primitive-admin 1.1.0-alpha.45 → 1.1.0-alpha.46

package/dist/src/commands/vars.d.ts

@@ -0,0 +1,8 @@
+import { Command } from "commander";
+/**
+ * `primitive vars` — non-secret per-app config scalars (issue #1364). The
+ * plaintext twin of `primitive secrets`: same key format and limits, but
+ * values are NOT secret — `list` shows them, and they appear unmasked in
+ * debug traces. Never store a credential in a var; use `primitive secrets`.
+ */
+export declare function registerVarsCommands(program: Command): void;

package/dist/src/commands/vars.js

@@ -0,0 +1,110 @@
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId } from "../lib/config.js";
+import { success, error, info, keyValue, formatTable, formatDate, json, } from "../lib/output.js";
+/**
+ * `primitive vars` — non-secret per-app config scalars (issue #1364). The
+ * plaintext twin of `primitive secrets`: same key format and limits, but
+ * values are NOT secret — `list` shows them, and they appear unmasked in
+ * debug traces. Never store a credential in a var; use `primitive secrets`.
+ */
+export function registerVarsCommands(program) {
+    const vars = program
+        .command("vars")
+        .description("Manage non-secret app config vars (values are visible; use secrets for credentials)")
+        .addHelpText("after", `
+Examples:
+  $ primitive vars list
+  $ primitive vars set ADMIN_GROUP_ID --value grp_01ABC --summary "Admins group id"
+  $ primitive vars set ADMIN_GROUP_ID --value grp_01NEW (updates existing)
+  $ primitive vars delete ADMIN_GROUP_ID
+
+Vars bind into CEL rules via the declared \`vars.*\` namespace — declare them
+with \`vars = ["ADMIN_GROUP_ID"]\` in the config's access manifest.
+`);
+    // List vars (values shown — non-secret)
+    vars
+        .command("list")
+        .description("List all config vars for an app (values are shown)")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const varsList = await client.listAppConfigVars(resolvedAppId);
+            if (options.json) {
+                json(varsList);
+                return;
+            }
+            if (!varsList || varsList.length === 0) {
+                info("No vars found.");
+                return;
+            }
+            console.log(formatTable(varsList, [
+                { header: "KEY", key: "key" },
+                { header: "VALUE", key: "value" },
+                { header: "SUMMARY", key: "summary" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+                { header: "UPDATED", key: "updatedAt", format: formatDate },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Set var (create or update — by-key upsert)
+    vars
+        .command("set")
+        .description("Create or update a config var")
+        .argument("<key>", "Var key (e.g., ADMIN_GROUP_ID)")
+        .option("--value <value>", "Var value (non-secret)")
+        .option("--summary <text>", "Description of the var")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (key, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.value) {
+            error("--value is required");
+            process.exit(1);
+        }
+        const client = new ApiClient();
+        try {
+            const payload = { value: options.value };
+            if (options.summary !== undefined) {
+                payload.summary = options.summary;
+            }
+            const result = await client.upsertAppConfigVar(resolvedAppId, key, payload);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Var '${key}' saved.`);
+            keyValue("Key", result?.key || key);
+            keyValue("Value", result?.value ?? options.value);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Delete var (key-addressed — no id lookup needed)
+    vars
+        .command("delete")
+        .description("Delete a config var")
+        .argument("<key>", "Var key (e.g., ADMIN_GROUP_ID)")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .action(async (key, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            await client.deleteAppConfigVar(resolvedAppId, key);
+            success(`Var '${key}' deleted.`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=vars.js.map

package/dist/src/commands/vars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vars.js","sourceRoot":"","sources":["../../../src/commands/vars.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qFAAqF,CAAC;SAClG,WAAW,CAAC,OAAO,EAAE;;;;;;;;;CASzB,CAAC,CAAC;IAED,wCAAwC;IACxC,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,QAAQ,EAAE;gBACpB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;gBAC7B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE;gBACjC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;gBACrC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;gBAC3D,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6CAA6C;IAC7C,IAAI;SACD,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,+BAA+B,CAAC;SAC5C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;SACnD,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;SACnD,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SACpD,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAE5E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC;YAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC;YACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,mDAAmD;IACnD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,qBAAqB,CAAC;SAClC,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;SACnD,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/workflows.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, statSync, existsSync, readdirSync, } from "fs";
+import { readFileSync, writeFileSync, statSync, readdirSync, } from "fs";
 import { basename } from "path";
 import * as path from "path";
 import { parseConfigToml, stringifyConfigToml } from "../lib/config-toml.js";
@@ -6,6 +6,7 @@ import { lookup as mimeLookup } from "mime-types";
 import { generateWorkflowTypes, } from "../lib/workflow-codegen/generator.js";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
+import { resolveCodegenSourceDir } from "../lib/codegen-shared/resolveCodegenSourceDir.js";
 import { validateWorkflowToml, formatWorkflowTomlErrors, } from "../lib/workflow-toml-validator.js";
 import { expandWorkflow } from "../lib/workflow-fragments.js";
 import { buildWorkflowPayloadFromToml } from "../lib/workflow-payload.js";
@@ -2472,91 +2473,31 @@ Examples:
         .option("--json", "Output the result summary as JSON")
         .action(async (workflowKey, options) => {
         try {
-            // 1. Locate the workflows directory. Mirrors `databases codegen`'s
-            //    sync-dir resolution: honor --sync-dir, else search any
-            //    env/appId subtree under ./.primitive/sync that has a workflows/
-            //    directory. When --app is given, restrict the scan to that app's
-            //    subtree (the sync-tree layout is <env>/<appId>/), so a multi-app
-            //    tree generates only the requested app's workflows instead of
-            //    combining every app's and writing into the first one found.
-            const workflowDirs = [];
-            if (options.syncDir) {
-                const candidate = path.join(options.syncDir, "workflows");
-                if (existsSync(candidate)) {
-                    workflowDirs.push(candidate);
-                }
-            }
-            else {
-                const root = path.join(process.cwd(), ".primitive", "sync");
-                if (existsSync(root)) {
-                    for (const env of readdirSync(root)) {
-                        const envDir = path.join(root, env);
-                        try {
-                            for (const app of readdirSync(envDir)) {
-                                if (options.app && app !== options.app)
-                                    continue;
-                                const candidate = path.join(envDir, app, "workflows");
-                                if (existsSync(candidate)) {
-                                    workflowDirs.push(candidate);
-                                }
-                            }
-                        }
-                        catch {
-                            // skip non-dirs
-                        }
-                    }
-                }
-            }
-            if (workflowDirs.length === 0) {
-                error(options.app
-                    ? `No workflows/ directory found for app "${options.app}" under .primitive/sync/. Check the --app id, pass --sync-dir, or run \`primitive sync pull\` first.`
-                    : "No workflows/ directory found. Pass --sync-dir or run `primitive sync pull` first.");
-                process.exit(1);
-            }
-            // Codegen writes one <key>.generated.ts per workflow into a single
-            // output dir derived from the first source dir below. Generating from
-            // more than one discovered workflows/ directory (multiple apps, or the
-            // same app across multiple synced envs) would combine unrelated apps'
-            // workflows into the first one's output dir and write nothing for the
-            // rest. Require the caller to disambiguate rather than combining.
-            if (workflowDirs.length > 1) {
-                const appsFound = [
-                    ...new Set(workflowDirs.map((d) => path.basename(path.dirname(d)))),
-                ];
-                error(`Found workflows/ directories for more than one app/env:\n` +
-                    workflowDirs
-                        .map((d) => `  ${path.relative(process.cwd(), d)}`)
-                        .join("\n") +
-                    `\nCodegen writes into one output dir, so it must run against` +
-                    ` one app. ` +
-                    (options.app
-                        ? `App "${options.app}" resolves to multiple synced envs — pass --sync-dir to pick one.`
-                        : `Pass --app <app-id> (found: ${appsFound.join(", ")}) or` +
-                            ` --sync-dir to select one.`));
-                process.exit(1);
-            }
+            // 1. Resolve the single source workflows/ directory via the shared
+            //    active-environment resolver (issue #1510). Honors --sync-dir /
+            //    --app overrides, resolves the active env
+            //    (--env → PRIMITIVE_ENV → defaultEnvironment → single-env), and
+            //    preserves the legacy per-app scan fallback in bare-dir mode.
+            const workflowsSourceDir = resolveCodegenSourceDir({
+                subdir: "workflows",
+                options: { app: options.app, syncDir: options.syncDir },
+            });
             // 2. Collect the source .toml files (one per workflow), filtered to a
             //    single workflow when an argument is given. Match on the file stem;
             //    the generator resolves the real key from `[workflow].key`.
             const inputs = [];
-            const seenStems = new Set();
-            for (const dir of workflowDirs) {
-                for (const fileName of readdirSync(dir)) {
-                    if (!fileName.endsWith(".toml"))
-                        continue;
-                    const stem = fileName.slice(0, -".toml".length);
-                    if (workflowKey && stem !== workflowKey)
-                        continue;
-                    if (seenStems.has(stem))
-                        continue;
-                    seenStems.add(stem);
-                    const tomlPath = path.join(dir, fileName);
-                    inputs.push({
-                        fileStem: stem,
-                        tomlPath,
-                        tomlContent: readFileSync(tomlPath, "utf-8"),
-                    });
-                }
+            for (const fileName of readdirSync(workflowsSourceDir)) {
+                if (!fileName.endsWith(".toml"))
+                    continue;
+                const stem = fileName.slice(0, -".toml".length);
+                if (workflowKey && stem !== workflowKey)
+                    continue;
+                const tomlPath = path.join(workflowsSourceDir, fileName);
+                inputs.push({
+                    fileStem: stem,
+                    tomlPath,
+                    tomlContent: readFileSync(tomlPath, "utf-8"),
+                });
             }
             if (inputs.length === 0) {
                 error(workflowKey