primitive-admin 1.1.0-alpha.8 → 1.1.0-alpha.80

package/dist/src/lib/confirm-prompt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export declare class ConfirmPromptError extends Error {
+    constructor(message: string);
+}
+/**
+ * Shape of the `@inquirer/prompts` `confirm()` function. Injectable for testing.
+ *
+ * Note (#999): this shifted from the legacy inquirer questions-array →
+ * `{ confirm: boolean }` shape to the modern bare `{ message, default }` →
+ * `Promise<boolean>` shape.
+ */
+export type PromptFn = (config: {
+    message: string;
+    default?: boolean;
+}) => Promise<boolean>;
+export interface ConfirmPromptOptions {
+    /** Default answer when the user just presses enter. Defaults to false. */
+    defaultValue?: boolean;
+    /**
+     * Override the underlying prompt function (for tests). Defaults to lazily
+     * importing `@inquirer/prompts` `confirm`.
+     */
+    promptFn?: PromptFn;
+    /**
+     * Override TTY detection (for tests). Defaults to `process.stdin.isTTY`.
+     */
+    isTTY?: boolean;
+}
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export declare function confirmPrompt(message: string, options?: ConfirmPromptOptions): Promise<boolean>;

package/dist/src/lib/confirm-prompt.js

@@ -0,0 +1,110 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export class ConfirmPromptError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfirmPromptError";
+    }
+}
+async function defaultPromptFn(config) {
+    const { confirm } = await import("@inquirer/prompts");
+    return confirm(config);
+}
+/**
+ * Names of the catchable abort errors thrown by `@inquirer/prompts` when the
+ * user interrupts a prompt (Ctrl-C / SIGINT / force-close / abort signal /
+ * cancel). We match on `name` (not just `instanceof`) so detection is robust to
+ * the error class being duplicated across module realms.
+ */
+const ABORT_ERROR_NAMES = new Set([
+    "ExitPromptError",
+    "AbortPromptError",
+    "CancelPromptError",
+]);
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export async function confirmPrompt(message, options = {}) {
+    const isTTY = options.isTTY ?? Boolean(process.stdin.isTTY);
+    if (!isTTY) {
+        throw new ConfirmPromptError("No interactive terminal available to confirm this action. " +
+            "Re-run with --yes (-y) to skip the confirmation prompt in " +
+            "non-interactive contexts (CI, pipes, agents).");
+    }
+    const promptFn = options.promptFn ?? defaultPromptFn;
+    try {
+        const confirmed = await promptFn({
+            message,
+            default: options.defaultValue ?? false,
+        });
+        return Boolean(confirmed);
+    }
+    catch (err) {
+        // A deliberate abort/EOF/Ctrl-C/Ctrl-D — either the modern
+        // `@inquirer/prompts` `ExitPromptError`/`AbortPromptError`/`CancelPromptError`
+        // (matched by name to survive cross-realm `instanceof` mismatches), or the
+        // legacy inquirer `ERR_USE_AFTER_CLOSE`. Surface as a clean, actionable
+        // error so the caller exits 1 with no stack trace / bare `Node.js vX` banner.
+        if (ABORT_ERROR_NAMES.has(err?.name) ||
+            err?.code === "ERR_USE_AFTER_CLOSE") {
+            throw new ConfirmPromptError("Confirmation cancelled (no interactive input). " +
+                "Re-run with --yes (-y) to skip confirmation.");
+        }
+        // Any other prompt failure: still surface it as a clean, catchable error
+        // rather than letting it escape as an uncaught crash.
+        throw new ConfirmPromptError(err?.message
+            ? `Confirmation prompt failed: ${err.message}`
+            : "Confirmation prompt failed.");
+    }
+}
+//# sourceMappingURL=confirm-prompt.js.map

package/dist/src/lib/confirm-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-prompt.js","sourceRoot":"","sources":["../../../src/lib/confirm-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AA4BD,KAAK,UAAU,eAAe,CAAC,MAG9B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAC1B,4DAA4D;YAC1D,4DAA4D;YAC5D,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC;YAC/B,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2DAA2D;QAC3D,+EAA+E;QAC/E,2EAA2E;QAC3E,wEAAwE;QACxE,8EAA8E;QAC9E,IACE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;YAChC,GAAG,EAAE,IAAI,KAAK,qBAAqB,EACnC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,iDAAiD;gBAC/C,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EAAE,OAAO;YACV,CAAC,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE;YAC9C,CAAC,CAAC,6BAA6B,CAClC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/lib/constants.d.ts

@@ -0,0 +1,11 @@
+export declare const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export declare const DEFAULT_SERVER_URL: string;
+/**
+ * The alpha deployment's canonical server URL. Mirrors
+ * `wrangler.toml [env.alpha] WORKER_URL` — keep the two in sync; if the alpha
+ * URL ever changes, update both. Used only by `primitive guides` to detect the
+ * alpha target and fetch guides from the `primitive-docs` `next` branch instead
+ * of `main` (issue #1463). This is an internal-only convenience;
+ * security-through-obscurity is acceptable.
+ */
+export declare const ALPHA_SERVER_URL = "https://js-bao-wss-alpha.primitive-labs-dev.workers.dev";

package/dist/src/lib/constants.js

@@ -0,0 +1,12 @@
+export const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export const DEFAULT_SERVER_URL = process.env.PRIMITIVE_SERVER_URL || PRODUCTION_SERVER_URL;
+/**
+ * The alpha deployment's canonical server URL. Mirrors
+ * `wrangler.toml [env.alpha] WORKER_URL` — keep the two in sync; if the alpha
+ * URL ever changes, update both. Used only by `primitive guides` to detect the
+ * alpha target and fetch guides from the `primitive-docs` `next` branch instead
+ * of `main` (issue #1463). This is an internal-only convenience;
+ * security-through-obscurity is acceptable.
+ */
+export const ALPHA_SERVER_URL = "https://js-bao-wss-alpha.primitive-labs-dev.workers.dev";
+//# sourceMappingURL=constants.js.map

package/dist/src/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,yDAAyD,CAAC"}

package/dist/src/lib/crash-handlers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export declare function installGlobalCrashHandlers(): void;

package/dist/src/lib/crash-handlers.js

@@ -0,0 +1,49 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+import { error } from "./output.js";
+function describe(err) {
+    if (err && typeof err === "object") {
+        const e = err;
+        // The signature crash from a non-TTY confirm prompt — give actionable help.
+        if (e.code === "ERR_USE_AFTER_CLOSE") {
+            return ("No interactive terminal available to confirm this action. " +
+                "Re-run with --yes (-y) to skip the confirmation prompt in " +
+                "non-interactive contexts (CI, pipes, agents).");
+        }
+        if (e.message)
+            return e.message;
+    }
+    return "An unexpected error occurred.";
+}
+let installed = false;
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export function installGlobalCrashHandlers() {
+    if (installed)
+        return;
+    installed = true;
+    process.on("uncaughtException", (err) => {
+        error(describe(err));
+        process.exit(1);
+    });
+    process.on("unhandledRejection", (reason) => {
+        error(describe(reason));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=crash-handlers.js.map

package/dist/src/lib/crash-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-handlers.js","sourceRoot":"","sources":["../../../src/lib/crash-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAA0C,CAAC;QACrD,4EAA4E;QAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACrC,OAAO,CACL,4DAA4D;gBAC5D,4DAA4D;gBAC5D,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/lib/credentials-store.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Credentials storage with dual-mode support.
+ *
+ * Credentials are tokens and who they belong to, and nothing else: the app an
+ * invocation runs against is the resolved environment's `appId` (#3152), never
+ * a slot in this file.
+ *
+ * Mode A (project mode): credentials live at
+ *   <projectRoot>/.primitive/credentials.json
+ * with per-environment slots:
+ *   {
+ *     "environments": {
+ *       "dev":  { "accessToken": "...", "refreshToken": "...", ... },
+ *       "prod": { ... }
+ *     }
+ *   }
+ *
+ * Mode B (global mode): no primitive/config.json in scope, so we fall back to
+ *   ~/.primitive/credentials.json
+ * with the flat Credentials shape the CLI has always used.
+ *
+ * Mode B is NOT a default any more (#3154, intent criterion 5). It used to be
+ * the silent answer for every command run outside a project, which is how an
+ * app-scoped command could quietly operate against whatever server the last
+ * `login` happened to target. Now a command has to say out loud that it may
+ * work outside a project, by calling `allowGlobalCredentials()` in its own
+ * action; every other command gets `missing-config` here instead of a file.
+ *
+ * Exactly four commands say it: `login`, which creates the file; `logout`,
+ * which is the only way to clear what login wrote; `init`, which must call the
+ * API before a project can exist; and `bootstrap`, which creates the first
+ * super-admin on an empty no-OAuth database and therefore cannot be inside a
+ * project either. The last two are the divergence from the intent's "login and
+ * init and nothing else", adjudicated on #3154 as finding F1.
+ *
+ * The opt-in is per ACTION, not per argv: `primitive --env prod login` and
+ * `primitive login` reach the same line, so there is no flag shape for a
+ * pre-parse to miss. And it only PERMITS the global file — inside a project
+ * all four still use the per-environment slots.
+ */
+import type { Credentials } from "../types/index.js";
+export declare const PROJECT_LOCAL_DIR = ".primitive";
+export declare const PROJECT_CREDENTIALS_FILENAME = "credentials.json";
+/** Returns true when a primitive/config.json is in scope (project mode active). */
+export declare function isProjectMode(): boolean;
+/**
+ * Returns the path to the credentials file that will be used, based on
+ * whether we're in project mode or legacy mode.
+ */
+export declare function getCredentialsFilePath(): string;
+/**
+ * Declare that THIS command may fall back to `~/.primitive/credentials.json`
+ * when no project is in scope. Called at the top of `login`, `logout`, `init`
+ * and `bootstrap`, and nowhere else.
+ */
+export declare function allowGlobalCredentials(): void;
+/**
+ * Drop the declaration again. One invocation runs one command, so nothing in
+ * the CLI calls this — it exists so a test file can exercise both sides of the
+ * boundary in one process, the way `resetEnvResolver()` does for the resolver.
+ */
+export declare function resetGlobalCredentialsAllowance(): void;
+/**
+ * Reads credentials for the current environment (project mode) or the
+ * legacy global file. Returns the standard Credentials shape so existing
+ * callers don't need to change.
+ *
+ * In project mode, we blend the per-env stored creds with the serverUrl
+ * and appId from primitive/config.json to produce the Credentials the rest of
+ * the CLI expects.
+ */
+export declare function loadCredentialsStore(): Credentials | null;
+/**
+ * Saves credentials. In project mode, writes to the per-env slot in the
+ * project credentials file. In legacy mode, writes the global file.
+ *
+ * The serverUrl on the incoming Credentials is used as-is for legacy
+ * mode, and ignored in project mode (the env's apiUrl is canonical).
+ */
+export declare function saveCredentialsStore(credentials: Credentials): void;
+/**
+ * Clears credentials for the current environment (project mode) or
+ * deletes the legacy file (legacy mode).
+ */
+export declare function clearCredentialsStore(): void;
+/**
+ * Removes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `env remove` so stale tokens from a
+ * previously-removed environment can never be silently re-used if the same
+ * name is later added back. Never throws.
+ */
+export declare function clearCredentialsForEnvInProject(projectRoot: string, envName: string): void;
+/**
+ * Writes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `primitive init` to carry the session
+ * it just authenticated into the freshly scaffolded project, so the first
+ * in-project CLI command works without a second `primitive login`.
+ */
+export declare function seedCredentialsForEnvInProject(projectRoot: string, envName: string, credentials: Credentials): void;
+/**
+ * Lists all environments that have stored credentials in project mode.
+ * Returns an empty array in legacy mode.
+ */
+export declare function listAuthenticatedEnvironments(): string[];