primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/config-surface.js

@@ -0,0 +1,368 @@
+/**
+ * The CLI's view of the configuration-object definitions (issue #2644).
+ *
+ * Everything here reads the committed, build-time-vendored artifact
+ * `generated-config-surfaces.ts` — the CLI never imports server `src/` at
+ * runtime. This module is the small amount of CLI-side wiring on top: table
+ * lookup that fails loudly, and the two unrecognized-key behaviors the design
+ * gate settled (2026-08-12):
+ *
+ *   - `config push` REJECTS any TOML key a definition does not recognize, so a
+ *     mistyped key fails locally instead of being silently dropped.
+ *   - `config pull` WARNS about any server key this CLI version does not know and
+ *     does NOT write it to the file. Writing it through would set a trap: the
+ *     next push would reject the key it had just written. A version-gap round
+ *     trip is therefore loud-and-lossy — push omits what it does not know, so
+ *     the server keeps its stored values — never silently destructive.
+ */
+import { GENERATED_CONFIG_MODEL_FIELDS, acceptedTomlKeys, findUnknownGroupedTomlKeys, tomlGroupsOf, retiredConfigKey, findMisshapenTomlTables, findUnknownTomlDocumentKeys, getConfigSurface, getConfigTable, recognizedResponseKeys, } from "./generated-config-surfaces.js";
+// #2645/#2803 — the guidance for a key a definition deliberately RETIRED. Its
+// text is vendored with the definitions so `config push` and the server's
+// create/update handlers say the same thing about the same key.
+export { retiredConfigKey };
+// #3626 — keys inside a `[configs.<group>]` block that no field declares
+// under it. Re-exported beside `findUnknownTomlKeys` so a caller checking a
+// table's keys needs one import for both halves of the same question.
+export { findUnknownGroupedTomlKeys };
+/** A surface by label. Throws rather than silently skipping checks. */
+export function requireConfigSurface(label) {
+    const surface = getConfigSurface(label);
+    if (!surface) {
+        throw new Error(`config-surface: no definition for "${label}". ` +
+            "Run `node cli/scripts/gen-config-surfaces.mjs`.");
+    }
+    return surface;
+}
+/** A table by label and TOML path. Throws rather than silently skipping checks. */
+export function requireConfigTable(label, tomlPath) {
+    const table = getConfigTable(label, tomlPath);
+    if (!table) {
+        throw new Error(`config-surface: no definition for "${label}" [${tomlPath.join(".")}]. ` +
+            "Run `node cli/scripts/gen-config-surfaces.mjs`.");
+    }
+    return table;
+}
+/** The `[workflow]` table — the first migrated object (#2644 phase 1). */
+export const WORKFLOW_TABLE = requireConfigTable("workflow", ["workflow"]);
+// The six flat per-entity objects (#2644 phase 2). Resolved once, at module
+// load, so a missing or misspelled definition fails immediately and loudly
+// rather than at the moment someone runs a pull.
+export const PROMPT_TABLE = requireConfigTable("prompt", ["prompt"]);
+export const PROMPT_CONFIG_TABLE = requireConfigTable("prompt", ["configs"]);
+export const INTEGRATION_TABLE = requireConfigTable("integration", [
+    "integration",
+]);
+export const WEBHOOK_TABLE = requireConfigTable("webhook", ["webhook"]);
+export const CRON_TRIGGER_TABLE = requireConfigTable("cron-trigger", [
+    "cronTrigger",
+]);
+export const BLOB_BUCKET_TABLE = requireConfigTable("blob-bucket", ["bucket"]);
+export const EMAIL_TEMPLATE_TABLE = requireConfigTable("email-template", [
+    "template",
+]);
+// #3179 — the `[function]` table. One table over the HEADER model; the three
+// version-carried keys (`entry`, `mode`, `limits`) are declared beside `key`
+// in its `tomlOnlyKeys`, because an author writes a function, never a version.
+export const SERVER_FUNCTION_TABLE = requireConfigTable("function", [
+    "function",
+]);
+// The five structured objects (#2644 phase 3). Their authored sub-trees —
+// `[rules]`, `[models.*]`, `[triggers]`, the `[metadata]` manifest — keep the
+// validators that already own them; these tables are the scalar surface.
+export const DATABASE_TYPE_TABLE = requireConfigTable("database-type-config", ["type"]);
+export const RULE_SET_TABLE = requireConfigTable("rule-set", ["ruleSet"]);
+export const GROUP_TYPE_CONFIG_TABLE = requireConfigTable("group-type-config", [
+    "groupTypeConfig",
+]);
+export const COLLECTION_TYPE_CONFIG_TABLE = requireConfigTable("collection-type-config", ["collectionTypeConfig"]);
+export const METADATA_CATEGORY_CONFIG_TABLE = requireConfigTable("metadata-category-config", ["metadataCategoryConfig"]);
+/**
+ * The `[test]` table of a `<key>.tests/*.toml` sidecar (#2644 phase 3).
+ *
+ * Test cases are a registered surface but NOT a `SYNC_RESOURCE_TYPES`
+ * directory, so the preflight that crosses the registry with that table never
+ * reaches them. Resolved here so the sidecar files get the same
+ * unrecognized-key posture as every per-entity file: push rejects a key the
+ * definition does not know, pull names a server key this CLI cannot manage.
+ */
+export const TEST_CASE_TABLE = requireConfigTable("test-case", ["test"]);
+/** The `test-case` surface itself, for the sidecars' document-shape check. */
+export const TEST_CASE_SURFACE = requireConfigSurface("test-case");
+/**
+ * The value a create materializes when the file omits `field`, as the
+ * definition records it — or `undefined` when the field has no such default.
+ *
+ * Read rather than repeated, so a caller that omits a value BECAUSE the server
+ * would assign it anyway (#3201's `[[configs]] status`) can never disagree
+ * with the default push sends for the same absent key.
+ */
+export function fieldServerDefault(table, field) {
+    return table.fields.find((f) => f.field === field)?.serverDefault;
+}
+/**
+ * Does this field's declared type genuinely admit more than one spelling
+ * (#2880 criterion 5)?
+ *
+ * Two sources, both recorded rather than inferred: the definition's own
+ * `dualEncoded` marker (the #2869 server-`StringField` numbers), and the `json`
+ * type, which `config pull` itself writes either as a native TOML table or —
+ * for a value TOML cannot hold — as JSON text.
+ */
+export function fieldAdmitsMultipleEncodings(field) {
+    return field.type === "json" || field.dualEncoded !== undefined;
+}
+/**
+ * Does this string spell a number the way the SERVER reads one back (#2880)?
+ *
+ * The grammar is `parseFloat`'s — sign, digits, one dot, an exponent, and
+ * nothing else — because that is what the server applies to the string it
+ * stored when it returns the value parsed. Published here so the declared-type
+ * validator and the comparator decide "is a number" the same way: a dual
+ * encoding the validator accepts must be one the comparison can equate, or
+ * `temperature = "warm"` passes preflight and then differs from the `null` the
+ * server reads it back as, on every run, with no push that can clear it.
+ */
+export function spellsDecimalNumber(value) {
+    const trimmed = value.trim();
+    if (!/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(trimmed)) {
+        return false;
+    }
+    return Number.isFinite(Number(trimmed));
+}
+/** How an author would name the declared type in a message. */
+function declaredTypeName(type) {
+    return type === "string[]" ? "list of strings" : type;
+}
+/** How the offending value spells itself, quoted the way TOML would. */
+function foundSpelling(value) {
+    if (typeof value === "string")
+        return `the string ${JSON.stringify(value)}`;
+    if (Array.isArray(value))
+        return "a list";
+    if (value === null)
+        return "an empty value";
+    if (typeof value === "object")
+        return "a table";
+    return `the ${typeof value} ${JSON.stringify(value)}`;
+}
+/**
+ * Does `value` match what `field` declares (#2880 criterion 5)?
+ *
+ * `null`/`undefined` are absence, which the emission rules and the push
+ * builders already own; a `json` field takes a table or its JSON text; a
+ * dual-encoded number takes the number or a string spelling of one. Everything
+ * else is the declared type and nothing else — no coercion, here or anywhere.
+ */
+function valueMatchesDeclaredType(field, value) {
+    if (value === undefined || value === null)
+        return true;
+    switch (field.type) {
+        case "json":
+            // Either transport spelling; whether the TEXT parses is the JSON
+            // validators' question, per type (`testCaseSidecarErrors` and friends).
+            return typeof value === "string" || typeof value === "object";
+        case "number":
+            if (typeof value === "number")
+                return true;
+            // A dual-encoded number takes the STRING SPELLING OF A NUMBER, not any
+            // string: the encoding is dual only where both spellings mean the same
+            // value, and `"warm"` means nothing the server can read back.
+            return (field.dualEncoded !== undefined &&
+                typeof value === "string" &&
+                spellsDecimalNumber(value));
+        case "boolean":
+            return typeof value === "boolean";
+        case "string":
+            return typeof value === "string";
+        case "string[]":
+            return Array.isArray(value) && value.every((v) => typeof v === "string");
+        default:
+            return true;
+    }
+}
+/** The value as a TOML table, or `undefined` when it is not one. */
+function readTomlTable(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * Is `key` a spelling this table still accepts but has superseded (#3626)?
+ *
+ * The nine flat chat keys are the first: declared in `tomlOnlyKeys` with
+ * `kind: "deprecated"` so an unmigrated prompt file keeps pushing, while the
+ * field itself is authored inside `[configs.chat]`.
+ */
+function isDeprecatedTomlKey(table, key) {
+    return table.tomlOnlyKeys?.[key]?.kind === "deprecated";
+}
+/**
+ * Every value in `tomlData` whose spelling does not match the type its field
+ * declares (#2880 criterion 5).
+ *
+ * Run by `config push`'s preflight — so a mistyped value fails before any
+ * request is issued — and by `config diff`, which renders the identical
+ * message instead of calling the file Synced. One validator, one message, two
+ * commands: the failure this replaces is a file diff reports as Synced and
+ * push then rejects (or, worse, coerces into a value the author did not write).
+ *
+ * A repeated table names the offending entry by index, so a typo in the third
+ * `[[configs]]` block is as findable as one in the first.
+ */
+export function configDeclaredTypeErrors(filePath, tomlData, table) {
+    const at = table.tomlPath.reduce((node, segment) => (node == null ? node : node[segment]), tomlData);
+    const entries = table.repeated
+        ? (Array.isArray(at) ? at : []).map((entry, index) => ({
+            label: `${table.tomlPath.join(".")}[${index}]`,
+            value: entry,
+        }))
+        : [{ label: table.tomlPath.join("."), value: at }];
+    const errors = [];
+    for (const entry of entries) {
+        if (!entry.value || typeof entry.value !== "object")
+            continue;
+        for (const field of table.fields) {
+            // #3626 — a grouped field is read at its group path and LABELLED with it
+            // (`configs[0].chat.temperature`), so the message names where the value
+            // actually is. A group that is not a table has no value to type-check;
+            // `findUnknownGroupedTomlKeys` reports that shape.
+            //
+            // #3798 — a field several blocks share is read in the first of its
+            // blocks that holds a value, and labelled with that block, so a
+            // mistyped `[configs.agent].temperature` names `agent`.
+            const groups = tomlGroupsOf(field);
+            const groupName = groups.find((name) => readTomlTable(entry.value[name])?.[field.tomlKey] !== undefined) ?? groups[0];
+            let container = readTomlTable(groupName
+                ? entry.value[groupName]
+                : entry.value);
+            let label = groupName ? `${entry.label}.${groupName}` : entry.label;
+            // #3626, CR3626-003 — a grouped key whose FLAT spelling the table still
+            // accepts as DEPRECATED is read where the file actually wrote it. The
+            // grouping moved the reader into the sub-table, which silently took the
+            // declared-type check away from every unmigrated file: a flat
+            // `temperature = "hot"` passed the preflight it used to fail and was
+            // hoisted into the payload unread. Accepting the old spelling has to mean
+            // accepting it on the same terms, so the root value is checked — and
+            // labelled at the root, because that is the line the author has to fix.
+            if (groupName &&
+                container?.[field.tomlKey] === undefined &&
+                isDeprecatedTomlKey(table, field.tomlKey) &&
+                entry.value[field.tomlKey] !== undefined) {
+                container = entry.value;
+                label = entry.label;
+            }
+            if (!container)
+                continue;
+            const value = container[field.tomlKey];
+            if (valueMatchesDeclaredType(field, value))
+                continue;
+            errors.push(`${filePath}: ${label}.${field.tomlKey} — expected a ` +
+                `${declaredTypeName(field.type)}, found ${foundSpelling(value)}. ` +
+                "The declared type is the contract: `config diff` and `config push` " +
+                "both read it this way and neither converts it for you.");
+        }
+    }
+    return errors;
+}
+/**
+ * TOML keys in `table` that the definition does not recognize.
+ *
+ * `config push` turns these into a hard error naming each key, for every migrated
+ * type — today's workflow posture (`validateWorkflowToml`'s misnest detector),
+ * generalized to whole tables and every configuration object.
+ */
+export function findUnknownTomlKeys(tomlTable, table) {
+    if (!tomlTable || typeof tomlTable !== "object" || Array.isArray(tomlTable)) {
+        return [];
+    }
+    const known = acceptedTomlKeys(table);
+    return Object.keys(tomlTable)
+        .filter((key) => !known.has(key))
+        .sort();
+}
+/**
+ * Server-response keys this CLI version does not recognize — a newer server
+ * returning a field the vendored definition has never heard of.
+ */
+export function findUnknownServerKeys(payload, table) {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+        return [];
+    }
+    const modelFields = GENERATED_CONFIG_MODEL_FIELDS[table.model];
+    if (!modelFields) {
+        // Degrading to an empty anchor would turn every model field the server
+        // returns into a false "this CLI does not recognize it" warning on every
+        // pull. Fail the way `requireConfigTable` does instead.
+        throw new Error(`config-surface: no models.yaml field list for "${table.model}". ` +
+            "Run `node cli/scripts/gen-config-surfaces.mjs`.");
+    }
+    const known = recognizedResponseKeys(table, modelFields);
+    return Object.keys(payload)
+        .filter((key) => !known.has(key))
+        .sort();
+}
+/**
+ * The `config pull` warning for keys this CLI version cannot manage. Names the
+ * file and every key, and says what to do — nothing is dropped without a
+ * message (#2644 criterion 6).
+ */
+export function unrecognizedPullKeysMessage(file, tomlPath, keys) {
+    const prefix = tomlPath.join(".");
+    const named = keys.map((k) => `${prefix}.${k}`).join(", ");
+    return (`config pull: ${file}: ${keys.length} key${keys.length === 1 ? "" : "s"} ` +
+        `this CLI version does not recognize: ${named}. ` +
+        "They were not written to the file — upgrade the CLI " +
+        "(npm i -g primitive-admin@latest) to manage them.");
+}
+/**
+ * Name the server keys this CLI version does not recognize, without writing
+ * them (#2644 criterion 6). No logger means no warning — the caller decides
+ * where the message goes.
+ */
+export function warnUnrecognizedServerKeys(record, table, file, logger) {
+    if (!logger)
+        return;
+    const unknown = findUnknownServerKeys(record, table);
+    if (unknown.length === 0)
+        return;
+    logger(unrecognizedPullKeysMessage(file, table.tomlPath, unknown));
+}
+/**
+ * Top-level TOML keys in `tomlData` the object's definition does not declare —
+ * a typo'd table header (`[integraton]`), a table from a newer CLI, or a stray
+ * section. Rejected by `config push` for the same reason an unrecognized key
+ * inside a table is: silently ignoring it made the file push as though the
+ * table it meant to write were empty, which CLEARED the TOML-owned fields
+ * server-side.
+ */
+export function findUnknownDocumentKeys(tomlData, surface) {
+    return findUnknownTomlDocumentKeys(surface, tomlData);
+}
+/** Field tables present in the wrong shape — `[configs]` for `[[configs]]`. */
+export function findMisshapenTables(tomlData, surface) {
+    return findMisshapenTomlTables(surface, tomlData);
+}
+/** The `config push` error for unrecognized top-level TOML tables. */
+export function unrecognizedPushTablesMessage(file, keys) {
+    const named = keys.map((k) => `[${k}]`).join(", ");
+    return (`${file}: unrecognized top-level table${keys.length === 1 ? "" : "s"}: ` +
+        `${named}. Check the spelling against the tables this file type accepts, ` +
+        "or upgrade the CLI if the server is newer than this one.");
+}
+/** The `config push` error for a field table written with the wrong array markers. */
+export function misshapenTableMessage(file, key, expected) {
+    return expected === "array of tables"
+        ? `${file}: \`${key}\` must be an array of tables — write \`[[${key}]]\`, ` +
+            "one header per entry."
+        : `${file}: \`${key}\` must be a table — write \`[${key}]\`, not an ` +
+            "array of tables.";
+}
+/** The `config push` error for unrecognized TOML keys. */
+export function unrecognizedPushKeysMessage(file, tomlPath, keys) {
+    const prefix = tomlPath.join(".");
+    const named = keys.map((k) => `${prefix}.${k}`).join(", ");
+    return (`${file}: unrecognized key${keys.length === 1 ? "" : "s"} in ` +
+        `[${prefix}]: ${named}. Remove ${keys.length === 1 ? "it" : "them"} or ` +
+        "upgrade the CLI if the server is newer than this one.");
+}
+//# sourceMappingURL=config-surface.js.map

package/dist/src/lib/config-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-surface.js","sourceRoot":"","sources":["../../../src/lib/config-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GAIvB,MAAM,gCAAgC,CAAC;AAExC,8EAA8E;AAC9E,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,KAAK;YAC9C,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAA2B;IAE3B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK;YACtE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE;IACjE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,cAAc,EAAE;IACnE,aAAa;CACd,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,gBAAgB,EAAE;IACvE,UAAU;CACX,CAAC,CAAC;AACH,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,UAAU,EAAE;IAClE,UAAU;CACX,CAAC,CAAC;AAEH,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,mBAAmB,EAAE;IAC7E,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAC5D,wBAAwB,EACxB,CAAC,sBAAsB,CAAC,CACzB,CAAC;AACF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAC9D,0BAA0B,EAC1B,CAAC,wBAAwB,CAAC,CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAAa;IAEb,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,aAAa,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAkB;IAC7D,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+DAA+D;AAC/D,SAAS,gBAAgB,CAAC,IAAyB;IACjD,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,OAAO,OAAO,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,KAAkB,EAClB,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,iEAAiE;YACjE,wEAAwE;YACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QAChE,KAAK,QAAQ;YACX,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3C,uEAAuE;YACvE,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,SAAS;gBAC/B,OAAO,KAAK,KAAK,QAAQ;gBACzB,mBAAmB,CAAC,KAAK,CAAC,CAC3B,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAkB,EAAE,GAAW;IAC1D,OAAO,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,QAAiB,EACjB,KAAkB;IAElB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC7D,QAAQ,CACT,CAAC;IACF,MAAM,OAAO,GAAyC,KAAK,CAAC,QAAQ;QAClE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAU,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;YAChE,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG;YAC9C,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QAC9D,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,mDAAmD;YACnD,EAAE;YACF,mEAAmE;YACnE,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,SAAS,GACb,MAAM,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CACP,aAAa,CACV,KAAK,CAAC,KAAiC,CAAC,IAAI,CAAC,CAC/C,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,SAAS,GAAG,aAAa,CAC3B,SAAS;gBACP,CAAC,CAAE,KAAK,CAAC,KAAiC,CAAC,SAAS,CAAC;gBACrD,CAAC,CAAC,KAAK,CAAC,KAAK,CAChB,CAAC;YACF,IAAI,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,8DAA8D;YAC9D,qEAAqE;YACrE,0EAA0E;YAC1E,qEAAqE;YACrE,wEAAwE;YACxE,IACE,SAAS;gBACT,SAAS,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;gBACxC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;gBACxC,KAAK,CAAC,KAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EACrE,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC,KAAgC,CAAC;gBACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAS;YACrD,MAAM,CAAC,IAAI,CACT,GAAG,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,gBAAgB;gBACpD,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,aAAa,CAAC,KAAK,CAAC,IAAI;gBAClE,qEAAqE;gBACrE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkB,EAClB,KAAkB;IAElB,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAoC,CAAC;SACrD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,KAAkB;IAElB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,uEAAuE;QACvE,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,IAAI,KAAK,CACb,kDAAkD,KAAK,CAAC,KAAK,KAAK;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC;SACnD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAChC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,gBAAgB,IAAI,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC1E,wCAAwC,KAAK,IAAI;QACjD,sDAAsD;QACtD,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,KAAkB,EAClB,IAAY,EACZ,MAAkC;IAElC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CACjC,QAAiB,EACjB,OAA4B;IAE5B,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,6BAA6B,CAC3C,IAAY,EACZ,IAAuB;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,CACL,GAAG,IAAI,iCAAiC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACxE,GAAG,KAAK,kEAAkE;QAC1E,0DAA0D,CAC3D,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,GAAW,EACX,QAAqC;IAErC,OAAO,QAAQ,KAAK,iBAAiB;QACnC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,6CAA6C,GAAG,QAAQ;YACvE,uBAAuB;QAC3B,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,iCAAiC,GAAG,cAAc;YACjE,kBAAkB,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,2BAA2B,CACzC,IAAY,EACZ,QAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CACL,GAAG,IAAI,qBAAqB,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;QAC9D,IAAI,MAAM,MAAM,KAAK,YAAY,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,MAAM;QACxE,uDAAuD,CACxD,CAAC;AACJ,CAAC"}

package/dist/src/lib/config-toml.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Parse a TOML source string with a TOML 1.0-compliant parser.
+ * Accepts heterogeneous inline arrays that the old `@iarna` rejected.
+ */
+export declare function parseConfigToml(content: string): Record<string, any>;
+/**
+ * Serialize a config object to TOML with a TOML 1.0-compliant serializer.
+ * Emits heterogeneous arrays natively instead of falling back to a JSON string.
+ */
+export declare function stringifyConfigToml(data: any): string;

package/dist/src/lib/config-toml.js

@@ -0,0 +1,42 @@
+/**
+ * The CLI's single TOML wrapper. Every TOML parse/stringify in the CLI routes
+ * through here — config files (database-type configs, workflows, collection-type
+ * configs, v2 block configs) and non-config files alike (app.toml, prompts,
+ * integrations, cron triggers, webhooks, rule-sets, codegen, ...).
+ *
+ * Config files can carry **heterogeneous arrays**: a settings-gated pipeline
+ * produces a CEL step-reference string next to a filter object, e.g.
+ * `"$and" = ["$steps.settings.first.peerVisible", { status = "approved" }]`.
+ * TOML 1.0.0 permits heterogeneous arrays; the previous library `@iarna`
+ * targeted TOML 0.5 and threw on them in **both** directions (`stringify` and
+ * `parse`). `smol-toml` is TOML 1.0-compliant and round-trips them, so #1450
+ * swapped the config paths and #1464 finished the migration — moving every
+ * remaining site here and removing `@iarna` entirely. Keeping one library
+ * means one set of parser semantics to reason about.
+ *
+ * Behavioral notes for the smol-toml swap (measured against `@iarna@2.2.5`):
+ * every divergence is a loud error, never silent value drift. smol throws on
+ * integers beyond 2^53 (`@iarna` returned a BigInt that then broke
+ * `JSON.stringify` on push), rejects control characters in comments (TOML 1.0
+ * ban), and throws on stringifying an array containing `null` (`@iarna`
+ * silently dropped it). `null`/`undefined` data-loss guards live in
+ * `canEmitNative` (`toml-database-config.ts`), not here. `smol` re-emits with
+ * slightly different formatting (`[]` not `[ ]`, no array-of-tables indent) —
+ * a one-time reformat on the next `pull`.
+ */
+import * as smolToml from "smol-toml";
+/**
+ * Parse a TOML source string with a TOML 1.0-compliant parser.
+ * Accepts heterogeneous inline arrays that the old `@iarna` rejected.
+ */
+export function parseConfigToml(content) {
+    return smolToml.parse(content);
+}
+/**
+ * Serialize a config object to TOML with a TOML 1.0-compliant serializer.
+ * Emits heterogeneous arrays natively instead of falling back to a JSON string.
+ */
+export function stringifyConfigToml(data) {
+    return smolToml.stringify(data);
+}
+//# sourceMappingURL=config-toml.js.map

package/dist/src/lib/config-toml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-toml.js","sourceRoot":"","sources":["../../../src/lib/config-toml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,QAAQ,MAAM,WAAW,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAS;IAC3C,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/src/lib/config.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Thin compatibility shim over the new project-scoped config system.
+ *
+ * Historically the CLI had one global credentials file at
+ * ~/.primitive/credentials.json and a handful of helpers here. After the
+ * project-config overhaul (issue #373) credentials live per-environment
+ * inside `<projectRoot>/.primitive/credentials.json` when a
+ * primitive/config.json is in scope, and fall back to the legacy global
+ * file otherwise.
+ *
+ * The rest of the CLI continues to import from this module, so we keep
+ * the original public API (loadCredentials, saveCredentials, etc.) and
+ * just delegate to the new stores.
+ */
+import type { Credentials } from "../types/index.js";
+export declare function loadCredentials(): Credentials | null;
+export declare function saveCredentials(credentials: Credentials): void;
+export declare function clearCredentials(): void;
+export declare function isTokenExpired(credentials: Credentials): boolean;
+export declare function isTokenExpiringSoon(credentials: Credentials): boolean;
+/**
+ * The app this invocation runs against: the resolved environment's, and only
+ * ever that (#3152).
+ *
+ * It never answers "none" (#3154). Outside a project there is no environment,
+ * and therefore no app — but there is also no configuration tree, no server
+ * and no credentials, so "which app?" is not a question with a quieter answer
+ * than the others. `requireCurrentEnvironment()` gives the one refusal, which
+ * is what retired the "No app specified" branch and its five local copies.
+ */
+export declare function getCurrentApp(): {
+    appId: string;
+    appName?: string;
+};
+export declare function getCurrentAppId(): string;
+/**
+ * The app a command acts on: an explicit one where the command still takes
+ * one (`users`, `apps`, `admins`, the database data verbs), otherwise the
+ * environment's.
+ *
+ * The explicit forms are checked FIRST and short-circuit, so a cross-app read
+ * still works with no environment able to name that app — that is the whole
+ * reason `--app` survives on those commands (intent §Decisions).
+ */
+export declare function resolveAppId(appId: string | undefined, options: {
+    app?: string;
+}): string;
+/**
+ * The API base URL for the active environment.
+ *
+ * The credentials-file fallback is gone (#3154): a `serverUrl` left in
+ * `~/.primitive/credentials.json` by whatever the last `login` targeted was a
+ * second source for the one thing an environment exists to say.
+ */
+export declare function getServerUrl(): string;
+/**
+ * Resolves the API base URL to authenticate against, used by `primitive login`
+ * (issue #1343).
+ *
+ * Unlike getServerUrl(), this must work *before* any credentials exist (first
+ * login), so it never falls back to the stored credentials' serverUrl:
+ *
+ *   - Project mode → the active environment's `apiUrl` (canonical). Lets
+ *     getCurrentEnvironment() throw on an unresolvable env (ambiguous/unknown
+ *     --env) so the caller can fail loudly instead of silently targeting prod.
+ *   - Legacy mode (no primitive/config.json) → DEFAULT_SERVER_URL, which
+ *     honors the PRIMITIVE_SERVER_URL escape hatch (constants.ts).
+ *
+ * The trailing slash is stripped so callers can build `${url}/admin/api/...`.
+ */
+export declare function getConfiguredServerUrl(): string;