primitive-admin 1.1.0-alpha.4 → 1.1.0-alpha.41

package/dist/src/lib/config.js

@@ -1,46 +1,29 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-// Allow override via environment variable for testing
-const CONFIG_DIR = process.env.PRIMITIVE_CONFIG_DIR || join(homedir(), ".primitive");
-const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
-function ensureConfigDir() {
-    if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
-}
+/**
+ * Thin compatibility shim over the new project-scoped config system.
+ *
+ * Historically the CLI had one global credentials file at
+ * ~/.primitive/credentials.json and a handful of helpers here. After the
+ * project-config overhaul (issue #373) credentials live per-environment
+ * inside `<projectRoot>/.primitive/credentials.json` when a
+ * .primitive/config.json is in scope, and fall back to the legacy global
+ * file otherwise.
+ *
+ * The rest of the CLI continues to import from this module, so we keep
+ * the original public API (loadCredentials, saveCredentials, etc.) and
+ * just delegate to the new stores.
+ */
+import { clearCredentialsStore, clearCurrentAppStore, loadCredentialsStore, peekLegacyCredentials, saveCredentialsStore, setCurrentAppStore, } from "./credentials-store.js";
+import { getCurrentEnvironment, getCurrentEnvNameSafe, } from "./env-resolver.js";
+import { PROJECT_CONFIG_DISPLAY_NAME } from "./project-config.js";
+import { DEFAULT_SERVER_URL } from "./constants.js";
 export function loadCredentials() {
-    try {
-        if (!existsSync(CREDENTIALS_FILE)) {
-            return null;
-        }
-        const data = readFileSync(CREDENTIALS_FILE, "utf-8");
-        return JSON.parse(data);
-    }
-    catch {
-        return null;
-    }
+    return loadCredentialsStore();
 }
 export function saveCredentials(credentials) {
-    ensureConfigDir();
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2), {
-        mode: 0o600,
-    });
-    // Ensure file permissions are secure
-    chmodSync(CREDENTIALS_FILE, 0o600);
+    saveCredentialsStore(credentials);
 }
 export function clearCredentials() {
-    try {
-        if (existsSync(CREDENTIALS_FILE)) {
-            writeFileSync(CREDENTIALS_FILE, "", { mode: 0o600 });
-            // Actually remove the file
-            const { unlinkSync } = require("fs");
-            unlinkSync(CREDENTIALS_FILE);
-        }
-    }
-    catch {
-        // Ignore errors
-    }
+    clearCredentialsStore();
 }
 export function isTokenExpired(credentials) {
     if (!credentials.expiresAt)
@@ -59,40 +42,96 @@ export function isTokenExpiringSoon(credentials) {
     return expiresAt - now < 5 * 60 * 1000;
 }
 export function setCurrentApp(appId, appName) {
-    const credentials = loadCredentials();
-    if (!credentials) {
-        throw new Error("Not logged in. Run 'primitive login' first.");
-    }
-    credentials.currentAppId = appId;
-    credentials.currentAppName = appName;
-    saveCredentials(credentials);
+    setCurrentAppStore(appId, appName);
 }
 export function clearCurrentApp() {
-    const credentials = loadCredentials();
-    if (!credentials) {
-        return;
-    }
-    delete credentials.currentAppId;
-    delete credentials.currentAppName;
-    saveCredentials(credentials);
+    clearCurrentAppStore();
 }
 export function getCurrentAppId() {
+    // In project mode, the appId may come from .primitive/config.json (via
+    // loadCredentialsStore), which is what we want. In legacy mode it comes
+    // from the global credentials file.
     const credentials = loadCredentials();
     return credentials?.currentAppId;
 }
 export function resolveAppId(appId, options) {
     const resolved = appId || options.app || getCurrentAppId();
     if (!resolved) {
-        console.error("No app specified. Use <app-id>, --app, or 'primitive use <app-id>' to set context.");
+        // When the active env declares an `appId` in .primitive/config.json but
+        // has no credentials slot, loadCredentialsStore() returns null (its
+        // null == unauthenticated contract), so getCurrentAppId() yields nothing
+        // even though an appId IS configured. In that case the accurate problem
+        // is that the user isn't authenticated for this env — not that no app was
+        // specified. (A creds slot would have blended in env.config.appId and made
+        // `resolved` truthy, so reaching here with a configured appId can only mean
+        // missing credentials.)
+        let env = null;
+        try {
+            env = getCurrentEnvironment();
+        }
+        catch {
+            // Env resolution failed (ambiguous/unknown env) — fall back to the
+            // original "No app specified." message below.
+        }
+        if (env && env.config.appId) {
+            console.error(`Not logged in to environment "${env.name}". An appId is configured in ${PROJECT_CONFIG_DISPLAY_NAME} but you're not authenticated. Run 'primitive -e ${env.name} login'.`);
+            process.exit(1);
+        }
+        const envName = getCurrentEnvNameSafe();
+        const hint = envName
+            ? `(current environment: ${envName}). Set 'appId' in .primitive/config.json, pass --app, or run 'primitive use <app-id>'.`
+            : `Use <app-id>, --app, or 'primitive use <app-id>' to set context.`;
+        console.error(`No app specified. ${hint}`);
         process.exit(1);
     }
     return resolved;
 }
+/**
+ * Returns the API base URL for the active environment (project mode) or
+ * the serverUrl saved in the legacy credentials file.
+ */
 export function getServerUrl() {
+    // Project mode takes priority — the project config is the source of
+    // truth for the API URL, even if we haven't logged in yet.
+    try {
+        const env = getCurrentEnvironment();
+        if (env)
+            return env.config.apiUrl;
+    }
+    catch (err) {
+        // Env resolution failed — fall through to credentials-based lookup.
+    }
     const credentials = loadCredentials();
     if (!credentials?.serverUrl) {
         throw new Error("Not logged in. Run 'primitive login' first.");
     }
     return credentials.serverUrl;
 }
+/**
+ * Resolves the API base URL to authenticate against, used by `primitive login`
+ * (issue #1343).
+ *
+ * Unlike getServerUrl(), this must work *before* any credentials exist (first
+ * login), so it never falls back to the stored credentials' serverUrl:
+ *
+ *   - Project mode → the active environment's `apiUrl` (canonical). Lets
+ *     getCurrentEnvironment() throw on an unresolvable env (ambiguous/unknown
+ *     --env) so the caller can fail loudly instead of silently targeting prod.
+ *   - Legacy mode (no .primitive/config.json) → DEFAULT_SERVER_URL, which
+ *     honors the PRIMITIVE_SERVER_URL escape hatch (constants.ts).
+ *
+ * The trailing slash is stripped so callers can build `${url}/admin/api/...`.
+ */
+export function getConfiguredServerUrl() {
+    const env = getCurrentEnvironment(); // may throw on an unresolvable env
+    return (env ? env.config.apiUrl : DEFAULT_SERVER_URL).replace(/\/$/, "");
+}
+/**
+ * Exposed so commands can check whether there's a pre-project-config
+ * credentials file at ~/.primitive/credentials.json (used by migration
+ * prompts).
+ */
+export function legacyCredentialsExist() {
+    return peekLegacyCredentials() !== null;
+}
 //# sourceMappingURL=config.js.map

package/dist/src/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,sDAAsD;AACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAE9D,SAAS,eAAe;IACtB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,eAAe,EAAE,CAAC;IAClB,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,qCAAqC;IACrC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,aAAa,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,2BAA2B;YAC3B,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,WAAW,CAAC,YAAY,GAAG,KAAK,CAAC;IACjC,WAAW,CAAC,cAAc,GAAG,OAAO,CAAC;IACrC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,OAAO,WAAW,CAAC,YAAY,CAAC;IAChC,OAAO,WAAW,CAAC,cAAc,CAAC;IAClC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,OAAO,WAAW,EAAE,YAAY,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAyB,EAAE,OAAyB;IAC/E,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,UAAU,eAAe;IAC7B,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,qBAAqB,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAgB;IAC3D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,uEAAuE;IACvE,wEAAwE;IACxE,oCAAoC;IACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,OAAO,WAAW,EAAE,YAAY,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,OAAyB;IAEzB,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,GAAG,GAA6C,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,8CAA8C;QAChD,CAAC;QACD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,iCAAiC,GAAG,CAAC,IAAI,gCAAgC,2BAA2B,oDAAoD,GAAG,CAAC,IAAI,UAAU,CAC3K,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,yBAAyB,OAAO,wFAAwF;YAC1H,CAAC,CAAC,kEAAkE,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,oEAAoE;IACpE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC,CAAC,mCAAmC;IACxE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,qBAAqB,EAAE,KAAK,IAAI,CAAC;AAC1C,CAAC"}

package/dist/src/lib/confirm-prompt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export declare class ConfirmPromptError extends Error {
+    constructor(message: string);
+}
+/**
+ * Shape of the `@inquirer/prompts` `confirm()` function. Injectable for testing.
+ *
+ * Note (#999): this shifted from the legacy inquirer questions-array →
+ * `{ confirm: boolean }` shape to the modern bare `{ message, default }` →
+ * `Promise<boolean>` shape.
+ */
+export type PromptFn = (config: {
+    message: string;
+    default?: boolean;
+}) => Promise<boolean>;
+export interface ConfirmPromptOptions {
+    /** Default answer when the user just presses enter. Defaults to false. */
+    defaultValue?: boolean;
+    /**
+     * Override the underlying prompt function (for tests). Defaults to lazily
+     * importing `@inquirer/prompts` `confirm`.
+     */
+    promptFn?: PromptFn;
+    /**
+     * Override TTY detection (for tests). Defaults to `process.stdin.isTTY`.
+     */
+    isTTY?: boolean;
+}
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export declare function confirmPrompt(message: string, options?: ConfirmPromptOptions): Promise<boolean>;

package/dist/src/lib/confirm-prompt.js

@@ -0,0 +1,110 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export class ConfirmPromptError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfirmPromptError";
+    }
+}
+async function defaultPromptFn(config) {
+    const { confirm } = await import("@inquirer/prompts");
+    return confirm(config);
+}
+/**
+ * Names of the catchable abort errors thrown by `@inquirer/prompts` when the
+ * user interrupts a prompt (Ctrl-C / SIGINT / force-close / abort signal /
+ * cancel). We match on `name` (not just `instanceof`) so detection is robust to
+ * the error class being duplicated across module realms.
+ */
+const ABORT_ERROR_NAMES = new Set([
+    "ExitPromptError",
+    "AbortPromptError",
+    "CancelPromptError",
+]);
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export async function confirmPrompt(message, options = {}) {
+    const isTTY = options.isTTY ?? Boolean(process.stdin.isTTY);
+    if (!isTTY) {
+        throw new ConfirmPromptError("No interactive terminal available to confirm this action. " +
+            "Re-run with --yes (-y) to skip the confirmation prompt in " +
+            "non-interactive contexts (CI, pipes, agents).");
+    }
+    const promptFn = options.promptFn ?? defaultPromptFn;
+    try {
+        const confirmed = await promptFn({
+            message,
+            default: options.defaultValue ?? false,
+        });
+        return Boolean(confirmed);
+    }
+    catch (err) {
+        // A deliberate abort/EOF/Ctrl-C/Ctrl-D — either the modern
+        // `@inquirer/prompts` `ExitPromptError`/`AbortPromptError`/`CancelPromptError`
+        // (matched by name to survive cross-realm `instanceof` mismatches), or the
+        // legacy inquirer `ERR_USE_AFTER_CLOSE`. Surface as a clean, actionable
+        // error so the caller exits 1 with no stack trace / bare `Node.js vX` banner.
+        if (ABORT_ERROR_NAMES.has(err?.name) ||
+            err?.code === "ERR_USE_AFTER_CLOSE") {
+            throw new ConfirmPromptError("Confirmation cancelled (no interactive input). " +
+                "Re-run with --yes (-y) to skip confirmation.");
+        }
+        // Any other prompt failure: still surface it as a clean, catchable error
+        // rather than letting it escape as an uncaught crash.
+        throw new ConfirmPromptError(err?.message
+            ? `Confirmation prompt failed: ${err.message}`
+            : "Confirmation prompt failed.");
+    }
+}
+//# sourceMappingURL=confirm-prompt.js.map

package/dist/src/lib/confirm-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-prompt.js","sourceRoot":"","sources":["../../../src/lib/confirm-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AA4BD,KAAK,UAAU,eAAe,CAAC,MAG9B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAC1B,4DAA4D;YAC1D,4DAA4D;YAC5D,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC;YAC/B,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2DAA2D;QAC3D,+EAA+E;QAC/E,2EAA2E;QAC3E,wEAAwE;QACxE,8EAA8E;QAC9E,IACE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;YAChC,GAAG,EAAE,IAAI,KAAK,qBAAqB,EACnC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,iDAAiD;gBAC/C,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EAAE,OAAO;YACV,CAAC,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE;YAC9C,CAAC,CAAC,6BAA6B,CAClC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/lib/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export declare const DEFAULT_SERVER_URL: string;

package/dist/src/lib/constants.js

@@ -0,0 +1,3 @@
+export const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export const DEFAULT_SERVER_URL = process.env.PRIMITIVE_SERVER_URL || PRODUCTION_SERVER_URL;
+//# sourceMappingURL=constants.js.map

package/dist/src/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,qBAAqB,CAAC"}

package/dist/src/lib/crash-handlers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export declare function installGlobalCrashHandlers(): void;

package/dist/src/lib/crash-handlers.js

@@ -0,0 +1,49 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+import { error } from "./output.js";
+function describe(err) {
+    if (err && typeof err === "object") {
+        const e = err;
+        // The signature crash from a non-TTY confirm prompt — give actionable help.
+        if (e.code === "ERR_USE_AFTER_CLOSE") {
+            return ("No interactive terminal available to confirm this action. " +
+                "Re-run with --yes (-y) to skip the confirmation prompt in " +
+                "non-interactive contexts (CI, pipes, agents).");
+        }
+        if (e.message)
+            return e.message;
+    }
+    return "An unexpected error occurred.";
+}
+let installed = false;
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export function installGlobalCrashHandlers() {
+    if (installed)
+        return;
+    installed = true;
+    process.on("uncaughtException", (err) => {
+        error(describe(err));
+        process.exit(1);
+    });
+    process.on("unhandledRejection", (reason) => {
+        error(describe(reason));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=crash-handlers.js.map

package/dist/src/lib/crash-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-handlers.js","sourceRoot":"","sources":["../../../src/lib/crash-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAA0C,CAAC;QACrD,4EAA4E;QAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACrC,OAAO,CACL,4DAA4D;gBAC5D,4DAA4D;gBAC5D,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/lib/credentials-store.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Credentials storage with dual-mode support.
+ *
+ * Mode A (project mode): credentials live at
+ *   <projectRoot>/.primitive/credentials.json
+ * with per-environment slots:
+ *   {
+ *     "environments": {
+ *       "dev":  { "accessToken": "...", "refreshToken": "...", ... },
+ *       "prod": { ... }
+ *     }
+ *   }
+ *
+ * Mode B (legacy mode): no .primitive/config.json in scope, so we fall back to
+ *   ~/.primitive/credentials.json
+ * with the flat Credentials shape the CLI has always used.
+ *
+ * The legacy mode is still the "global default" for users who haven't
+ * run `primitive init` yet.
+ */
+import type { Credentials } from "../types/index.js";
+export declare const PROJECT_LOCAL_DIR = ".primitive";
+export declare const PROJECT_CREDENTIALS_FILENAME = "credentials.json";
+/** Returns true when a .primitive/config.json is in scope (project mode active). */
+export declare function isProjectMode(): boolean;
+/**
+ * Returns the path to the credentials file that will be used, based on
+ * whether we're in project mode or legacy mode.
+ */
+export declare function getCredentialsFilePath(): string;
+/**
+ * Reads credentials for the current environment (project mode) or the
+ * legacy global file. Returns the standard Credentials shape so existing
+ * callers don't need to change.
+ *
+ * In project mode, we blend the per-env stored creds with the serverUrl
+ * and appId from .primitive/config.json to produce the Credentials the rest of
+ * the CLI expects.
+ */
+export declare function loadCredentialsStore(): Credentials | null;
+/**
+ * Saves credentials. In project mode, writes to the per-env slot in the
+ * project credentials file. In legacy mode, writes the global file.
+ *
+ * The serverUrl on the incoming Credentials is used as-is for legacy
+ * mode, and ignored in project mode (the env's apiUrl is canonical).
+ */
+export declare function saveCredentialsStore(credentials: Credentials): void;
+/**
+ * Clears credentials for the current environment (project mode) or
+ * deletes the legacy file (legacy mode).
+ */
+export declare function clearCredentialsStore(): void;
+/**
+ * Removes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `env remove` so stale tokens from a
+ * previously-removed environment can never be silently re-used if the same
+ * name is later added back. Never throws.
+ */
+export declare function clearCredentialsForEnvInProject(projectRoot: string, envName: string): void;
+/**
+ * Lists all environments that have stored credentials in project mode.
+ * Returns an empty array in legacy mode.
+ */
+export declare function listAuthenticatedEnvironments(): string[];
+/**
+ * Updates the "current app" in credential storage. In project mode with a
+ * project-level appId this is a no-op (the project config is canonical).
+ */
+export declare function setCurrentAppStore(appId: string, appName?: string): void;
+/**
+ * Clears the "current app" for the current environment.
+ */
+export declare function clearCurrentAppStore(): void;
+/**
+ * Returns the legacy credentials file, if one exists. Used by migration
+ * prompts that want to detect a pre-project-config install.
+ */
+export declare function peekLegacyCredentials(): Credentials | null;