primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/lib/config.js

@@ -1,46 +1,28 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-// Allow override via environment variable for testing
-const CONFIG_DIR = process.env.PRIMITIVE_CONFIG_DIR || join(homedir(), ".primitive");
-const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
-function ensureConfigDir() {
-    if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
-}
+/**
+ * Thin compatibility shim over the new project-scoped config system.
+ *
+ * Historically the CLI had one global credentials file at
+ * ~/.primitive/credentials.json and a handful of helpers here. After the
+ * project-config overhaul (issue #373) credentials live per-environment
+ * inside `<projectRoot>/.primitive/credentials.json` when a
+ * primitive/config.json is in scope, and fall back to the legacy global
+ * file otherwise.
+ *
+ * The rest of the CLI continues to import from this module, so we keep
+ * the original public API (loadCredentials, saveCredentials, etc.) and
+ * just delegate to the new stores.
+ */
+import { clearCredentialsStore, loadCredentialsStore, saveCredentialsStore, } from "./credentials-store.js";
+import { getCurrentEnvironment, requireCurrentEnvironment, } from "./env-resolver.js";
+import { DEFAULT_SERVER_URL } from "./constants.js";
 export function loadCredentials() {
-    try {
-        if (!existsSync(CREDENTIALS_FILE)) {
-            return null;
-        }
-        const data = readFileSync(CREDENTIALS_FILE, "utf-8");
-        return JSON.parse(data);
-    }
-    catch {
-        return null;
-    }
+    return loadCredentialsStore();
 }
 export function saveCredentials(credentials) {
-    ensureConfigDir();
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2), {
-        mode: 0o600,
-    });
-    // Ensure file permissions are secure
-    chmodSync(CREDENTIALS_FILE, 0o600);
+    saveCredentialsStore(credentials);
 }
 export function clearCredentials() {
-    try {
-        if (existsSync(CREDENTIALS_FILE)) {
-            writeFileSync(CREDENTIALS_FILE, "", { mode: 0o600 });
-            // Actually remove the file
-            const { unlinkSync } = require("fs");
-            unlinkSync(CREDENTIALS_FILE);
-        }
-    }
-    catch {
-        // Ignore errors
-    }
+    clearCredentialsStore();
 }
 export function isTokenExpired(credentials) {
     if (!credentials.expiresAt)
@@ -58,41 +40,62 @@ export function isTokenExpiringSoon(credentials) {
     // Consider expiring soon if less than 5 minutes remaining
     return expiresAt - now < 5 * 60 * 1000;
 }
-export function setCurrentApp(appId, appName) {
-    const credentials = loadCredentials();
-    if (!credentials) {
-        throw new Error("Not logged in. Run 'primitive login' first.");
-    }
-    credentials.currentAppId = appId;
-    credentials.currentAppName = appName;
-    saveCredentials(credentials);
-}
-export function clearCurrentApp() {
-    const credentials = loadCredentials();
-    if (!credentials) {
-        return;
-    }
-    delete credentials.currentAppId;
-    delete credentials.currentAppName;
-    saveCredentials(credentials);
+/**
+ * The app this invocation runs against: the resolved environment's, and only
+ * ever that (#3152).
+ *
+ * It never answers "none" (#3154). Outside a project there is no environment,
+ * and therefore no app — but there is also no configuration tree, no server
+ * and no credentials, so "which app?" is not a question with a quieter answer
+ * than the others. `requireCurrentEnvironment()` gives the one refusal, which
+ * is what retired the "No app specified" branch and its five local copies.
+ */
+export function getCurrentApp() {
+    const env = requireCurrentEnvironment(); // may throw on an unresolvable env
+    return { appId: env.config.appId, appName: env.config.appName };
 }
 export function getCurrentAppId() {
-    const credentials = loadCredentials();
-    return credentials?.currentAppId;
+    return getCurrentApp().appId;
 }
+/**
+ * The app a command acts on: an explicit one where the command still takes
+ * one (`users`, `apps`, `admins`, the database data verbs), otherwise the
+ * environment's.
+ *
+ * The explicit forms are checked FIRST and short-circuit, so a cross-app read
+ * still works with no environment able to name that app — that is the whole
+ * reason `--app` survives on those commands (intent §Decisions).
+ */
 export function resolveAppId(appId, options) {
-    const resolved = appId || options.app || getCurrentAppId();
-    if (!resolved) {
-        console.error("No app specified. Use <app-id>, --app, or 'primitive use <app-id>' to set context.");
-        process.exit(1);
-    }
-    return resolved;
+    return appId || options.app || getCurrentAppId();
 }
+/**
+ * The API base URL for the active environment.
+ *
+ * The credentials-file fallback is gone (#3154): a `serverUrl` left in
+ * `~/.primitive/credentials.json` by whatever the last `login` targeted was a
+ * second source for the one thing an environment exists to say.
+ */
 export function getServerUrl() {
-    const credentials = loadCredentials();
-    if (!credentials?.serverUrl) {
-        throw new Error("Not logged in. Run 'primitive login' first.");
-    }
-    return credentials.serverUrl;
+    return requireCurrentEnvironment().config.apiUrl;
+}
+/**
+ * Resolves the API base URL to authenticate against, used by `primitive login`
+ * (issue #1343).
+ *
+ * Unlike getServerUrl(), this must work *before* any credentials exist (first
+ * login), so it never falls back to the stored credentials' serverUrl:
+ *
+ *   - Project mode → the active environment's `apiUrl` (canonical). Lets
+ *     getCurrentEnvironment() throw on an unresolvable env (ambiguous/unknown
+ *     --env) so the caller can fail loudly instead of silently targeting prod.
+ *   - Legacy mode (no primitive/config.json) → DEFAULT_SERVER_URL, which
+ *     honors the PRIMITIVE_SERVER_URL escape hatch (constants.ts).
+ *
+ * The trailing slash is stripped so callers can build `${url}/admin/api/...`.
+ */
+export function getConfiguredServerUrl() {
+    const env = getCurrentEnvironment(); // may throw on an unresolvable env
+    return (env ? env.config.apiUrl : DEFAULT_SERVER_URL).replace(/\/$/, "");
 }
 //# sourceMappingURL=config.js.map

package/dist/src/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,sDAAsD;AACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAE9D,SAAS,eAAe;IACtB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,eAAe,EAAE,CAAC;IAClB,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,qCAAqC;IACrC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,aAAa,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,2BAA2B;YAC3B,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,OAAgB;IAC3D,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,WAAW,CAAC,YAAY,GAAG,KAAK,CAAC;IACjC,WAAW,CAAC,cAAc,GAAG,OAAO,CAAC;IACrC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,OAAO,WAAW,CAAC,YAAY,CAAC;IAChC,OAAO,WAAW,CAAC,cAAc,CAAC;IAClC,eAAe,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,OAAO,WAAW,EAAE,YAAY,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAyB,EAAE,OAAyB;IAC/E,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,UAAU,eAAe;IAC7B,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,qBAAqB,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAwB;IACrD,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qDAAqD;IACrD,OAAO,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAwB;IAC1D,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,0DAA0D;IAC1D,OAAO,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC,CAAC,mCAAmC;IAC5E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,EAAE,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAyB,EACzB,OAAyB;IAEzB,OAAO,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,yBAAyB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC,CAAC,mCAAmC;IACxE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/src/lib/confirm-prompt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export declare class ConfirmPromptError extends Error {
+    constructor(message: string);
+}
+/**
+ * Shape of the `@inquirer/prompts` `confirm()` function. Injectable for testing.
+ *
+ * Note (#999): this shifted from the legacy inquirer questions-array →
+ * `{ confirm: boolean }` shape to the modern bare `{ message, default }` →
+ * `Promise<boolean>` shape.
+ */
+export type PromptFn = (config: {
+    message: string;
+    default?: boolean;
+}) => Promise<boolean>;
+export interface ConfirmPromptOptions {
+    /** Default answer when the user just presses enter. Defaults to false. */
+    defaultValue?: boolean;
+    /**
+     * Override the underlying prompt function (for tests). Defaults to lazily
+     * importing `@inquirer/prompts` `confirm`.
+     */
+    promptFn?: PromptFn;
+    /**
+     * Override TTY detection (for tests). Defaults to `process.stdin.isTTY`.
+     */
+    isTTY?: boolean;
+}
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export declare function confirmPrompt(message: string, options?: ConfirmPromptOptions): Promise<boolean>;

package/dist/src/lib/confirm-prompt.js

@@ -0,0 +1,110 @@
+/**
+ * Shared interactive-confirmation helper for destructive CLI commands.
+ *
+ * Background (issue #972): every destructive command used the legacy
+ * `inquirer.default.prompt([{ type: "confirm", ... }])` pattern directly. When
+ * stdin is not a usable TTY (closed/piped/EOF/Ctrl-D), inquirer v9.3.8 throws
+ * `ERR_USE_AFTER_CLOSE: readline was closed` from inside a Node event-emitter
+ * callback (`PromptUI.onForceClose` -> `process.emit`). Because that throw
+ * originates in event-dispatch, it escapes both the command's own `try/catch`
+ * AND the top-level `.catch` in `cli/bin/primitive.ts` — and with no
+ * `uncaughtException` handler, Node printed only the bare `Node.js vX` banner
+ * and died before the API call. `cron-triggers delete` / `workflows delete`
+ * crashed without deleting anything.
+ *
+ * Migration (issue #999): the helper's internals are now built on the modern
+ * `@inquirer/prompts` `confirm()` API instead of legacy `inquirer.default.prompt`.
+ * The modern API rejects its promise with a *catchable* `ExitPromptError`
+ * (Ctrl-C / SIGINT / force-close) / `AbortPromptError` / `CancelPromptError`
+ * rather than crashing via `process.emit`, so the root-cause crash class is
+ * removed. Crucially, `@inquirer/prompts` `confirm()` has **no built-in non-TTY
+ * guard** — so the #972 guard below MUST stay, or the crash class regresses into
+ * a hang/opaque-reject on piped/closed stdin. The migration changes only the
+ * default prompt fn's internals; the guard, the `ConfirmPromptError` contract,
+ * and the public `confirmPrompt()` signature are preserved.
+ *
+ * `confirmPrompt()` fixes the cause:
+ *   1. Non-TTY guard — if stdin is not a TTY, it never touches the prompt.
+ *      Instead it throws a catchable `ConfirmPromptError` with an actionable
+ *      message ("re-run with --yes ..."). Per the maintainer decision on #972
+ *      this is a hard error, never a silent mutate or silent abort.
+ *   2. Local try/catch — in a real TTY the prompt is awaited inside a try/catch
+ *      so an abort/EOF (`ExitPromptError` / `AbortPromptError` /
+ *      `CancelPromptError`, or legacy `ERR_USE_AFTER_CLOSE`) surfaces as a clean
+ *      `ConfirmPromptError`, not a stack trace or crash.
+ *
+ * Commands should call this instead of inquirer directly, e.g.:
+ *
+ *   if (!options.yes) {
+ *     try {
+ *       const ok = await confirmPrompt(`Delete cron trigger ${id}?`);
+ *       if (!ok) { info("Cancelled."); return; }
+ *     } catch (err) {
+ *       error(err.message);
+ *       process.exit(1);
+ *     }
+ *   }
+ */
+/** Error thrown when a confirmation can't be obtained interactively. */
+export class ConfirmPromptError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfirmPromptError";
+    }
+}
+async function defaultPromptFn(config) {
+    const { confirm } = await import("@inquirer/prompts");
+    return confirm(config);
+}
+/**
+ * Names of the catchable abort errors thrown by `@inquirer/prompts` when the
+ * user interrupts a prompt (Ctrl-C / SIGINT / force-close / abort signal /
+ * cancel). We match on `name` (not just `instanceof`) so detection is robust to
+ * the error class being duplicated across module realms.
+ */
+const ABORT_ERROR_NAMES = new Set([
+    "ExitPromptError",
+    "AbortPromptError",
+    "CancelPromptError",
+]);
+/**
+ * Ask the user a yes/no confirmation question.
+ *
+ * @returns `true` if the user confirms, `false` if they decline.
+ * @throws {ConfirmPromptError} when stdin is not an interactive TTY (so the
+ *   prompt can't be shown), or when the underlying prompt aborts/crashes.
+ */
+export async function confirmPrompt(message, options = {}) {
+    const isTTY = options.isTTY ?? Boolean(process.stdin.isTTY);
+    if (!isTTY) {
+        throw new ConfirmPromptError("No interactive terminal available to confirm this action. " +
+            "Re-run with --yes (-y) to skip the confirmation prompt in " +
+            "non-interactive contexts (CI, pipes, agents).");
+    }
+    const promptFn = options.promptFn ?? defaultPromptFn;
+    try {
+        const confirmed = await promptFn({
+            message,
+            default: options.defaultValue ?? false,
+        });
+        return Boolean(confirmed);
+    }
+    catch (err) {
+        // A deliberate abort/EOF/Ctrl-C/Ctrl-D — either the modern
+        // `@inquirer/prompts` `ExitPromptError`/`AbortPromptError`/`CancelPromptError`
+        // (matched by name to survive cross-realm `instanceof` mismatches), or the
+        // legacy inquirer `ERR_USE_AFTER_CLOSE`. Surface as a clean, actionable
+        // error so the caller exits 1 with no stack trace / bare `Node.js vX` banner.
+        if (ABORT_ERROR_NAMES.has(err?.name) ||
+            err?.code === "ERR_USE_AFTER_CLOSE") {
+            throw new ConfirmPromptError("Confirmation cancelled (no interactive input). " +
+                "Re-run with --yes (-y) to skip confirmation.");
+        }
+        // Any other prompt failure: still surface it as a clean, catchable error
+        // rather than letting it escape as an uncaught crash.
+        throw new ConfirmPromptError(err?.message
+            ? `Confirmation prompt failed: ${err.message}`
+            : "Confirmation prompt failed.");
+    }
+}
+//# sourceMappingURL=confirm-prompt.js.map

package/dist/src/lib/confirm-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-prompt.js","sourceRoot":"","sources":["../../../src/lib/confirm-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,wEAAwE;AACxE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AA4BD,KAAK,UAAU,eAAe,CAAC,MAG9B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAC1B,4DAA4D;YAC1D,4DAA4D;YAC5D,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC;YAC/B,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,2DAA2D;QAC3D,+EAA+E;QAC/E,2EAA2E;QAC3E,wEAAwE;QACxE,8EAA8E;QAC9E,IACE,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;YAChC,GAAG,EAAE,IAAI,KAAK,qBAAqB,EACnC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,iDAAiD;gBAC/C,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,EAAE,OAAO;YACV,CAAC,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE;YAC9C,CAAC,CAAC,6BAA6B,CAClC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/src/lib/constants.d.ts

@@ -0,0 +1,11 @@
+export declare const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export declare const DEFAULT_SERVER_URL: string;
+/**
+ * The alpha deployment's canonical server URL. Mirrors
+ * `wrangler.toml [env.alpha] WORKER_URL` — keep the two in sync; if the alpha
+ * URL ever changes, update both. Used only by `primitive guides` to detect the
+ * alpha target and fetch guides from the `primitive-docs` `next` branch instead
+ * of `main` (issue #1463). This is an internal-only convenience;
+ * security-through-obscurity is acceptable.
+ */
+export declare const ALPHA_SERVER_URL = "https://js-bao-wss-alpha.primitive-labs-dev.workers.dev";

package/dist/src/lib/constants.js

@@ -0,0 +1,12 @@
+export const PRODUCTION_SERVER_URL = "https://primitiveapi.com";
+export const DEFAULT_SERVER_URL = process.env.PRIMITIVE_SERVER_URL || PRODUCTION_SERVER_URL;
+/**
+ * The alpha deployment's canonical server URL. Mirrors
+ * `wrangler.toml [env.alpha] WORKER_URL` — keep the two in sync; if the alpha
+ * URL ever changes, update both. Used only by `primitive guides` to detect the
+ * alpha target and fetch guides from the `primitive-docs` `next` branch instead
+ * of `main` (issue #1463). This is an internal-only convenience;
+ * security-through-obscurity is acceptable.
+ */
+export const ALPHA_SERVER_URL = "https://js-bao-wss-alpha.primitive-labs-dev.workers.dev";
+//# sourceMappingURL=constants.js.map

package/dist/src/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,yDAAyD,CAAC"}

package/dist/src/lib/crash-handlers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export declare function installGlobalCrashHandlers(): void;

package/dist/src/lib/crash-handlers.js

@@ -0,0 +1,49 @@
+/**
+ * Global crash handlers for the CLI entrypoint (issue #972, Option A).
+ *
+ * The CLI previously registered no `uncaughtException` / `unhandledRejection`
+ * handlers. When an error escaped the top-level `.catch` in
+ * `cli/bin/primitive.ts` — e.g. the `ERR_USE_AFTER_CLOSE` thrown from inside an
+ * inquirer event-emitter callback when stdin isn't a usable TTY — Node printed
+ * only its bare `Node.js vX` version banner and died. That was the exact
+ * symptom in #972: a delete command crashed with no error message.
+ *
+ * These handlers are a narrow safety net: print a clean `✗ <message>` to stderr
+ * (matching `error()` in output.ts) and exit non-zero, so NO command can ever
+ * bare-crash again. They intentionally do not try to recover — they only make
+ * an already-fatal error legible.
+ */
+import { error } from "./output.js";
+function describe(err) {
+    if (err && typeof err === "object") {
+        const e = err;
+        // The signature crash from a non-TTY confirm prompt — give actionable help.
+        if (e.code === "ERR_USE_AFTER_CLOSE") {
+            return ("No interactive terminal available to confirm this action. " +
+                "Re-run with --yes (-y) to skip the confirmation prompt in " +
+                "non-interactive contexts (CI, pipes, agents).");
+        }
+        if (e.message)
+            return e.message;
+    }
+    return "An unexpected error occurred.";
+}
+let installed = false;
+/**
+ * Register process-level handlers that convert otherwise-fatal escaped errors
+ * into a clean stderr message + non-zero exit. Idempotent.
+ */
+export function installGlobalCrashHandlers() {
+    if (installed)
+        return;
+    installed = true;
+    process.on("uncaughtException", (err) => {
+        error(describe(err));
+        process.exit(1);
+    });
+    process.on("unhandledRejection", (reason) => {
+        error(describe(reason));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=crash-handlers.js.map

package/dist/src/lib/crash-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crash-handlers.js","sourceRoot":"","sources":["../../../src/lib/crash-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAA0C,CAAC;QACrD,4EAA4E;QAC5E,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACrC,OAAO,CACL,4DAA4D;gBAC5D,4DAA4D;gBAC5D,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IACD,OAAO,+BAA+B,CAAC;AACzC,CAAC;AAED,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IAEjB,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/lib/credentials-store.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Credentials storage with dual-mode support.
+ *
+ * Credentials are tokens and who they belong to, and nothing else: the app an
+ * invocation runs against is the resolved environment's `appId` (#3152), never
+ * a slot in this file.
+ *
+ * Mode A (project mode): credentials live at
+ *   <projectRoot>/.primitive/credentials.json
+ * with per-environment slots:
+ *   {
+ *     "environments": {
+ *       "dev":  { "accessToken": "...", "refreshToken": "...", ... },
+ *       "prod": { ... }
+ *     }
+ *   }
+ *
+ * Mode B (global mode): no primitive/config.json in scope, so we fall back to
+ *   ~/.primitive/credentials.json
+ * with the flat Credentials shape the CLI has always used.
+ *
+ * Mode B is NOT a default any more (#3154, intent criterion 5). It used to be
+ * the silent answer for every command run outside a project, which is how an
+ * app-scoped command could quietly operate against whatever server the last
+ * `login` happened to target. Now a command has to say out loud that it may
+ * work outside a project, by calling `allowGlobalCredentials()` in its own
+ * action; every other command gets `missing-config` here instead of a file.
+ *
+ * Exactly four commands say it: `login`, which creates the file; `logout`,
+ * which is the only way to clear what login wrote; `init`, which must call the
+ * API before a project can exist; and `bootstrap`, which creates the first
+ * super-admin on an empty no-OAuth database and therefore cannot be inside a
+ * project either. The last two are the divergence from the intent's "login and
+ * init and nothing else", adjudicated on #3154 as finding F1.
+ *
+ * The opt-in is per ACTION, not per argv: `primitive --env prod login` and
+ * `primitive login` reach the same line, so there is no flag shape for a
+ * pre-parse to miss. And it only PERMITS the global file — inside a project
+ * all four still use the per-environment slots.
+ */
+import type { Credentials } from "../types/index.js";
+export declare const PROJECT_LOCAL_DIR = ".primitive";
+export declare const PROJECT_CREDENTIALS_FILENAME = "credentials.json";
+/** Returns true when a primitive/config.json is in scope (project mode active). */
+export declare function isProjectMode(): boolean;
+/**
+ * Returns the path to the credentials file that will be used, based on
+ * whether we're in project mode or legacy mode.
+ */
+export declare function getCredentialsFilePath(): string;
+/**
+ * Declare that THIS command may fall back to `~/.primitive/credentials.json`
+ * when no project is in scope. Called at the top of `login`, `logout`, `init`
+ * and `bootstrap`, and nowhere else.
+ */
+export declare function allowGlobalCredentials(): void;
+/**
+ * Drop the declaration again. One invocation runs one command, so nothing in
+ * the CLI calls this — it exists so a test file can exercise both sides of the
+ * boundary in one process, the way `resetEnvResolver()` does for the resolver.
+ */
+export declare function resetGlobalCredentialsAllowance(): void;
+/**
+ * Reads credentials for the current environment (project mode) or the
+ * legacy global file. Returns the standard Credentials shape so existing
+ * callers don't need to change.
+ *
+ * In project mode, we blend the per-env stored creds with the serverUrl
+ * and appId from primitive/config.json to produce the Credentials the rest of
+ * the CLI expects.
+ */
+export declare function loadCredentialsStore(): Credentials | null;
+/**
+ * Saves credentials. In project mode, writes to the per-env slot in the
+ * project credentials file. In legacy mode, writes the global file.
+ *
+ * The serverUrl on the incoming Credentials is used as-is for legacy
+ * mode, and ignored in project mode (the env's apiUrl is canonical).
+ */
+export declare function saveCredentialsStore(credentials: Credentials): void;
+/**
+ * Clears credentials for the current environment (project mode) or
+ * deletes the legacy file (legacy mode).
+ */
+export declare function clearCredentialsStore(): void;
+/**
+ * Removes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `env remove` so stale tokens from a
+ * previously-removed environment can never be silently re-used if the same
+ * name is later added back. Never throws.
+ */
+export declare function clearCredentialsForEnvInProject(projectRoot: string, envName: string): void;
+/**
+ * Writes the credentials slot for the named environment in a specific
+ * project's credentials file. Used by `primitive init` to carry the session
+ * it just authenticated into the freshly scaffolded project, so the first
+ * in-project CLI command works without a second `primitive login`.
+ */
+export declare function seedCredentialsForEnvInProject(projectRoot: string, envName: string, credentials: Credentials): void;
+/**
+ * Lists all environments that have stored credentials in project mode.
+ * Returns an empty array in legacy mode.
+ */
+export declare function listAuthenticatedEnvironments(): string[];