primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/server-url.js

@@ -0,0 +1,33 @@
+/**
+ * The one server-URL validator the CLI shares (issue #2927).
+ *
+ * It returns the `string | true` shape `@inquirer/prompts` expects from a
+ * `validate` callback, so the same function backs the `primitive init` prompt,
+ * the `--server` flag check and init-config validation, `project-config.ts`'s
+ * `apiUrl` check, and `env add --api-url`. It used to live in the
+ * init-specific `resolve-init-server.ts` while the last two hand-rolled their
+ * own `try { new URL(x) } catch`.
+ *
+ * The parse deliberately runs on the *raw* string: JavaScript `trim()` strips
+ * Unicode whitespace (U+00A0, U+2028, U+FEFF, …) that the WHATWG URL parser
+ * does not, so trimming first would accept values like `" https://x"`
+ * that later URL construction cannot use — and `env add` would persist them.
+ * `trim()` is therefore used only to decide whether the input is empty; the
+ * URL parser already ignores the ASCII padding it is willing to strip.
+ */
+/**
+ * Validates a server URL. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export function validateServerUrl(url) {
+    if (typeof url !== "string" || !url.trim())
+        return "Server URL cannot be empty";
+    try {
+        new URL(url);
+        return true;
+    }
+    catch {
+        return "Please enter a valid URL (e.g., https://example.com)";
+    }
+}
+//# sourceMappingURL=server-url.js.map

package/dist/src/lib/server-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-url.js","sourceRoot":"","sources":["../../../src/lib/server-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,4BAA4B,CAAC;IAChF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sDAAsD,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/src/lib/signing-secret-status.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Platform ceiling on a webhook's `secretGracePeriodMs`, mirrored from the
+ * server's `MAX_SECRET_GRACE_PERIOD_MS` (#2383). Read-only now: the field is
+ * authored as `webhook.secretGracePeriodMs` and applied by `config push` (#2645),
+ * so this ceiling is used to RENDER a stored value, not to pre-validate a flag.
+ * The server remains the authority and returns
+ * `SECRET_GRACE_PERIOD_OUT_OF_RANGE` on a bad push.
+ */
+export declare const MAX_SECRET_GRACE_PERIOD_MS: number;
+/**
+ * The platform default applied when a webhook stores no `secretGracePeriodMs`,
+ * mirrored from the server's `DEFAULT_SECRET_GRACE_PERIOD_MS` (#2383). Only
+ * used to label the unset case on a read surface — nothing is computed from it
+ * CLI-side.
+ */
+export declare const DEFAULT_SECRET_GRACE_PERIOD_MS: number;
+/**
+ * Render a webhook's stored `secretGracePeriodMs` for a read surface.
+ *
+ * A stored `0` and an absent field mean opposite things — immediate cutover vs
+ * the 24 h platform default — so they must not render the same. Naming the
+ * default explicitly matches how `Max Body Bytes` reports its own unset case.
+ */
+export declare function formatGracePeriodMs(value: number | null | undefined): string;
+/**
+ * The operator-facing warning for a webhook whose stored `signingSecret` is not
+ * a `{{secrets.KEY}}` reference (#2332).
+ *
+ * Two commands report it — `webhooks get` on a single row and `config pull` on
+ * every pulled row — and each has two statuses to describe. Those four strings
+ * were written out in full and had already drifted twice, so the wording lives
+ * here once and the call sites supply only what genuinely differs: how the
+ * field is named in that context, and what the un-migrated value blocks.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export declare function signingSecretStatusWarning(status: string | null | undefined, context: {
+    /** How to name the field, e.g. `"Signing secret"`. Starts the sentence. */
+    subject: string;
+    /** What an un-migrated value blocks, e.g. `"this webhook cannot be updated"`. */
+    blocks: string;
+}): string | null;
+/**
+ * The operator-facing warning for a stored signing secret whose HEALTH is not
+ * `ok` — the second axis the server reports alongside the status (#2383).
+ *
+ * Written as "anything that is not `ok` needs attention" rather than as a list
+ * of known members, so a member a newer server adds is surfaced rather than
+ * silently read as fine. `signingSecretStatusWarning` above deliberately keeps
+ * the opposite rule for the STATUS axis, whose union is closed.
+ *
+ * Returns `null` for `ok`, for an absent field (a server that predates the
+ * health axis), and when the slot holds nothing to assess.
+ */
+export declare function signingSecretHealthWarning(health: string | null | undefined, context: {
+    /** How to name the field, e.g. `"Signing secret"`. Starts the sentence. */
+    subject: string;
+}): string | null;
+/**
+ * The warning for the GRACE SLOT — a value in `previousSigningSecret` that the
+ * receiver still accepts until the rotation window closes.
+ *
+ * Split from the current-slot wording because the remediation differs: there is
+ * nothing to migrate here, the value simply has to stop being accepted.
+ *
+ * The two statuses need separate wording, because only one of them describes
+ * live credential material. A `legacy-literal` in this slot is grandfathered
+ * and really does keep verifying deliveries until the window closes, so
+ * `secretGracePeriodMs` is the operator's lever. A `malformed-reference` is
+ * dropped by the receiver before it reaches the verifier
+ * (`webhook-receiver.ts`: an unresolved previous reference yields no grace
+ * key), so it verifies nothing and lowering the grace period does nothing to
+ * it — telling the operator otherwise points them at a knob with no effect.
+ * This is the same distinction `signingSecretStatusWarning` draws for the
+ * current slot.
+ */
+export declare function previousSigningSecretWarning(status: string | null | undefined, context: {
+    /** How to name the row, e.g. `"webhooks/foo.toml: 'foo'"`. */
+    subject: string;
+}): string | null;

package/dist/src/lib/signing-secret-status.js

@@ -0,0 +1,116 @@
+/**
+ * Platform ceiling on a webhook's `secretGracePeriodMs`, mirrored from the
+ * server's `MAX_SECRET_GRACE_PERIOD_MS` (#2383). Read-only now: the field is
+ * authored as `webhook.secretGracePeriodMs` and applied by `config push` (#2645),
+ * so this ceiling is used to RENDER a stored value, not to pre-validate a flag.
+ * The server remains the authority and returns
+ * `SECRET_GRACE_PERIOD_OUT_OF_RANGE` on a bad push.
+ */
+export const MAX_SECRET_GRACE_PERIOD_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * The platform default applied when a webhook stores no `secretGracePeriodMs`,
+ * mirrored from the server's `DEFAULT_SECRET_GRACE_PERIOD_MS` (#2383). Only
+ * used to label the unset case on a read surface — nothing is computed from it
+ * CLI-side.
+ */
+export const DEFAULT_SECRET_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
+/**
+ * Render a webhook's stored `secretGracePeriodMs` for a read surface.
+ *
+ * A stored `0` and an absent field mean opposite things — immediate cutover vs
+ * the 24 h platform default — so they must not render the same. Naming the
+ * default explicitly matches how `Max Body Bytes` reports its own unset case.
+ */
+export function formatGracePeriodMs(value) {
+    if (value === undefined || value === null) {
+        return `default (${DEFAULT_SECRET_GRACE_PERIOD_MS}ms, 24 h)`;
+    }
+    return `${value}ms`;
+}
+/**
+ * The operator-facing warning for a webhook whose stored `signingSecret` is not
+ * a `{{secrets.KEY}}` reference (#2332).
+ *
+ * Two commands report it — `webhooks get` on a single row and `config pull` on
+ * every pulled row — and each has two statuses to describe. Those four strings
+ * were written out in full and had already drifted twice, so the wording lives
+ * here once and the call sites supply only what genuinely differs: how the
+ * field is named in that context, and what the un-migrated value blocks.
+ *
+ * Returns `null` for a status that needs no warning (`reference`, `unset`, or
+ * anything a newer server adds), so a call site is one `if` rather than two.
+ */
+export function signingSecretStatusWarning(status, context) {
+    const remediation = 'Store the value with `primitive secrets set KEY --value <value>` and set signingSecret = "{{secrets.KEY}}".';
+    if (status === "legacy-literal") {
+        return (`${context.subject} still holds a raw value. Deliveries still verify, but ` +
+            `${context.blocks} until it is migrated. ${remediation}`);
+    }
+    // Not a working legacy literal: the stored value carries reference syntax
+    // that resolves to nothing, so it is not a usable signing key and every
+    // signed delivery is already being rejected.
+    if (status === "malformed-reference") {
+        return (`${context.subject} is neither a {{secrets.KEY}} reference nor a plain stored value — ` +
+            "it carries reference syntax that does not resolve, so every signed delivery is being REJECTED. " +
+            `${remediation}`);
+    }
+    return null;
+}
+/**
+ * The operator-facing warning for a stored signing secret whose HEALTH is not
+ * `ok` — the second axis the server reports alongside the status (#2383).
+ *
+ * Written as "anything that is not `ok` needs attention" rather than as a list
+ * of known members, so a member a newer server adds is surfaced rather than
+ * silently read as fine. `signingSecretStatusWarning` above deliberately keeps
+ * the opposite rule for the STATUS axis, whose union is closed.
+ *
+ * Returns `null` for `ok`, for an absent field (a server that predates the
+ * health axis), and when the slot holds nothing to assess.
+ */
+export function signingSecretHealthWarning(health, context) {
+    if (health === undefined || health === null || health === "ok")
+        return null;
+    if (health === "weak-literal") {
+        return (`${context.subject} is a short raw value — too short to be a strong ` +
+            "HMAC key, so a sender's signature is easier to forge. Deliveries still " +
+            "verify; replace it with a strong value stored as a secret: " +
+            '`primitive secrets set KEY --value <value>`, then set signingSecret = "{{secrets.KEY}}".');
+    }
+    return (`${context.subject} was reported as '${health}' by the server, which this ` +
+        "CLI does not recognize — upgrade the CLI for the full explanation.");
+}
+/**
+ * The warning for the GRACE SLOT — a value in `previousSigningSecret` that the
+ * receiver still accepts until the rotation window closes.
+ *
+ * Split from the current-slot wording because the remediation differs: there is
+ * nothing to migrate here, the value simply has to stop being accepted.
+ *
+ * The two statuses need separate wording, because only one of them describes
+ * live credential material. A `legacy-literal` in this slot is grandfathered
+ * and really does keep verifying deliveries until the window closes, so
+ * `secretGracePeriodMs` is the operator's lever. A `malformed-reference` is
+ * dropped by the receiver before it reaches the verifier
+ * (`webhook-receiver.ts`: an unresolved previous reference yields no grace
+ * key), so it verifies nothing and lowering the grace period does nothing to
+ * it — telling the operator otherwise points them at a knob with no effect.
+ * This is the same distinction `signingSecretStatusWarning` draws for the
+ * current slot.
+ */
+export function previousSigningSecretWarning(status, context) {
+    if (status === "legacy-literal") {
+        return (`${context.subject}: the ROTATED-OUT signing secret is a raw stored value, ` +
+            "not a {{secrets.KEY}} reference. It keeps verifying deliveries until the " +
+            "rotation grace window closes (secretRotatedAt + secretGracePeriodMs). To " +
+            "stop accepting it sooner, lower secretGracePeriodMs (0 cuts over immediately).");
+    }
+    if (status === "malformed-reference") {
+        return (`${context.subject}: the ROTATED-OUT signing secret carries reference syntax ` +
+            "that does not resolve, so it verifies nothing — it is inert, not a live " +
+            "grace key, and secretGracePeriodMs has no effect on it. No action is " +
+            "required; it clears on the next rotation.");
+    }
+    return null;
+}
+//# sourceMappingURL=signing-secret-status.js.map

package/dist/src/lib/signing-secret-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-secret-status.js","sourceRoot":"","sources":["../../../src/lib/signing-secret-status.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAGlE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,YAAY,8BAA8B,WAAW,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC,EACjC,OAKC;IAED,MAAM,WAAW,GACf,6GAA6G,CAAC;IAChH,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,yDAAyD;YAC3E,GAAG,OAAO,CAAC,MAAM,0BAA0B,WAAW,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,qEAAqE;YACvF,iGAAiG;YACjG,GAAG,WAAW,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC,EACjC,OAGC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,mDAAmD;YACrE,yEAAyE;YACzE,6DAA6D;YAC7D,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,qBAAqB,MAAM,8BAA8B;QAC3E,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAiC,EACjC,OAGC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,0DAA0D;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,4DAA4D;YAC9E,0EAA0E;YAC1E,uEAAuE;YACvE,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/skill-installer.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Skills for Primitive-Labs members only. Not bundled with the CLI — fetched
+ * from the private js-bao-wss repo via `gh`, so repo access is the gate.
+ *
+ * Each entry lists every file the installed skill needs, as (repo path,
+ * path inside the installed skill directory). A skill is installed
+ * all-or-nothing: one missing file and the existing copy is kept.
+ */
+interface FetchedFile {
+    /** Path inside Primitive-Labs/js-bao-wss (main branch). */
+    repoPath: string;
+    /** Path relative to the installed skill directory. */
+    localPath: string;
+}
+interface FetchedSkill {
+    name: string;
+    files: FetchedFile[];
+}
+export declare const FETCHED_SKILLS: FetchedSkill[];
+export declare function getCliVersion(): string | null;
+/**
+ * Returns true if the skill is currently installed.
+ */
+export declare function isSkillInstalled(): boolean;
+/**
+ * Read one file of the private js-bao-wss repo (main branch) via the GitHub
+ * contents API through `gh`. Returns null if gh is missing, unauthenticated,
+ * or the caller lacks access to the repo — access failure is how non-members
+ * are gated.
+ *
+ * `PRIMITIVE_SKILL_SOURCE_DIR` reads the same repo paths from a local
+ * checkout instead, to try a skill edit before it is merged (and for the
+ * unit tests, which install from this repo's own files).
+ */
+export declare function fetchRepoFile(repoPath: string): Promise<string | null>;
+/**
+ * Auto-update an already-installed skill if a newer version is bundled.
+ * Called after command execution for non-init, non-skill commands.
+ * If the skill is not installed, shows a non-blocking hint instead.
+ * Never throws — fails silently like version-check.
+ */
+export declare function checkSkillStatus(): Promise<void>;
+/**
+ * Explicitly install or reinstall the skill. Shows output.
+ * Also installs the members' skills (primitive-platform-internal and
+ * file-issue) when the caller has access to the private repo
+ * (Primitive-Labs members); silently skipped otherwise.
+ */
+export declare function installSkillExplicit(): Promise<boolean>;
+/**
+ * Uninstall the skill (and the members' skills, if present).
+ */
+export declare function uninstallSkill(): boolean;
+export interface SkillStatusReport {
+    installedHash: string | null;
+    bundledHash: string | null;
+    location: string;
+    /** One entry per members' skill: hash and the CLI version that fetched it, or null when not installed. */
+    fetched: Record<string, {
+        hash: string;
+        cliVersion: string;
+        location: string;
+    } | null>;
+}
+/** The data `skillStatus()` prints; exported so tests can read it directly. */
+export declare function getSkillStatus(): SkillStatusReport;
+/**
+ * Show current skill installation status.
+ */
+export declare function skillStatus(): void;
+export {};