primitive-admin 1.1.0-alpha.71 → 1.1.0-alpha.73

package/dist/src/lib/generated-workflow-model-fields.d.ts

@@ -0,0 +1,20 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the `WorkflowDefinition` model in the repo-root
+ * `models.yaml` — the one statically-parseable server anchor for the
+ * `[workflow]`-level config surface (issue #2326, Phase 1 of #1976).
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-fields.mjs   (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-workflow-fields.mjs --check`, also
+ * asserted by `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts`)
+ * fails if this committed artifact does not match a fresh parse of
+ * `models.yaml`. The same test asserts every field below is classified in
+ * `cli/src/lib/workflow-field-descriptor.ts` as synced, structural, or
+ * internal — so a new server-side workflow field cannot be silently ignored by
+ * the CLI.
+ */
+/** Every `WorkflowDefinition` field, in `models.yaml` declaration order (#2326). */
+export declare const GENERATED_WORKFLOW_MODEL_FIELDS: readonly string[];

package/dist/src/lib/generated-workflow-model-fields.js

@@ -0,0 +1,53 @@
+/**
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ *
+ * Source of truth: the `WorkflowDefinition` model in the repo-root
+ * `models.yaml` — the one statically-parseable server anchor for the
+ * `[workflow]`-level config surface (issue #2326, Phase 1 of #1976).
+ *
+ * Regenerate with:
+ *   node cli/scripts/gen-workflow-fields.mjs   (runs automatically at CLI prebuild)
+ *
+ * A CI freshness guard (`cli/scripts/gen-workflow-fields.mjs --check`, also
+ * asserted by `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts`)
+ * fails if this committed artifact does not match a fresh parse of
+ * `models.yaml`. The same test asserts every field below is classified in
+ * `cli/src/lib/workflow-field-descriptor.ts` as synced, structural, or
+ * internal — so a new server-side workflow field cannot be silently ignored by
+ * the CLI.
+ */
+/** Every `WorkflowDefinition` field, in `models.yaml` declaration order (#2326). */
+export const GENERATED_WORKFLOW_MODEL_FIELDS = [
+    "workflowId",
+    "appId",
+    "workflowKey",
+    "name",
+    "status",
+    "latestRevision",
+    "description",
+    "stepsR2Key",
+    "draftStepsR2Key",
+    "draftInputSchema",
+    "draftOutputSchema",
+    "draftModifiedAt",
+    "activeConfigId",
+    "inputSchema",
+    "outputSchema",
+    "perUserMaxRunning",
+    "perUserMaxQueued",
+    "perAppMaxRunning",
+    "perAppMaxQueued",
+    "queueTtlSeconds",
+    "dequeueOrder",
+    "requiresClientApply",
+    "syncCallable",
+    "accessRule",
+    "metadataManifest",
+    "runAs",
+    "lock",
+    "capabilities",
+    "createdBy",
+    "createdAt",
+    "modifiedAt",
+];
+//# sourceMappingURL=generated-workflow-model-fields.js.map

package/dist/src/lib/generated-workflow-model-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-workflow-model-fields.js","sourceRoot":"","sources":["../../../src/lib/generated-workflow-model-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,+BAA+B,GAAsB;IAChE,YAAY;IACZ,OAAO;IACP,aAAa;IACb,MAAM;IACN,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,qBAAqB;IACrB,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,OAAO;IACP,MAAM;IACN,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;CACb,CAAC"}

package/dist/src/lib/google-client-secret-status.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The operator-facing warning for an app whose stored `googleClientSecret` is
+ * not a `{{secrets.KEY}}` reference (#2256, #2307).
+ *
+ * The server never sends such a value back: `GET /settings` omits the key and
+ * reports `googleClientSecretStatus` in its place, so the only way an operator
+ * learns the field is still unmigrated is a command that reads the status and
+ * says so. Two do — `apps get` and `config pull` — and
+ * each has two statuses to describe, so the wording lives here once and the
+ * call sites supply only what genuinely differs: how the field is named in that
+ * context, where the value is missing from, and what the un-migrated value
+ * blocks.
+ *
+ * Modelled on `signingSecretStatusWarning` (the same problem for
+ * `webhook.signingSecret`), deliberately kept as a separate function: the
+ * remediation names a different TOML key, and a `legacy-literal` blocks
+ * different things on the two fields.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export declare function googleClientSecretStatusWarning(status: string | null | undefined, context: {
+    /** How to name the field, e.g. `"googleClientSecret"`. Starts the sentence. */
+    subject: string;
+    /** Where the value is missing from, e.g. `"this output"`. */
+    withheldFrom: string;
+    /**
+     * What an un-migrated value blocks, e.g. `"the next settings write will be
+     * rejected"`. Every settings write on such an app fails unless it carries a
+     * `googleClientSecret` that migrates the field
+     * (`validateGoogleClientSecretMigration`), and a pulled `app.toml` never
+     * carries one — so for the pull paths this is the concrete consequence.
+     */
+    blocks: string;
+}): string | null;

package/dist/src/lib/google-client-secret-status.js

@@ -0,0 +1,56 @@
+/**
+ * The operator-facing warning for an app whose stored `googleClientSecret` is
+ * not a `{{secrets.KEY}}` reference (#2256, #2307).
+ *
+ * The server never sends such a value back: `GET /settings` omits the key and
+ * reports `googleClientSecretStatus` in its place, so the only way an operator
+ * learns the field is still unmigrated is a command that reads the status and
+ * says so. Two do — `apps get` and `config pull` — and
+ * each has two statuses to describe, so the wording lives here once and the
+ * call sites supply only what genuinely differs: how the field is named in that
+ * context, where the value is missing from, and what the un-migrated value
+ * blocks.
+ *
+ * Modelled on `signingSecretStatusWarning` (the same problem for
+ * `webhook.signingSecret`), deliberately kept as a separate function: the
+ * remediation names a different TOML key, and a `legacy-literal` blocks
+ * different things on the two fields.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export function googleClientSecretStatusWarning(status, context) {
+    const remediation = "Store the value with `primitive secrets set KEY --value <value>` and set " +
+        'googleClientSecret = "{{secrets.KEY}}".';
+    if (status === "legacy-literal") {
+        return (`${context.subject} still holds a raw value rather than a {{secrets.KEY}} reference, ` +
+            `so it is withheld from ${context.withheldFrom}. Google sign-in keeps working, but the ` +
+            `value is deprecated and ${context.blocks} until it is migrated. ${remediation}`);
+    }
+    // Not a working legacy literal: the stored value carries reference syntax
+    // that resolves to nothing, so Google sign-in is already failing (#2332).
+    //
+    // Two deliberate differences from the branch above, both to keep the
+    // rendered settings output byte-identical to what PR #2293 shipped:
+    //
+    //   - `context.blocks` is unused. A push of the pulled file is rejected for
+    //     this status too (`validateGoogleClientSecretMigration` gates on
+    //     `isWithheldSecretStatus`, which covers both), but the sign-in outage is
+    //     the louder problem and the remediation below already fixes both. The
+    //     sibling `signingSecretStatusWarning` drops `blocks` in its malformed
+    //     branch the same way.
+    //   - The remediation sentence is written out rather than interpolating the
+    //     `remediation` constant above: this one says "the real client secret",
+    //     which the shared sentence does not.
+    //
+    // Both are worth revisiting together if `apps get`'s wording is ever
+    // allowed to change.
+    if (status === "malformed-reference") {
+        return (`${context.subject} is neither a {{secrets.KEY}} reference nor a plain stored value — it ` +
+            `carries reference syntax that does not resolve, so it is withheld from ${context.withheldFrom} ` +
+            "and Google sign-in is already FAILING. Store the real client secret with " +
+            '`primitive secrets set KEY --value <value>` and set googleClientSecret = "{{secrets.KEY}}".');
+    }
+    return null;
+}
+//# sourceMappingURL=google-client-secret-status.js.map

package/dist/src/lib/google-client-secret-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client-secret-status.js","sourceRoot":"","sources":["../../../src/lib/google-client-secret-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAiC,EACjC,OAaC;IAED,MAAM,WAAW,GACf,2EAA2E;QAC3E,yCAAyC,CAAC;IAC5C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,oEAAoE;YACtF,0BAA0B,OAAO,CAAC,YAAY,0CAA0C;YACxF,2BAA2B,OAAO,CAAC,MAAM,0BAA0B,WAAW,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,2BAA2B;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,0CAA0C;IAC1C,EAAE;IACF,qEAAqE;IACrE,qBAAqB;IACrB,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,wEAAwE;YAC1F,0EAA0E,OAAO,CAAC,YAAY,GAAG;YACjG,2EAA2E;YAC3E,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/init-client-platforms.d.ts

@@ -0,0 +1,14 @@
+import type { Platform } from "./resolve-platform.js";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export declare function detectClientPlatform(dir: string): Platform | null;
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export declare function discoverClientPlatforms(projectRoot: string): Platform[];
+/** Whether the app ends up with an iOS client AND a web client. */
+export declare function appHasBothPlatforms(planned: Platform[], discovered: Platform[]): boolean;

package/dist/src/lib/init-client-platforms.js

@@ -0,0 +1,71 @@
+/**
+ * Which client platforms an app HAS — the ones this run scaffolds plus the
+ * ones already in the repository (#2982).
+ *
+ * An app with both an iOS and a web client gets the universal-link wiring: the
+ * emailed sign-in link becomes the web deployment's https callback, which
+ * opens the installed app and still signs in from any browser. So "does this
+ * app have both?" decides whether init seeds a `webUrl` and prints the
+ * activation checklist.
+ *
+ * The existing clients are found by the signals the templates ship — a Swift
+ * package or Xcode project, a Vite project — so a `functions/` directory with
+ * a `package.json` is not mistaken for a client. They are looked for in child
+ * directories AND at the project root: `primitive init` still produces the
+ * flat single-client layout where the client IS the repository root, and
+ * adding the second platform to such a repository is exactly the case this
+ * feature exists for (DSO-2982-013).
+ */
+import { existsSync, readdirSync } from "fs";
+import { join } from "path";
+/**
+ * The platform of the client in `dir`, or null when `dir` is not a client.
+ * The ONE definition of the template signals — the AGENTS.md client listing
+ * and the both-platforms predicate read it, so they cannot drift.
+ */
+export function detectClientPlatform(dir) {
+    let hasXcodeProject = false;
+    try {
+        hasXcodeProject = readdirSync(dir).some((name) => name.endsWith(".xcodeproj"));
+    }
+    catch {
+        return null;
+    }
+    if (existsSync(join(dir, "Package.swift")) || hasXcodeProject)
+        return "ios";
+    if (existsSync(join(dir, "package.json")) && existsSync(join(dir, "vite.config.ts"))) {
+        return "web";
+    }
+    return null;
+}
+/**
+ * Every platform already present under `projectRoot`, counting a client that
+ * IS the root. Deduplicated, in canonical order.
+ */
+export function discoverClientPlatforms(projectRoot) {
+    const found = new Set();
+    const atRoot = detectClientPlatform(projectRoot);
+    if (atRoot)
+        found.add(atRoot);
+    let entries;
+    try {
+        entries = readdirSync(projectRoot, { withFileTypes: true });
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name.startsWith("."))
+            continue;
+        const platform = detectClientPlatform(join(projectRoot, entry.name));
+        if (platform)
+            found.add(platform);
+    }
+    return ["web", "ios"].filter((platform) => found.has(platform));
+}
+/** Whether the app ends up with an iOS client AND a web client. */
+export function appHasBothPlatforms(planned, discovered) {
+    const platforms = new Set([...planned, ...discovered]);
+    return platforms.has("ios") && platforms.has("web");
+}
+//# sourceMappingURL=init-client-platforms.js.map

package/dist/src/lib/init-client-platforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-client-platforms.js","sourceRoot":"","sources":["../../../src/lib/init-client-platforms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAY,CAAC;IAElC,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAQ,CAAC,KAAK,EAAE,KAAK,CAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,OAAmB,EACnB,UAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAW,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC"}

package/dist/src/lib/init-email-redirect-uris.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+export type EmailRedirectUriMerge = {
+    action: "already-listed";
+} | {
+    action: "merge";
+    uris: string[];
+} | {
+    action: "leave-alone";
+    reason: string;
+};
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export declare function planEmailRedirectUriMerge(existing: unknown, callbackUri: string): EmailRedirectUriMerge;

package/dist/src/lib/init-email-redirect-uris.js

@@ -0,0 +1,46 @@
+/**
+ * Whether init may add a sign-in callback to an app's magic-link allow-list,
+ * and what to write (#2982).
+ *
+ * A combined iOS + web app emails ONE https link — the web app's
+ * `/oauth/callback` — and the server matches that target against
+ * `emailRedirectUris` fail-closed. So init only points an environment's
+ * `webUrl` at a dev origin whose callback the app actually allows; otherwise it
+ * would flip a working code-only email into a request that 400s.
+ *
+ * A brand-new app is seeded with `http://localhost:5173/oauth/callback` at
+ * creation, and the dev-port step merges the chosen port's callback — but an
+ * app adopted with `--use-existing-app-id` on the default port has been through
+ * neither, and its allow-list is whatever it already was.
+ *
+ * The one thing this must never do is NARROW that list. An app with no
+ * `emailRedirectUris` attribute still behaves by the pre-#2891 app-wide
+ * `redirectUris`, and writing a fresh single-entry list would silently replace
+ * that fallback with our callback — breaking magic-link sign-in for whichever
+ * client was relying on it. An explicitly empty list is a deliberate "reject
+ * everything" for the same reason. Both are left alone, and init falls back to
+ * printing the manual step.
+ */
+/**
+ * Decide what to do with `existing` (the app's `emailRedirectUris` as the
+ * settings API reports it) to make `callbackUri` an allowed target.
+ */
+export function planEmailRedirectUriMerge(existing, callbackUri) {
+    if (!Array.isArray(existing)) {
+        return {
+            action: "leave-alone",
+            reason: "this app has no emailRedirectUris list of its own, and writing one would replace the allow-list it behaves by today",
+        };
+    }
+    const uris = existing.filter((value) => typeof value === "string");
+    if (uris.length === 0) {
+        return {
+            action: "leave-alone",
+            reason: "this app's emailRedirectUris list is empty, which is a deliberate 'reject every link target'",
+        };
+    }
+    if (uris.includes(callbackUri))
+        return { action: "already-listed" };
+    return { action: "merge", uris: [...uris, callbackUri] };
+}
+//# sourceMappingURL=init-email-redirect-uris.js.map

package/dist/src/lib/init-email-redirect-uris.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-email-redirect-uris.js","sourceRoot":"","sources":["../../../src/lib/init-email-redirect-uris.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,qHAAqH;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EACJ,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;AAC3D,CAAC"}

package/dist/src/lib/init-ios-links.d.ts

@@ -29,6 +29,20 @@ export interface StampResult {
  * serializer would drop them.
  */
 export declare function stampCallbackScheme(clientDir: string, scheme: string): StampResult;
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * refuses a name the config already has. Every environment anyone reads this
+ * about already exists (init wrote `dev`; `prod` was added when the app was
+ * deployed), so the instruction for those has to be the file, which is also
+ * what the docs describe as the way to edit one. The flag is worth naming only
+ * where a new environment is being created.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export declare function setWebUrlInstruction(origin: string, indent?: string): string[];
 /**
  * What init prints about email sign-in on the iOS path: it already works, and
  * this is the one opt-in that adds the link.
@@ -46,5 +60,31 @@ export declare function stampCallbackScheme(clientDir: string, scheme: string):
 export declare function linkOptInGuidance(scheme: string, options?: {
     registered?: boolean;
 }): string[];
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export declare function universalLinkGuidance(options?: {
+    webOrigin?: string;
+    unverifiedDevCallback?: string;
+}): string[];
 /** What init says when the template predates the `PrimitiveAuth` URL type. */
 export declare function missingUrlTypeGuidance(scheme: string): string[];

package/dist/src/lib/init-ios-links.js

@@ -109,6 +109,26 @@ export function stampCallbackScheme(clientDir, scheme) {
     writeFileSync(plistPath, text.slice(0, dictStart) + rewritten + text.slice(dictEnd));
     return { outcome: "stamped" };
 }
+/**
+ * How to point an environment at the app's web origin — in the shape that
+ * actually works (#2982).
+ *
+ * `primitive env add` CREATES an environment: it requires `--api-url` and
+ * refuses a name the config already has. Every environment anyone reads this
+ * about already exists (init wrote `dev`; `prod` was added when the app was
+ * deployed), so the instruction for those has to be the file, which is also
+ * what the docs describe as the way to edit one. The flag is worth naming only
+ * where a new environment is being created.
+ *
+ * `origin` is the placeholder or real origin to show.
+ */
+export function setWebUrlInstruction(origin, indent = "  ") {
+    return [
+        `${indent}add "webUrl": "${origin}" to that environment in .primitive/config.json`,
+        `${indent}(\`primitive env add <name> --api-url … --web-url <origin>\` does this only for an`,
+        `${indent}environment it CREATES — it cannot edit one that already exists).`,
+    ];
+}
 /**
  * What init prints about email sign-in on the iOS path: it already works, and
  * this is the one opt-in that adds the link.
@@ -128,7 +148,11 @@ export function linkOptInGuidance(scheme, options = {}) {
     const redirectUri = iosMagicLinkRedirectUri(scheme);
     return [
         "Email sign-in works now: the email carries a 6-digit code and needs no app settings.",
-        `To ALSO send a sign-in link that opens this app, add "${redirectUri}" to the existing`,
+        "When this app gets a web client, prefer the https link: set the environment's `webUrl` —",
+        ...setWebUrlInstruction("https://<your-web-domain>"),
+        "  The email then carries that origin's /oauth/callback instead — one link that opens this",
+        "  app where it is installed and signs in through the browser anywhere else.",
+        `Until then, to ALSO send a sign-in link that opens this app, add "${redirectUri}" to the existing`,
         "  [auth].emailRedirectUris array in config/app.toml (merge it in — run",
         "  `primitive config pull --only app` first if that file is not there yet), then run",
         "  `primitive config push --only app` and set `authManager.sendsEmailSignInLink = true`.",
@@ -140,6 +164,47 @@ export function linkOptInGuidance(scheme, options = {}) {
         "  authentication.md docs page — 'Make the emailed sign-in link open your app'.",
     ];
 }
+/**
+ * What init prints for an app with BOTH clients: the emailed sign-in link is
+ * already the web app's https callback, and this is what it takes to make that
+ * link open the iOS app in production (#2982).
+ *
+ * Everything here is a post-deploy step by necessity — the production web
+ * domain does not exist at init time, and the deploy script never learns the
+ * URL it deployed to. The order is load-bearing: the `applinks:` entitlement
+ * is the ONLY thing that makes Apple fetch the association document, and
+ * Apple's CDN caches what it gets, so it goes last — after the deployed
+ * document has been verified.
+ *
+ * `webOrigin` is the dev origin the run seeded — set only when the run also
+ * confirmed that origin's `/oauth/callback` is on the app's allow-list, since
+ * that is what makes the seeded link work.
+ *
+ * `unverifiedDevCallback` is the opposite case: a combined app whose allow-list
+ * this run could not vouch for (an adopted app, or no credentials to ask with).
+ * Nothing was seeded — the app keeps its working code-only email — and the two
+ * steps that turn the link on are printed instead. Neither is set for an
+ * adopting run, which does not own the project config at all.
+ */
+export function universalLinkGuidance(options = {}) {
+    const lines = [
+        "This app has both an iOS and a web client, so its sign-in email carries ONE https link:",
+        "  the web app's /oauth/callback. Tapped where the iOS app is installed it opens the app;",
+        "  anywhere else it is an ordinary web sign-in. The 6-digit code still works everywhere.",
+    ];
+    if (options.webOrigin) {
+        lines.push(`In dev that link is ${options.webOrigin}/oauth/callback — seeded as the environment's`, "  `webUrl`, and allow-listed on the app. Nothing to do.");
+    }
+    else if (options.unverifiedDevCallback) {
+        const origin = options.unverifiedDevCallback.replace(/\/oauth\/callback$/, "");
+        lines.push("The link is NOT on yet in dev: this app already existed, and its sign-in link allow-list", `  does not (or could not be checked to) carry ${options.unverifiedDevCallback}. Nothing was`, "  changed — the email stays code-only, which works. To turn the link on:", `  1. Merge "${options.unverifiedDevCallback}" into the existing [auth].emailRedirectUris`, "     array in config/app.toml (run `primitive config pull --only app` first if that file is", "     not there yet), then `primitive config push --only app`.", `  2. Then ${setWebUrlInstruction(origin, "")[0]}`, "     — the same edit the production steps below describe.");
+    }
+    else {
+        lines.push("Set `webUrl` on this app's environment to turn it on (this run did not write the", "  project config):", ...setWebUrlInstruction("https://<your-web-domain>"), "  Allow-list that origin's /oauth/callback in [auth].emailRedirectUris too.");
+    }
+    lines.push("For production, once the web app is deployed:", "  1. Set that environment's `webUrl` to the deployed origin —", ...setWebUrlInstruction("https://<your-web-domain>", "     "), "  2. Merge \"https://<your-web-domain>/oauth/callback\" into the existing", "     [auth].emailRedirectUris array in config/app.toml (run `primitive config pull --only app`", "     first if that file is not there yet), then `primitive config push --only app`.", "  3. In the web client, fill your Apple team and bundle ids into", "     public/.well-known/apple-app-site-association.example and rename it (drop .example).", "  4. Deploy, then verify: `curl -i https://<your-web-domain>/.well-known/apple-app-site-association`", "     must return 200, application/json and the JSON body — HTML means the SPA fallback answered.", "  5. Only then enable the `applinks:<your-web-domain>` entitlement in the iOS client's", "     project.yml (it needs a real DEVELOPMENT_TEAM) and reinstall the app.", "  Full checklist: the web client's public/.well-known/README.md, or the authentication", "  docs page — 'Make the emailed sign-in link open your app'.");
+    return lines;
+}
 /** What init says when the template predates the `PrimitiveAuth` URL type. */
 export function missingUrlTypeGuidance(scheme) {
     return [

package/dist/src/lib/init-ios-links.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-ios-links.js","sourceRoot":"","sources":["../../../src/lib/init-ios-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,SAAiB;IAClE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,KAAa,EACb,aAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,MAAM,GACV,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAChD,KAAK,CAAC;IACR,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,4BAA4B,WAAW,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAExD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEnF,MAAM,cAAc,GAClB,0EAA0E,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;IACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,sFAAsF;QACtF,yDAAyD,WAAW,mBAAmB;QACvF,wEAAwE;QACxE,qFAAqF;QACrF,yFAAyF;QACzF,UAAU;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,eAAe,MAAM,iEAAiE;kBACpF,QAAQ,4BAA4B,gDAAgD;QAC1F,kFAAkF;QAClF,gFAAgF;KACjF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO;QACL,mDAAmD,4BAA4B,mBAAmB;QAClG,aAAa,MAAM,qEAAqE;QACxF,wCAAwC,4BAA4B,gCAAgC;QACpG,mFAAmF;QACnF,gEAAgE;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"init-ios-links.js","sourceRoot":"","sources":["../../../src/lib/init-ios-links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,kEAAkE;AAClE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAyB,EAAE,SAAiB;IAClE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,KAAa,EACb,aAAsB;IAEtB,MAAM,KAAK,GAAG,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,MAAM,GACV,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC;QAChD,KAAK,CAAC;IACR,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,GAAG,MAAM,oBAAoB,CAAC;AACvC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,4BAA4B,WAAW,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAExD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAEnF,MAAM,cAAc,GAClB,0EAA0E,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC;IACjE,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAM,GAAG,IAAI;IAChE,OAAO;QACL,GAAG,MAAM,kBAAkB,MAAM,iDAAiD;QAClF,GAAG,MAAM,oFAAoF;QAC7F,GAAG,MAAM,mEAAmE;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO;QACL,sFAAsF;QACtF,0FAA0F;QAC1F,GAAG,oBAAoB,CAAC,2BAA2B,CAAC;QACpD,2FAA2F;QAC3F,6EAA6E;QAC7E,qEAAqE,WAAW,mBAAmB;QACnG,wEAAwE;QACxE,qFAAqF;QACrF,yFAAyF;QACzF,UAAU;YACR,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,eAAe,MAAM,iEAAiE;kBACpF,QAAQ,4BAA4B,gDAAgD;QAC1F,kFAAkF;QAClF,gFAAgF;KACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkE,EAAE;IAEpE,MAAM,KAAK,GAAG;QACZ,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;KAC1F,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,uBAAuB,OAAO,CAAC,SAAS,+CAA+C,EACvF,yDAAyD,CAC1D,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CACR,0FAA0F,EAC1F,iDAAiD,OAAO,CAAC,qBAAqB,eAAe,EAC7F,0EAA0E,EAC1E,eAAe,OAAO,CAAC,qBAAqB,8CAA8C,EAC1F,6FAA6F,EAC7F,+DAA+D,EAC/D,aAAa,oBAAoB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAClD,2DAA2D,CAC5D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,kFAAkF,EAClF,oBAAoB,EACpB,GAAG,oBAAoB,CAAC,2BAA2B,CAAC,EACpD,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,+CAA+C,EAC/C,+DAA+D,EAC/D,GAAG,oBAAoB,CAAC,2BAA2B,EAAE,OAAO,CAAC,EAC7D,2EAA2E,EAC3E,gGAAgG,EAChG,qFAAqF,EACrF,kEAAkE,EAClE,2FAA2F,EAC3F,sGAAsG,EACtG,kGAAkG,EAClG,wFAAwF,EACxF,4EAA4E,EAC5E,wFAAwF,EACxF,8DAA8D,CAC/D,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO;QACL,mDAAmD,4BAA4B,mBAAmB;QAClG,aAAa,MAAM,qEAAqE;QACxF,wCAAwC,4BAA4B,gCAAgC;QACpG,mFAAmF;QACnF,gEAAgE;KACjE,CAAC;AACJ,CAAC"}

package/dist/src/lib/integration-selector.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolve the identifier the `integrations tests` verbs take (issue #3000).
+ *
+ * The block-testing endpoints key on the composite `integration#<blockId>` and
+ * never check that the block exists, so an identifier that names no
+ * integration came back as an empty page rather than a 404: `tests list`
+ * printed "No test cases found." and `tests run-all` printed
+ * `Total Tests: 0 / Failed: 0` and exited 0. That is success-shaped in CI and
+ * indistinguishable from an integration that genuinely has no cases, so a
+ * typo, an integration KEY, or an ID from another app all read as "nothing to
+ * run".
+ *
+ * Resolving here — against the app's own integration list — is what makes
+ * `Total Tests: 0` mean "this integration exists and has no cases". The list
+ * is the one call that can answer both halves: it maps a key to its ID (keys
+ * are stored lowercased, so the match is case-insensitive) and it proves the
+ * identifier belongs to THIS app. Archived integrations are included, because
+ * their cases stay inspectable.
+ */
+export interface ResolvedIntegration {
+    integrationId: string;
+    /** The integration's key, when the summary carries one. */
+    integrationKey?: string;
+}
+/** The one method this resolver needs from `ApiClient`. */
+export interface IntegrationLister {
+    listIntegrations(appId: string, params?: {
+        status?: string;
+        cursor?: string;
+        limit?: number;
+    }): Promise<{
+        items: any[];
+        nextCursor?: string | null;
+    }>;
+}
+/**
+ * Map an integration ID or key to its integration ID.
+ *
+ * Throws — naming the identifier — when nothing in the app matches, so the
+ * caller's existing catch prints the message and exits non-zero.
+ */
+export declare function resolveIntegrationSelector(client: IntegrationLister, appId: string, selector: string): Promise<ResolvedIntegration>;

package/dist/src/lib/integration-selector.js

@@ -0,0 +1,46 @@
+/**
+ * Resolve the identifier the `integrations tests` verbs take (issue #3000).
+ *
+ * The block-testing endpoints key on the composite `integration#<blockId>` and
+ * never check that the block exists, so an identifier that names no
+ * integration came back as an empty page rather than a 404: `tests list`
+ * printed "No test cases found." and `tests run-all` printed
+ * `Total Tests: 0 / Failed: 0` and exited 0. That is success-shaped in CI and
+ * indistinguishable from an integration that genuinely has no cases, so a
+ * typo, an integration KEY, or an ID from another app all read as "nothing to
+ * run".
+ *
+ * Resolving here — against the app's own integration list — is what makes
+ * `Total Tests: 0` mean "this integration exists and has no cases". The list
+ * is the one call that can answer both halves: it maps a key to its ID (keys
+ * are stored lowercased, so the match is case-insensitive) and it proves the
+ * identifier belongs to THIS app. Archived integrations are included, because
+ * their cases stay inspectable.
+ */
+import { paginateAll } from "./paginate.js";
+/**
+ * Map an integration ID or key to its integration ID.
+ *
+ * Throws — naming the identifier — when nothing in the app matches, so the
+ * caller's existing catch prints the message and exits non-zero.
+ */
+export async function resolveIntegrationSelector(client, appId, selector) {
+    const identifier = (selector ?? "").trim();
+    if (!identifier) {
+        throw new Error("An integration ID or key is required.");
+    }
+    const items = await paginateAll((cursor) => client.listIntegrations(appId, cursor ? { cursor } : {}));
+    const lowered = identifier.toLowerCase();
+    const match = items.find((item) => item?.integrationId === identifier) ??
+        items.find((item) => typeof item?.integrationKey === "string" &&
+            item.integrationKey.toLowerCase() === lowered);
+    if (!match) {
+        throw new Error(`No integration '${identifier}' in app ${appId}. ` +
+            `Pass an integration key or ID from 'primitive integrations list'.`);
+    }
+    return {
+        integrationId: match.integrationId ?? identifier,
+        ...(match.integrationKey ? { integrationKey: match.integrationKey } : {}),
+    };
+}
+//# sourceMappingURL=integration-selector.js.map

package/dist/src/lib/integration-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-selector.js","sourceRoot":"","sources":["../../../src/lib/integration-selector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgB5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAyB,EACzB,KAAa,EACb,QAAgB;IAEhB,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAM,CAAC,MAAM,EAAE,EAAE,CAC9C,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD,CAAC;IAEF,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,UAAU,CAAC;QACxD,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ;YACxC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,OAAO,CAChD,CAAC;IAEJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,mBAAmB,UAAU,YAAY,KAAK,IAAI;YAChD,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,UAAU;QAChD,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC"}