primitive-admin 1.1.0-alpha.4 → 1.1.0-alpha.41

package/dist/src/lib/project-config.js

@@ -0,0 +1,209 @@
+/**
+ * Project-scoped configuration (.primitive/config.json).
+ *
+ * This module handles loading, validating, and saving the project config file
+ * that lives inside the .primitive/ directory at the project root. The config
+ * defines named environments (dev, prod, staging, etc.) with their API URLs
+ * and app IDs.
+ *
+ * Design:
+ *   - Config file: .primitive/config.json (or any ancestor directory)
+ *   - The .primitive/ directory groups the committable config and the
+ *     gitignored local state (credentials, sync data) in one place.
+ *   - Format: JSON
+ *   - Schema is versioned (currently 1). Future versions use semver-ish
+ *     caret range compatibility: we accept any config where major version
+ *     matches CURRENT_CONFIG_VERSION.
+ *   - Invalid configs throw — we do NOT silently ignore malformed files.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+/**
+ * Current schema version. Increment the major version when making
+ * backward-incompatible changes. Older configs will be rejected.
+ */
+export const CURRENT_CONFIG_VERSION = 1;
+/**
+ * The config file lives inside the .primitive/ directory, not at the
+ * project root. This keeps the project root clean and groups all
+ * Primitive state (config, credentials, sync data) under one directory.
+ */
+export const PROJECT_CONFIG_DIR = ".primitive";
+export const PROJECT_CONFIG_FILENAME = "config.json";
+/** Display name used in user-facing messages. */
+export const PROJECT_CONFIG_DISPLAY_NAME = ".primitive/config.json";
+export class ProjectConfigError extends Error {
+    path;
+    constructor(message, path) {
+        super(message);
+        this.path = path;
+        this.name = "ProjectConfigError";
+    }
+}
+/**
+ * Walks upward from `startDir` looking for a `.primitive/config.json` file.
+ * Returns the absolute path to the config file, or null if not found.
+ *
+ * Allows running `primitive` commands from subdirectories of a project,
+ * much like `git` walks up to find `.git`.
+ */
+export function findProjectConfigPath(startDir = process.cwd()) {
+    // Allow override via env var for testing / unusual setups.
+    if (process.env.PRIMITIVE_PROJECT_CONFIG) {
+        const forced = resolve(process.env.PRIMITIVE_PROJECT_CONFIG);
+        return existsSync(forced) ? forced : null;
+    }
+    let current = resolve(startDir);
+    // Walk up until we hit filesystem root.
+    while (true) {
+        const candidate = join(current, PROJECT_CONFIG_DIR, PROJECT_CONFIG_FILENAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+/**
+ * Returns the project root directory (the parent of .primitive/ that contains
+ * .primitive/config.json), or null if no project config is found.
+ *
+ * When the PRIMITIVE_PROJECT_CONFIG env var override is active, the config
+ * file may not live inside a `.primitive/` directory (e.g. in tests), so
+ * we simply go up one level from the file.
+ */
+export function findProjectRoot(startDir = process.cwd()) {
+    const path = findProjectConfigPath(startDir);
+    if (!path)
+        return null;
+    // When using the env var override, the file could be anywhere — just go
+    // up one level. In the normal case the path ends with .primitive/config.json
+    // so dirname(dirname(path)) gives the project root.
+    if (process.env.PRIMITIVE_PROJECT_CONFIG) {
+        return dirname(path);
+    }
+    return dirname(dirname(path));
+}
+/**
+ * Validates a raw parsed object against the ProjectConfig schema.
+ * Throws ProjectConfigError with a helpful message on any problem.
+ */
+export function validateProjectConfig(raw, sourcePath) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new ProjectConfigError(`${PROJECT_CONFIG_DISPLAY_NAME} must contain a JSON object at the top level.`, sourcePath);
+    }
+    const obj = raw;
+    // Version is required.
+    if (typeof obj.version !== "number" || !Number.isInteger(obj.version)) {
+        throw new ProjectConfigError(`${PROJECT_CONFIG_DISPLAY_NAME} is missing required integer field "version".`, sourcePath);
+    }
+    const version = obj.version;
+    // Caret-range compatibility: accept any config whose major version matches.
+    // For version 1.x this is simply version === 1; when we ship v2 we'll
+    // reject v1 configs and tell the user to migrate.
+    if (version !== CURRENT_CONFIG_VERSION) {
+        if (version > CURRENT_CONFIG_VERSION) {
+            throw new ProjectConfigError(`${PROJECT_CONFIG_DISPLAY_NAME} has version ${version}, but this CLI only understands version ${CURRENT_CONFIG_VERSION}. Please upgrade the CLI: npm install -g primitive-admin`, sourcePath);
+        }
+        throw new ProjectConfigError(`${PROJECT_CONFIG_DISPLAY_NAME} has unsupported version ${version}. This CLI expects version ${CURRENT_CONFIG_VERSION}.`, sourcePath);
+    }
+    // environments is required.
+    if (!obj.environments || typeof obj.environments !== "object" || Array.isArray(obj.environments)) {
+        throw new ProjectConfigError(`${PROJECT_CONFIG_DISPLAY_NAME} is missing required "environments" object.`, sourcePath);
+    }
+    const environments = {};
+    for (const [name, envRaw] of Object.entries(obj.environments)) {
+        if (!name.match(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/)) {
+            throw new ProjectConfigError(`Invalid environment name "${name}" in ${PROJECT_CONFIG_DISPLAY_NAME}. Names must be alphanumeric with optional dashes/underscores.`, sourcePath);
+        }
+        if (!envRaw || typeof envRaw !== "object" || Array.isArray(envRaw)) {
+            throw new ProjectConfigError(`Environment "${name}" must be an object in ${PROJECT_CONFIG_DISPLAY_NAME}.`, sourcePath);
+        }
+        const envObj = envRaw;
+        if (typeof envObj.apiUrl !== "string" || !envObj.apiUrl) {
+            throw new ProjectConfigError(`Environment "${name}" must have a non-empty "apiUrl" string in ${PROJECT_CONFIG_DISPLAY_NAME}.`, sourcePath);
+        }
+        try {
+            new URL(envObj.apiUrl);
+        }
+        catch {
+            throw new ProjectConfigError(`Environment "${name}" has invalid apiUrl: ${envObj.apiUrl}`, sourcePath);
+        }
+        if (envObj.appId !== undefined && typeof envObj.appId !== "string") {
+            throw new ProjectConfigError(`Environment "${name}": "appId" must be a string if set.`, sourcePath);
+        }
+        if (envObj.appName !== undefined && typeof envObj.appName !== "string") {
+            throw new ProjectConfigError(`Environment "${name}": "appName" must be a string if set.`, sourcePath);
+        }
+        if (envObj.description !== undefined && typeof envObj.description !== "string") {
+            throw new ProjectConfigError(`Environment "${name}": "description" must be a string if set.`, sourcePath);
+        }
+        environments[name] = {
+            apiUrl: envObj.apiUrl.replace(/\/$/, ""),
+            appId: envObj.appId,
+            appName: envObj.appName,
+            description: envObj.description,
+        };
+    }
+    // defaultEnvironment is optional but must refer to a real environment.
+    let defaultEnvironment;
+    if (obj.defaultEnvironment !== undefined) {
+        if (typeof obj.defaultEnvironment !== "string") {
+            throw new ProjectConfigError(`"defaultEnvironment" must be a string if set.`, sourcePath);
+        }
+        if (obj.defaultEnvironment && !environments[obj.defaultEnvironment]) {
+            throw new ProjectConfigError(`"defaultEnvironment" is set to "${obj.defaultEnvironment}" but no such environment is defined.`, sourcePath);
+        }
+        defaultEnvironment = obj.defaultEnvironment || undefined;
+    }
+    return { version, defaultEnvironment, environments };
+}
+/**
+ * Loads and validates the project config from a specific file path.
+ * Throws ProjectConfigError on I/O errors, JSON parse errors, or schema
+ * validation failures — we deliberately do NOT swallow these, because a
+ * broken config should be noisy so the user can fix it.
+ */
+export function loadProjectConfigFromPath(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf-8");
+    }
+    catch (err) {
+        throw new ProjectConfigError(`Failed to read ${PROJECT_CONFIG_DISPLAY_NAME}: ${err.message}`, path);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new ProjectConfigError(`Failed to parse ${PROJECT_CONFIG_DISPLAY_NAME}: ${err.message}`, path);
+    }
+    return validateProjectConfig(parsed, path);
+}
+/**
+ * Loads the project config by searching upward from the current directory.
+ * Returns null (not an error) if no .primitive/config.json is found anywhere.
+ * Still throws ProjectConfigError if a config IS found but is invalid.
+ */
+export function loadProjectConfig(startDir = process.cwd()) {
+    const path = findProjectConfigPath(startDir);
+    if (!path)
+        return null;
+    return loadProjectConfigFromPath(path);
+}
+/**
+ * Writes a project config to disk as pretty-printed JSON. Callers are
+ * responsible for ensuring the parent directory exists — this function
+ * does not try to be clever about location.
+ */
+export function saveProjectConfig(path, config) {
+    const dir = dirname(path);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const serialized = JSON.stringify(config, null, 2) + "\n";
+    writeFileSync(path, serialized);
+}
+//# sourceMappingURL=project-config.js.map

package/dist/src/lib/project-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config.js","sourceRoot":"","sources":["../../../src/lib/project-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,iDAAiD;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAwBpE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACE;IAA7C,YAAY,OAAe,EAAkB,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,SAAI,GAAJ,IAAI,CAAS;QAExD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IACpE,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,wCAAwC;IACxC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,wEAAwE;IACxE,6EAA6E;IAC7E,oDAAoD;IACpD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,UAAmB;IACrE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,kBAAkB,CAC1B,GAAG,2BAA2B,+CAA+C,EAC7E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,uBAAuB;IACvB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAC1B,GAAG,2BAA2B,+CAA+C,EAC7E,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAE5B,4EAA4E;IAC5E,sEAAsE;IACtE,kDAAkD;IAClD,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAC1B,GAAG,2BAA2B,gBAAgB,OAAO,2CAA2C,sBAAsB,0DAA0D,EAChL,UAAU,CACX,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,2BAA2B,4BAA4B,OAAO,8BAA8B,sBAAsB,GAAG,EACxH,UAAU,CACX,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,kBAAkB,CAC1B,GAAG,2BAA2B,6CAA6C,EAC3E,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAuC,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAuC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,IAAI,QAAQ,2BAA2B,gEAAgE,EACpI,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,0BAA0B,2BAA2B,GAAG,EAC5E,UAAU,CACX,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,8CAA8C,2BAA2B,GAAG,EAChG,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,yBAAyB,MAAM,CAAC,MAAM,EAAE,EAC5D,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,qCAAqC,EACzD,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,uCAAuC,EAC3D,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC/E,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,IAAI,2CAA2C,EAC/D,UAAU,CACX,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACxC,KAAK,EAAE,MAAM,CAAC,KAA2B;YACzC,OAAO,EAAE,MAAM,CAAC,OAA6B;YAC7C,WAAW,EAAE,MAAM,CAAC,WAAiC;SACtD,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,kBAAsC,CAAC;IAC3C,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAC1B,+CAA+C,EAC/C,UAAU,CACX,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,kBAAkB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,GAAG,CAAC,kBAAkB,uCAAuC,EAChG,UAAU,CACX,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,2BAA2B,KAAK,GAAG,CAAC,OAAO,EAAE,EAC/D,IAAI,CACL,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,2BAA2B,KAAK,GAAG,CAAC,OAAO,EAAE,EAChE,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAChE,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAqB;IACnE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAC1D,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAClC,CAAC"}

package/dist/src/lib/query-operators.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared constant for the query operators an operation `filter` may use,
+ * plus a helper to find operator keys that aren't in the supported set.
+ *
+ * Background (issue #1255): a database-operation `filter` uses Mongo-style
+ * operators (`$gte`, `$in`, ...). A typo like `$gt` → `$gte` or an invented
+ * `$foo` silently passes `sync push` (the server only validates `filter` is
+ * an object) and then throws `InvalidOperatorError` at *query execution*.
+ * The CLI can warn about unknown operators at push time so the author fixes
+ * it before it reaches runtime.
+ *
+ * The set mirrors the runtime translator
+ * (`packages/js-bao/src/query/JsonQueryTranslator.ts`): field operators
+ * (`translateFieldCondition` / substring ops) plus the two logical
+ * combinators special-cased in `translateFilter` (`$and` / `$or`).
+ *
+ * `$not` is intentionally NOT included — it is not a runtime operator; the
+ * translator only special-cases `$and` / `$or`, so `$not` would throw at
+ * execution just like any other unknown operator (codex review, #1255).
+ *
+ * This is deliberately a single source of truth so the validator and any
+ * future emitter/detector agree on what "known" means.
+ */
+/** Field-level comparison / membership / string operators. */
+export declare const FIELD_QUERY_OPERATORS: readonly string[];
+/** Logical combinators (arrays of sub-filters). */
+export declare const LOGICAL_QUERY_OPERATORS: readonly string[];
+/**
+ * Every operator the runtime query translator accepts. Any `$`-prefixed
+ * *key* inside a filter that is not in this set is unknown.
+ */
+export declare const SUPPORTED_QUERY_OPERATORS: ReadonlySet<string>;
+/**
+ * Recursively collect the distinct `$`-prefixed *keys* used in a filter (or
+ * any nested value) that are not in {@link SUPPORTED_QUERY_OPERATORS}.
+ *
+ * Only object *keys* are considered operators — matching the runtime
+ * convention (`walk-operation.ts`: `$`-prefixed keys are operators). String
+ * *values* like `$params.activeSince` are substitution references, never
+ * operators, so they are never flagged. `$and` / `$or` values are arrays of
+ * sub-filter objects and are walked recursively.
+ */
+export declare function collectUnknownOperators(value: any): string[];

package/dist/src/lib/query-operators.js

@@ -0,0 +1,80 @@
+/**
+ * Shared constant for the query operators an operation `filter` may use,
+ * plus a helper to find operator keys that aren't in the supported set.
+ *
+ * Background (issue #1255): a database-operation `filter` uses Mongo-style
+ * operators (`$gte`, `$in`, ...). A typo like `$gt` → `$gte` or an invented
+ * `$foo` silently passes `sync push` (the server only validates `filter` is
+ * an object) and then throws `InvalidOperatorError` at *query execution*.
+ * The CLI can warn about unknown operators at push time so the author fixes
+ * it before it reaches runtime.
+ *
+ * The set mirrors the runtime translator
+ * (`packages/js-bao/src/query/JsonQueryTranslator.ts`): field operators
+ * (`translateFieldCondition` / substring ops) plus the two logical
+ * combinators special-cased in `translateFilter` (`$and` / `$or`).
+ *
+ * `$not` is intentionally NOT included — it is not a runtime operator; the
+ * translator only special-cases `$and` / `$or`, so `$not` would throw at
+ * execution just like any other unknown operator (codex review, #1255).
+ *
+ * This is deliberately a single source of truth so the validator and any
+ * future emitter/detector agree on what "known" means.
+ */
+/** Field-level comparison / membership / string operators. */
+export const FIELD_QUERY_OPERATORS = [
+    "$eq",
+    "$ne",
+    "$gt",
+    "$gte",
+    "$lt",
+    "$lte",
+    "$in",
+    "$nin",
+    "$exists",
+    "$contains",
+    "$startsWith",
+    "$endsWith",
+    "$containsText",
+];
+/** Logical combinators (arrays of sub-filters). */
+export const LOGICAL_QUERY_OPERATORS = ["$and", "$or"];
+/**
+ * Every operator the runtime query translator accepts. Any `$`-prefixed
+ * *key* inside a filter that is not in this set is unknown.
+ */
+export const SUPPORTED_QUERY_OPERATORS = new Set([
+    ...FIELD_QUERY_OPERATORS,
+    ...LOGICAL_QUERY_OPERATORS,
+]);
+/**
+ * Recursively collect the distinct `$`-prefixed *keys* used in a filter (or
+ * any nested value) that are not in {@link SUPPORTED_QUERY_OPERATORS}.
+ *
+ * Only object *keys* are considered operators — matching the runtime
+ * convention (`walk-operation.ts`: `$`-prefixed keys are operators). String
+ * *values* like `$params.activeSince` are substitution references, never
+ * operators, so they are never flagged. `$and` / `$or` values are arrays of
+ * sub-filter objects and are walked recursively.
+ */
+export function collectUnknownOperators(value) {
+    const unknown = new Set();
+    walk(value, unknown);
+    return [...unknown];
+}
+function walk(value, unknown) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walk(item, unknown);
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (key.startsWith("$") && !SUPPORTED_QUERY_OPERATORS.has(key)) {
+                unknown.add(key);
+            }
+            walk(child, unknown);
+        }
+    }
+}
+//# sourceMappingURL=query-operators.js.map

package/dist/src/lib/query-operators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-operators.js","sourceRoot":"","sources":["../../../src/lib/query-operators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACX,aAAa;IACb,WAAW;IACX,eAAe;CAChB,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IACpE,GAAG,qBAAqB;IACxB,GAAG,uBAAuB;CAC3B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAU;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,IAAI,CAAC,KAAU,EAAE,OAAoB;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/lib/refresh-admin-credentials.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Shared helper for refreshing the admin access token via the CLI auth API.
+ *
+ * Why this module exists:
+ *
+ *   - `ApiClient.refreshToken()` already POSTs to /admin/api/auth/refresh
+ *     before every API call when the access token is near expiry.
+ *   - `primitive token` (issue #772) now needs the same exchange so it can
+ *     auto-refresh a stale token before printing it.
+ *   - `primitive login --token-stdin` does the same POST a third time to
+ *     bootstrap credentials from a refresh token piped from another CLI.
+ *
+ * Putting the HTTP exchange + response parsing in one place keeps the
+ * response-shape contract in a single spot (server returns both `jwt` and
+ * `accessToken` — see `src/index.ts:2349-2356`) and means future server
+ * changes to that endpoint require touching exactly one CLI file.
+ *
+ * Design notes:
+ *
+ *   - This module **does not** depend on `api-client.ts`. `ApiClient` imports
+ *     it, not the other way around — that prevents the avoidable module cycle
+ *     codex flagged in the design review.
+ *   - It defines its own `RefreshError` so callers can map failures to
+ *     whatever error type (or exit code) makes sense for their surface.
+ *     `ApiClient` translates these to `ApiError`; the `token` command
+ *     translates them to an `error()` + `process.exit(1)`.
+ *   - It **does not save** the refreshed credentials. The caller decides
+ *     whether to persist (the `token` command does; `ApiClient.refreshToken`
+ *     does). Keeping persistence caller-owned matches the existing
+ *     "storage is owned by `credentials-store.ts`" convention.
+ *   - It **does not print anything**. Output (success/failure messaging) is
+ *     the caller's responsibility — important because the `token` command
+ *     must keep stdout clean for piping.
+ */
+import type { Credentials } from "../types/index.js";
+/**
+ * Reasons a refresh attempt can fail. `unauthorized` covers any HTTP non-2xx
+ * response (typically a 401 from an expired/invalid refresh token).
+ * `network` covers transport-level failures (DNS, ECONNREFUSED, etc.).
+ * `missing-refresh-token` is a precondition failure — there's no token to
+ * send.
+ */
+export type RefreshFailureKind = "missing-refresh-token" | "unauthorized" | "network";
+export declare class RefreshError extends Error {
+    kind: RefreshFailureKind;
+    statusCode?: number;
+    cause?: unknown;
+    constructor(message: string, kind: RefreshFailureKind, statusCode?: number, cause?: unknown);
+}
+/**
+ * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
+ * `Credentials` object — the caller is responsible for persistence via
+ * `saveCredentials()` (or whatever storage the caller owns).
+ *
+ * Server contract: `POST {serverUrl}/admin/api/auth/refresh` with
+ *   { refreshToken: string }
+ * Response (200):
+ *   { jwt, accessToken, refreshToken, expiresAt }
+ *
+ * We accept `accessToken` as the canonical field and fall back to `jwt` for
+ * forward-compat (the server currently emits both — see issue #772 codex
+ * cleanup #3). Login's legacy `data.token` form is dropped — no server
+ * version that's still in support emits that field.
+ */
+export declare function refreshAdminCredentials(credentials: Credentials): Promise<Credentials>;

package/dist/src/lib/refresh-admin-credentials.js

@@ -0,0 +1,103 @@
+/**
+ * Shared helper for refreshing the admin access token via the CLI auth API.
+ *
+ * Why this module exists:
+ *
+ *   - `ApiClient.refreshToken()` already POSTs to /admin/api/auth/refresh
+ *     before every API call when the access token is near expiry.
+ *   - `primitive token` (issue #772) now needs the same exchange so it can
+ *     auto-refresh a stale token before printing it.
+ *   - `primitive login --token-stdin` does the same POST a third time to
+ *     bootstrap credentials from a refresh token piped from another CLI.
+ *
+ * Putting the HTTP exchange + response parsing in one place keeps the
+ * response-shape contract in a single spot (server returns both `jwt` and
+ * `accessToken` — see `src/index.ts:2349-2356`) and means future server
+ * changes to that endpoint require touching exactly one CLI file.
+ *
+ * Design notes:
+ *
+ *   - This module **does not** depend on `api-client.ts`. `ApiClient` imports
+ *     it, not the other way around — that prevents the avoidable module cycle
+ *     codex flagged in the design review.
+ *   - It defines its own `RefreshError` so callers can map failures to
+ *     whatever error type (or exit code) makes sense for their surface.
+ *     `ApiClient` translates these to `ApiError`; the `token` command
+ *     translates them to an `error()` + `process.exit(1)`.
+ *   - It **does not save** the refreshed credentials. The caller decides
+ *     whether to persist (the `token` command does; `ApiClient.refreshToken`
+ *     does). Keeping persistence caller-owned matches the existing
+ *     "storage is owned by `credentials-store.ts`" convention.
+ *   - It **does not print anything**. Output (success/failure messaging) is
+ *     the caller's responsibility — important because the `token` command
+ *     must keep stdout clean for piping.
+ */
+import { fetchWithTLS } from "./fetch.js";
+export class RefreshError extends Error {
+    kind;
+    statusCode;
+    cause;
+    constructor(message, kind, statusCode, cause) {
+        super(message);
+        this.kind = kind;
+        this.statusCode = statusCode;
+        this.cause = cause;
+        this.name = "RefreshError";
+    }
+}
+/**
+ * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
+ * `Credentials` object — the caller is responsible for persistence via
+ * `saveCredentials()` (or whatever storage the caller owns).
+ *
+ * Server contract: `POST {serverUrl}/admin/api/auth/refresh` with
+ *   { refreshToken: string }
+ * Response (200):
+ *   { jwt, accessToken, refreshToken, expiresAt }
+ *
+ * We accept `accessToken` as the canonical field and fall back to `jwt` for
+ * forward-compat (the server currently emits both — see issue #772 codex
+ * cleanup #3). Login's legacy `data.token` form is dropped — no server
+ * version that's still in support emits that field.
+ */
+export async function refreshAdminCredentials(credentials) {
+    if (!credentials.refreshToken) {
+        throw new RefreshError("No refresh token available. Please login again.", "missing-refresh-token");
+    }
+    const url = `${credentials.serverUrl}/admin/api/auth/refresh`;
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (credentials.globalAdminAppId) {
+        headers["X-Global-Admin-App-Id"] = credentials.globalAdminAppId;
+    }
+    let response;
+    try {
+        response = await fetchWithTLS(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ refreshToken: credentials.refreshToken }),
+        });
+    }
+    catch (cause) {
+        const reason = cause instanceof Error && cause.message
+            ? cause.message
+            : String(cause);
+        throw new RefreshError(`Network error refreshing token: ${reason}.`, "network", undefined, cause);
+    }
+    if (!response.ok) {
+        throw new RefreshError("Refresh token expired. Run 'primitive login'.", "unauthorized", response.status);
+    }
+    const data = (await response.json());
+    const accessToken = data?.accessToken || data?.jwt;
+    if (!accessToken) {
+        throw new RefreshError("Refresh response did not include an access token. Run 'primitive login'.", "unauthorized", response.status);
+    }
+    return {
+        ...credentials,
+        accessToken,
+        refreshToken: data.refreshToken || credentials.refreshToken,
+        expiresAt: data.expiresAt || new Date(Date.now() + 3600 * 1000).toISOString(),
+    };
+}
+//# sourceMappingURL=refresh-admin-credentials.js.map

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAJT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,+CAA+C,EAC/C,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/resolve-platform.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Pure resolution of the target platform for `primitive init`.
+ *
+ * Background (issue #1009): `primitive init` must become platform-aware. The
+ * commander `-p, --platform` option no longer carries a `"web"` default, so an
+ * omitted flag is `undefined` and distinguishable from an explicit
+ * `--platform web`. Resolution follows a 4-case interactivity contract:
+ *
+ *   (a) explicit `--platform` flag set        -> use it (never prompt)
+ *   (b) init-config TOML present (configPlatform may be set) -> use config
+ *       value, else fall back to "web" (never prompt)
+ *   (c) interactive TTY, no flag, no config    -> prompt with `select`
+ *   (d) non-TTY, no flag, no config            -> fall back to "web" WITHOUT
+ *       hanging and WITHOUT the `ERR_USE_AFTER_CLOSE` crash that
+ *       `@inquirer/prompts` `select` throws on a closed/piped stdin
+ *       (same hazard family hardened in #972/#999 — see `confirm-prompt.ts`).
+ *
+ * Extracting the decision into a pure function (with injectable `isTTY` /
+ * `promptFn`, mirroring `confirm-prompt.ts`) makes the otherwise
+ * terminal-dependent interactivity contract unit-testable.
+ */
+export type Platform = "web" | "ios";
+/** Prompt thunk returning the chosen platform. Injectable for testing. */
+export type PlatformPromptFn = () => Promise<Platform>;
+export interface ResolvePlatformOptions {
+    /** Value of the explicit `--platform` flag, or `undefined` when omitted. */
+    flag?: Platform;
+    /** `platform` key from a loaded `.primitive-init.toml`, if a config is present. */
+    configPlatform?: Platform;
+    /**
+     * Whether a non-interactive init-config file is in effect. When `true`, the
+     * prompt is skipped entirely (case b) regardless of TTY.
+     */
+    hasConfig: boolean;
+    /** Whether stdin is an interactive TTY. Inject `false` to exercise case (d). */
+    isTTY: boolean;
+    /** Prompt function used only in the interactive case (c). */
+    promptFn: PlatformPromptFn;
+}
+/**
+ * Resolve the target platform per the 4-case interactivity contract above.
+ *
+ * @returns the resolved platform (`"web"` or `"ios"`).
+ */
+export declare function resolvePlatform(options: ResolvePlatformOptions): Promise<Platform>;

package/dist/src/lib/resolve-platform.js

@@ -0,0 +1,43 @@
+/**
+ * Pure resolution of the target platform for `primitive init`.
+ *
+ * Background (issue #1009): `primitive init` must become platform-aware. The
+ * commander `-p, --platform` option no longer carries a `"web"` default, so an
+ * omitted flag is `undefined` and distinguishable from an explicit
+ * `--platform web`. Resolution follows a 4-case interactivity contract:
+ *
+ *   (a) explicit `--platform` flag set        -> use it (never prompt)
+ *   (b) init-config TOML present (configPlatform may be set) -> use config
+ *       value, else fall back to "web" (never prompt)
+ *   (c) interactive TTY, no flag, no config    -> prompt with `select`
+ *   (d) non-TTY, no flag, no config            -> fall back to "web" WITHOUT
+ *       hanging and WITHOUT the `ERR_USE_AFTER_CLOSE` crash that
+ *       `@inquirer/prompts` `select` throws on a closed/piped stdin
+ *       (same hazard family hardened in #972/#999 — see `confirm-prompt.ts`).
+ *
+ * Extracting the decision into a pure function (with injectable `isTTY` /
+ * `promptFn`, mirroring `confirm-prompt.ts`) makes the otherwise
+ * terminal-dependent interactivity contract unit-testable.
+ */
+/**
+ * Resolve the target platform per the 4-case interactivity contract above.
+ *
+ * @returns the resolved platform (`"web"` or `"ios"`).
+ */
+export async function resolvePlatform(options) {
+    // (a) explicit flag wins, no prompt.
+    if (options.flag !== undefined) {
+        return options.flag;
+    }
+    // (b) non-interactive config present: use its platform or default to web.
+    if (options.hasConfig) {
+        return options.configPlatform ?? "web";
+    }
+    // (c) interactive TTY, no flag, no config: prompt.
+    if (options.isTTY) {
+        return options.promptFn();
+    }
+    // (d) non-TTY, no flag, no config: never prompt; fall back to web.
+    return "web";
+}
+//# sourceMappingURL=resolve-platform.js.map

package/dist/src/lib/resolve-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-platform.js","sourceRoot":"","sources":["../../../src/lib/resolve-platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAuBH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,qCAAqC;IACrC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACzC,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/lib/skill-installer.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Returns true if the skill is currently installed.
+ */
+export declare function isSkillInstalled(): boolean;
+/**
+ * Auto-update an already-installed skill if a newer version is bundled.
+ * Called after command execution for non-init, non-skill commands.
+ * If the skill is not installed, shows a non-blocking hint instead.
+ * Never throws — fails silently like version-check.
+ */
+export declare function checkSkillStatus(): Promise<void>;
+/**
+ * Explicitly install or reinstall the skill. Shows output.
+ */
+export declare function installSkillExplicit(): boolean;
+/**
+ * Uninstall the skill.
+ */
+export declare function uninstallSkill(): boolean;
+/**
+ * Show current skill installation status.
+ */
+export declare function skillStatus(): void;