+        writeFileSync(getNagCacheFile(), JSON.stringify(cache, null, 2));
+    }
+    catch {
+        // Swallow — at worst the user gets re-nagged next invocation.
+    }
+}
+/**
+ * Returns true if `argv` indicates the warning should be skipped:
+ *   - any of `--help` / `-h` / `--version` / `-V` / `--json` present, OR
+ *   - the subcommand is on the migration path (`env *`, `init`, `login`,
+ *     `logout`), OR
+ *   - the subcommand is `token`. The `token` command is contractually
+ *     stdout-only (callers pipe its output to `--access-token` or paste it
+ *     into env vars), so any extra warning lines would corrupt that output.
+ *
+ * `argv` is expected to be the same shape as `process.argv` (i.e. the
+ * subcommand sits at index 2, after `node` and the script path). Defensive
+ * about short or unusual argv shapes.
+ */
+function shouldSuppressByArgv(argv) {
+    for (const a of argv) {
+        if (a === "--help" || a === "-h" || a === "--version" || a === "-V" || a === "--json") {
+            return true;
+        }
+    }
+    const subcommand = argv[2];
+    if (subcommand === "env" ||
+        subcommand === "init" ||
+        subcommand === "login" ||
+        subcommand === "logout" ||
+        subcommand === "token") {
+        return true;
+    }
+    return false;
+}
+/**
+ * Returns true when `cwd` looks like a project that has actually been
+ * used with `primitive sync` — specifically, when
+ * `<cwd>/config/.primitive-sync.json` exists. Per F4 of the approved
+ * plan, this is the only project-shape signal we use; we deliberately
+ * do not fall back to `package.json` or `.git` to avoid nagging users
+ * who run the CLI for read-only commands from incidental project
+ * directories.
+ */
+function isProjectShaped(cwd) {
+    try {
+        return existsSync(join(cwd, "config", ".primitive-sync.json"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Print the legacy-mode migration nag if the detection signal matches
+ * and no suppression condition applies. Never throws.
+ */
+export function maybeWarnLegacyMigration(options) {
+    try {
+        // --- Fast suppression checks (no disk I/O) ---------------------------
+        if (process.env.PRIMITIVE_NO_MIGRATE_NAG === "1")
+            return;
+        if (process.env.CI)
+            return;
+        if (!process.stdout.isTTY)
+            return;
+        if (shouldSuppressByArgv(options.argv))
+            return;
+        const cwd = options.cwd ?? process.cwd();
+        // --- Detection signal -------------------------------------------------
+        if (!isProjectShaped(cwd))
+            return;
+        if (findProjectConfigPath(cwd) !== null)
+            return;
+        if (peekLegacyCredentials() === null)
+            return;
+        // --- Rate-limit -------------------------------------------------------
+        const cache = loadNagCache();
+        const now = Date.now();
+        if (cache && now - cache.lastWarnedAt < NAG_INTERVAL_MS)
+            return;
+        // --- Print --------------------------------------------------------------
+        warn("Legacy CLI config detected at ~/.primitive/credentials.json.");
+        warn("Run `primitive env add <name> --api-url <url> --app-id <appId>` to upgrade to project-scoped config (see issue #548 for why). Set PRIMITIVE_NO_MIGRATE_NAG=1 to silence.");
+        saveNagCache({ lastWarnedAt: now });
+    }
+    catch {
+        // Never let nag errors affect CLI operation — mirrors version-check.ts.
+    }
+}
+//# sourceMappingURL=migration-nag.js.map

package/dist/src/lib/migration-nag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-nag.js","sourceRoot":"","sources":["../../../src/lib/migration-nag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAM5C,+EAA+E;AAC/E,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAe;IACnC,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,aAAa,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,IAAc;IAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IACE,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,QAAQ;QACvB,UAAU,KAAK,OAAO,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAC/E,IAAI,CAAC;QACH,wEAAwE;QACxE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG;YAAE,OAAO;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO;QAClC,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEzC,yEAAyE;QACzE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO;QAChD,IAAI,qBAAqB,EAAE,KAAK,IAAI;YAAE,OAAO;QAE7C,yEAAyE;QACzE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,eAAe;YAAE,OAAO;QAEhE,2EAA2E;QAC3E,IAAI,CAAC,8DAA8D,CAAC,CAAC;QACrE,IAAI,CACF,0KAA0K,CAC3K,CAAC;QAEF,YAAY,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;AACH,CAAC"}