primitive-admin 1.1.0-alpha.9 → 1.2.0-alpha.0

package/dist/src/lib/record-filter.js

@@ -0,0 +1,55 @@
+import { readFileSync } from "fs";
+import { parseConfigToml } from "./config-toml.js";
+import { error } from "./output.js";
+/**
+ * Parse the shared `--filter` / `--filter-file` option pair used by the record
+ * read/query verbs on both surfaces: `databases records` (`query`, `count`,
+ * `aggregate`, `delete-all`) and `documents records` (`query`, `count`,
+ * `aggregate`).
+ *
+ * `--filter` takes an inline JSON object; `--filter-file` reads the filter from
+ * a JSON file, or a TOML file (either a top-level table or a `[filter]` section).
+ * The two options are mutually exclusive. All validation happens CLI-side so a
+ * malformed filter produces a clear error rather than a server 500.
+ *
+ * Exits the process with a clear message on bad input. Returns `undefined` when
+ * neither option is supplied.
+ */
+export function parseFilterOptions(options) {
+    if (options.filter && options.filterFile) {
+        error("Cannot use both --filter and --filter-file.");
+        process.exit(1);
+    }
+    if (options.filterFile) {
+        let content;
+        try {
+            content = readFileSync(options.filterFile, "utf-8");
+        }
+        catch (err) {
+            error(`Failed to read filter file: ${err.message}`);
+            process.exit(1);
+        }
+        try {
+            if (options.filterFile.endsWith(".toml")) {
+                const parsed = parseConfigToml(content);
+                return parsed.filter || parsed;
+            }
+            return JSON.parse(content);
+        }
+        catch (err) {
+            error(`Invalid filter file: ${err.message}`);
+            process.exit(1);
+        }
+    }
+    if (options.filter) {
+        try {
+            return JSON.parse(options.filter);
+        }
+        catch {
+            error("Invalid --filter JSON.");
+            process.exit(1);
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=record-filter.js.map

package/dist/src/lib/record-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-filter.js","sourceRoot":"","sources":["../../../src/lib/record-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAGlC;IACC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACzC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAQ,CAAC;gBAC/C,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/lib/refresh-admin-credentials.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared helper for refreshing the admin access token via the CLI auth API.
+ *
+ * Why this module exists:
+ *
+ *   - `ApiClient.refreshToken()` already POSTs to /admin/api/auth/refresh
+ *     before every API call when the access token is near expiry.
+ *   - `primitive token` (issue #772) now needs the same exchange so it can
+ *     auto-refresh a stale token before printing it.
+ *   - `primitive login --token-stdin` does the same POST a third time to
+ *     bootstrap credentials from a refresh token piped from another CLI.
+ *
+ * Putting the HTTP exchange + response parsing in one place keeps the
+ * response-shape contract in a single spot (server returns both `jwt` and
+ * `accessToken` — see `src/index.ts:2349-2356`) and means future server
+ * changes to that endpoint require touching exactly one CLI file.
+ *
+ * Design notes:
+ *
+ *   - This module **does not** depend on `api-client.ts`. `ApiClient` imports
+ *     it, not the other way around — that prevents the avoidable module cycle
+ *     codex flagged in the design review.
+ *   - It defines its own `RefreshError` so callers can map failures to
+ *     whatever error type (or exit code) makes sense for their surface.
+ *     `ApiClient` translates these to `ApiError`; the `token` command
+ *     translates them to an `error()` + `process.exit(1)`.
+ *   - It **does not save** the refreshed credentials. The caller decides
+ *     whether to persist (the `token` command does; `ApiClient.refreshToken`
+ *     does). Keeping persistence caller-owned matches the existing
+ *     "storage is owned by `credentials-store.ts`" convention.
+ *   - It **does not print anything**. Output (success/failure messaging) is
+ *     the caller's responsibility — important because the `token` command
+ *     must keep stdout clean for piping.
+ */
+import type { Credentials } from "../types/index.js";
+/**
+ * Reasons a refresh attempt can fail. `unauthorized` covers any HTTP non-2xx
+ * response (typically a 401 from an expired/invalid refresh token).
+ * `network` covers transport-level failures (DNS, ECONNREFUSED, etc.).
+ * `missing-refresh-token` is a precondition failure — there's no token to
+ * send.
+ */
+export type RefreshFailureKind = "missing-refresh-token" | "unauthorized" | "network";
+export declare class RefreshError extends Error {
+    kind: RefreshFailureKind;
+    statusCode?: number;
+    cause?: unknown;
+    /** The server's machine-readable `code`, when it sent one. */
+    code?: string;
+    constructor(message: string, kind: RefreshFailureKind, statusCode?: number, cause?: unknown, 
+    /** The server's machine-readable `code`, when it sent one. */
+    code?: string);
+}
+/** The refresh token's session was revoked (logout or `auth sessions revoke`). */
+export declare const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
+/** Any other refused refresh. */
+export declare const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
+/**
+ * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
+ * `Credentials` object — the caller is responsible for persistence via
+ * `saveCredentials()` (or whatever storage the caller owns).
+ *
+ * Server contract: `POST {serverUrl}/admin/api/auth/refresh` with
+ *   { refreshToken: string }
+ * Response (200):
+ *   { jwt, accessToken, refreshToken, expiresAt }
+ *
+ * We accept `accessToken` as the canonical field and fall back to `jwt` for
+ * forward-compat (the server currently emits both — see issue #772 codex
+ * cleanup #3). Login's legacy `data.token` form is dropped — no server
+ * version that's still in support emits that field.
+ */
+export declare function refreshAdminCredentials(credentials: Credentials): Promise<Credentials>;

package/dist/src/lib/refresh-admin-credentials.js

@@ -0,0 +1,123 @@
+/**
+ * Shared helper for refreshing the admin access token via the CLI auth API.
+ *
+ * Why this module exists:
+ *
+ *   - `ApiClient.refreshToken()` already POSTs to /admin/api/auth/refresh
+ *     before every API call when the access token is near expiry.
+ *   - `primitive token` (issue #772) now needs the same exchange so it can
+ *     auto-refresh a stale token before printing it.
+ *   - `primitive login --token-stdin` does the same POST a third time to
+ *     bootstrap credentials from a refresh token piped from another CLI.
+ *
+ * Putting the HTTP exchange + response parsing in one place keeps the
+ * response-shape contract in a single spot (server returns both `jwt` and
+ * `accessToken` — see `src/index.ts:2349-2356`) and means future server
+ * changes to that endpoint require touching exactly one CLI file.
+ *
+ * Design notes:
+ *
+ *   - This module **does not** depend on `api-client.ts`. `ApiClient` imports
+ *     it, not the other way around — that prevents the avoidable module cycle
+ *     codex flagged in the design review.
+ *   - It defines its own `RefreshError` so callers can map failures to
+ *     whatever error type (or exit code) makes sense for their surface.
+ *     `ApiClient` translates these to `ApiError`; the `token` command
+ *     translates them to an `error()` + `process.exit(1)`.
+ *   - It **does not save** the refreshed credentials. The caller decides
+ *     whether to persist (the `token` command does; `ApiClient.refreshToken`
+ *     does). Keeping persistence caller-owned matches the existing
+ *     "storage is owned by `credentials-store.ts`" convention.
+ *   - It **does not print anything**. Output (success/failure messaging) is
+ *     the caller's responsibility — important because the `token` command
+ *     must keep stdout clean for piping.
+ */
+import { fetchWithTLS } from "./fetch.js";
+export class RefreshError extends Error {
+    kind;
+    statusCode;
+    cause;
+    code;
+    constructor(message, kind, statusCode, cause, 
+    /** The server's machine-readable `code`, when it sent one. */
+    code) {
+        super(message);
+        this.kind = kind;
+        this.statusCode = statusCode;
+        this.cause = cause;
+        this.code = code;
+        this.name = "RefreshError";
+    }
+}
+/** The refresh token's session was revoked (logout or `auth sessions revoke`). */
+export const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
+/** Any other refused refresh. */
+export const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
+/**
+ * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
+ * `Credentials` object — the caller is responsible for persistence via
+ * `saveCredentials()` (or whatever storage the caller owns).
+ *
+ * Server contract: `POST {serverUrl}/admin/api/auth/refresh` with
+ *   { refreshToken: string }
+ * Response (200):
+ *   { jwt, accessToken, refreshToken, expiresAt }
+ *
+ * We accept `accessToken` as the canonical field and fall back to `jwt` for
+ * forward-compat (the server currently emits both — see issue #772 codex
+ * cleanup #3). Login's legacy `data.token` form is dropped — no server
+ * version that's still in support emits that field.
+ */
+export async function refreshAdminCredentials(credentials) {
+    if (!credentials.refreshToken) {
+        throw new RefreshError("No refresh token available. Please login again.", "missing-refresh-token");
+    }
+    const url = `${credentials.serverUrl}/admin/api/auth/refresh`;
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (credentials.globalAdminAppId) {
+        headers["X-Global-Admin-App-Id"] = credentials.globalAdminAppId;
+    }
+    let response;
+    try {
+        response = await fetchWithTLS(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ refreshToken: credentials.refreshToken }),
+        });
+    }
+    catch (cause) {
+        const reason = cause instanceof Error && cause.message
+            ? cause.message
+            : String(cause);
+        throw new RefreshError(`Network error refreshing token: ${reason}.`, "network", undefined, cause);
+    }
+    if (!response.ok) {
+        // #3885: a refresh of a revoked session answers 401 with code
+        // SESSION_REVOKED; say so, rather than calling the token expired.
+        let code;
+        try {
+            const body = (await response.json());
+            code = typeof body?.code === "string" ? body.code : undefined;
+        }
+        catch {
+            // Not JSON: no code to report.
+        }
+        throw new RefreshError(code === "SESSION_REVOKED"
+            ? SESSION_REVOKED_MESSAGE
+            : REFRESH_EXPIRED_MESSAGE, "unauthorized", response.status, undefined, code);
+    }
+    const data = (await response.json());
+    const accessToken = data?.accessToken || data?.jwt;
+    if (!accessToken) {
+        throw new RefreshError("Refresh response did not include an access token. Run 'primitive login'.", "unauthorized", response.status);
+    }
+    return {
+        ...credentials,
+        accessToken,
+        refreshToken: data.refreshToken || credentials.refreshToken,
+        expiresAt: data.expiresAt || new Date(Date.now() + 3600 * 1000).toISOString(),
+    };
+}
+//# sourceMappingURL=refresh-admin-credentials.js.map

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAEA;IANT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;IACtB,8DAA8D;IACvD,IAAa;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kDAAkD,CAAC;AAErD,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+CAA+C,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;YAC5C,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,uBAAuB,EAC3B,cAAc,EACd,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/resolve-init-dev-port.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure resolution of the dev server port for `primitive init` (step 6).
+ *
+ * Background (issue #2720): `primitive init --help` documents a `dev_port`
+ * init-config key and `init-config.ts` validates it, but the step-6 prompt ran
+ * unconditionally — the only branch in the command that wasn't guarded with
+ * `if (initConfig)`. So the config's port was ignored, and on a piped/CI stdin
+ * the `@inquirer/prompts` `input` threw `ERR_USE_AFTER_CLOSE` into a swallowing
+ * catch: the run kept 5173, skipped the CORS/redirect-URI update a non-default
+ * port needs, and still exited 0.
+ *
+ * Resolution follows the same interactivity contract as `resolve-platform.ts`:
+ *
+ *   (a) init-config with `dev_port`     -> use it (never prompt)
+ *   (b) init-config without `dev_port`  -> keep the default (never prompt)
+ *   (c) interactive TTY, no config      -> prompt
+ *   (d) non-TTY, no config              -> keep the default WITHOUT prompting,
+ *       so the closed-stdin crash above can't happen
+ *
+ * Extracting the decision into a pure function (with injectable `isTTY` /
+ * `promptFn`) makes the terminal-dependent contract unit-testable.
+ */
+/** Vite's default dev port, and the universal localhost origin for an app. */
+export declare const DEFAULT_DEV_PORT = 5173;
+/** Where the resolved port came from. */
+export type DevPortSource = "config" | "prompt" | "default";
+/** Prompt thunk returning the chosen port. Injectable for testing. */
+export type DevPortPromptFn = () => Promise<number>;
+export interface ResolveDevPortOptions {
+    /** `dev_port` from a loaded `.primitive-init.toml`, if set. */
+    configPort?: number;
+    /**
+     * Whether a non-interactive init-config file is in effect. When `true`, the
+     * prompt is skipped entirely (cases a/b) regardless of TTY.
+     */
+    hasConfig: boolean;
+    /** Whether stdin is an interactive TTY. Inject `false` to exercise case (d). */
+    isTTY: boolean;
+    /** Prompt function used only in the interactive case (c). */
+    promptFn: DevPortPromptFn;
+    /** Overridable default, for tests. */
+    defaultPort?: number;
+}
+export interface ResolvedDevPort {
+    port: number;
+    source: DevPortSource;
+}
+/**
+ * Validates a typed-in port. Shared by the interactive prompt so a rejected
+ * value reads the same as the init-config validation in `init-config.ts`.
+ */
+export declare function validateDevPort(value: string): true | string;
+/**
+ * Resolve the dev server port per the 4-case contract above.
+ */
+export declare function resolveDevPort(options: ResolveDevPortOptions): Promise<ResolvedDevPort>;

package/dist/src/lib/resolve-init-dev-port.js

@@ -0,0 +1,55 @@
+/**
+ * Pure resolution of the dev server port for `primitive init` (step 6).
+ *
+ * Background (issue #2720): `primitive init --help` documents a `dev_port`
+ * init-config key and `init-config.ts` validates it, but the step-6 prompt ran
+ * unconditionally — the only branch in the command that wasn't guarded with
+ * `if (initConfig)`. So the config's port was ignored, and on a piped/CI stdin
+ * the `@inquirer/prompts` `input` threw `ERR_USE_AFTER_CLOSE` into a swallowing
+ * catch: the run kept 5173, skipped the CORS/redirect-URI update a non-default
+ * port needs, and still exited 0.
+ *
+ * Resolution follows the same interactivity contract as `resolve-platform.ts`:
+ *
+ *   (a) init-config with `dev_port`     -> use it (never prompt)
+ *   (b) init-config without `dev_port`  -> keep the default (never prompt)
+ *   (c) interactive TTY, no config      -> prompt
+ *   (d) non-TTY, no config              -> keep the default WITHOUT prompting,
+ *       so the closed-stdin crash above can't happen
+ *
+ * Extracting the decision into a pure function (with injectable `isTTY` /
+ * `promptFn`) makes the terminal-dependent contract unit-testable.
+ */
+/** Vite's default dev port, and the universal localhost origin for an app. */
+export const DEFAULT_DEV_PORT = 5173;
+/**
+ * Validates a typed-in port. Shared by the interactive prompt so a rejected
+ * value reads the same as the init-config validation in `init-config.ts`.
+ */
+export function validateDevPort(value) {
+    const port = parseInt(value, 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+        return "Enter a valid port number.";
+    }
+    return true;
+}
+/**
+ * Resolve the dev server port per the 4-case contract above.
+ */
+export async function resolveDevPort(options) {
+    const defaultPort = options.defaultPort ?? DEFAULT_DEV_PORT;
+    // (a)/(b) non-interactive config present: use its port, else the default.
+    if (options.hasConfig) {
+        if (options.configPort !== undefined) {
+            return { port: options.configPort, source: "config" };
+        }
+        return { port: defaultPort, source: "default" };
+    }
+    // (c) interactive TTY, no config: prompt.
+    if (options.isTTY) {
+        return { port: await options.promptFn(), source: "prompt" };
+    }
+    // (d) non-TTY, no config: never prompt; keep the default.
+    return { port: defaultPort, source: "default" };
+}
+//# sourceMappingURL=resolve-init-dev-port.js.map

package/dist/src/lib/resolve-init-dev-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-init-dev-port.js","sourceRoot":"","sources":["../../../src/lib/resolve-init-dev-port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AA6BrC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC5C,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC;IAE5D,0EAA0E;IAC1E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,0CAA0C;IAC1C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9D,CAAC;IAED,0DAA0D;IAC1D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAClD,CAAC"}

package/dist/src/lib/resolve-init-server.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Pure resolution of the target server for `primitive init`.
+ *
+ * Background (issue #2376): the init-config TOML documents a `server` key, but
+ * `init` only ever read the `-s/--server` flag and the current credentials. A
+ * config that named a different server was silently ignored — the app was
+ * created on the CLI's current server and the scaffolded `primitive.json` got
+ * that URL too.
+ *
+ * Precedence (highest first):
+ *   (a) `-s/--server` flag
+ *   (b) init-config `server` key
+ *   (c) the server the CLI is currently logged into
+ *   (d) `DEFAULT_SERVER_URL`
+ *
+ * Case (c) has one interactive twist: when the current server is not the
+ * default and the run is interactive (no flag, no config, TTY stdin), init
+ * asks which server to use. The prompt is TTY- and config-guarded here so a
+ * piped/CI stdin can never trigger the `@inquirer/prompts` closed-stdin crash
+ * (same hazard hardened in #972/#999).
+ *
+ * Extracting the decision into a pure function with an injectable prompt
+ * mirrors `resolve-platform.ts`, which the same command already uses, and makes
+ * the precedence contract unit-testable without a network or a terminal.
+ */
+/** Where the resolved server URL came from. */
+export type InitServerSource = "flag" | "config" | "prompt" | "current" | "default";
+/** Prompt thunk returning the chosen server URL. Injectable for testing. */
+export type ServerPromptFn = () => Promise<string>;
+export interface ResolveInitServerOptions {
+    /** Value of the explicit `-s/--server` flag, or `undefined` when omitted. */
+    flagServer?: string;
+    /** `server` key from a loaded init-config TOML, if a config is present. */
+    configServer?: string;
+    /**
+     * Whether a non-interactive init-config file is in effect. When `true` the
+     * prompt is skipped entirely, regardless of TTY.
+     */
+    hasConfig: boolean;
+    /** Server URL of the current credentials, or `undefined` when logged out. */
+    currentServer?: string;
+    /** Fallback when nothing else selects a server (`DEFAULT_SERVER_URL`). */
+    defaultServer: string;
+    /** Whether stdin is an interactive TTY. */
+    isTTY: boolean;
+    /** Prompt used only in the interactive case. */
+    promptFn: ServerPromptFn;
+}
+export interface ResolvedInitServer {
+    /** The server init should create the app on and write into the scaffold. */
+    serverUrl: string;
+    /** Which input selected it. */
+    source: InitServerSource;
+    /**
+     * True when the resolved server differs from the server the stored
+     * credentials belong to. Callers use it to authenticate against the target
+     * server instead of silently reusing the current login.
+     */
+    serverChanged: boolean;
+}
+/**
+ * Resolve the server `primitive init` should target, per the precedence above.
+ */
+export declare function resolveInitServer(options: ResolveInitServerOptions): Promise<ResolvedInitServer>;

package/dist/src/lib/resolve-init-server.js

@@ -0,0 +1,77 @@
+/**
+ * Pure resolution of the target server for `primitive init`.
+ *
+ * Background (issue #2376): the init-config TOML documents a `server` key, but
+ * `init` only ever read the `-s/--server` flag and the current credentials. A
+ * config that named a different server was silently ignored — the app was
+ * created on the CLI's current server and the scaffolded `primitive.json` got
+ * that URL too.
+ *
+ * Precedence (highest first):
+ *   (a) `-s/--server` flag
+ *   (b) init-config `server` key
+ *   (c) the server the CLI is currently logged into
+ *   (d) `DEFAULT_SERVER_URL`
+ *
+ * Case (c) has one interactive twist: when the current server is not the
+ * default and the run is interactive (no flag, no config, TTY stdin), init
+ * asks which server to use. The prompt is TTY- and config-guarded here so a
+ * piped/CI stdin can never trigger the `@inquirer/prompts` closed-stdin crash
+ * (same hazard hardened in #972/#999).
+ *
+ * Extracting the decision into a pure function with an injectable prompt
+ * mirrors `resolve-platform.ts`, which the same command already uses, and makes
+ * the precedence contract unit-testable without a network or a terminal.
+ */
+import { normalizeServerUrl } from "./channel.js";
+/**
+ * Canonical form used for both comparison and the value written into the
+ * scaffold: `channel.ts`'s `normalizeServerUrl` (shared with the
+ * branch-as-channel detection) strips trailing slashes so `https://host/` and
+ * `https://host` compare equal and `${serverUrl}${path}` never doubles up.
+ * Unparseable values are left as-is — `validateServerUrl` (now the shared
+ * validator in `server-url.ts`) rejects them before they reach here.
+ */
+function canonicalize(url) {
+    const trimmed = url.trim();
+    return normalizeServerUrl(trimmed) ?? trimmed;
+}
+/**
+ * Resolve the server `primitive init` should target, per the precedence above.
+ */
+export async function resolveInitServer(options) {
+    const currentServer = options.currentServer
+        ? canonicalize(options.currentServer)
+        : undefined;
+    const defaultServer = canonicalize(options.defaultServer);
+    const changedFrom = (serverUrl) => !!currentServer && currentServer !== serverUrl;
+    // (a)/(b) An explicitly requested server wins; the flag beats the config.
+    const explicit = options.flagServer ?? options.configServer;
+    if (explicit !== undefined) {
+        const serverUrl = canonicalize(explicit);
+        return {
+            serverUrl,
+            source: options.flagServer !== undefined ? "flag" : "config",
+            serverChanged: changedFrom(serverUrl),
+        };
+    }
+    // (c) Interactive runs on a non-default server ask where to create the app.
+    if (currentServer &&
+        currentServer !== defaultServer &&
+        !options.hasConfig &&
+        options.isTTY) {
+        const serverUrl = canonicalize(await options.promptFn());
+        return {
+            serverUrl,
+            source: "prompt",
+            serverChanged: changedFrom(serverUrl),
+        };
+    }
+    // (c)/(d) Stay on the current server, or fall back to the default.
+    return {
+        serverUrl: currentServer || defaultServer,
+        source: currentServer ? "current" : "default",
+        serverChanged: false,
+    };
+}
+//# sourceMappingURL=resolve-init-server.js.map

package/dist/src/lib/resolve-init-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-init-server.js","sourceRoot":"","sources":["../../../src/lib/resolve-init-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AA8ClD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa;QACzC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1D,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAW,EAAE,CACjD,CAAC,CAAC,aAAa,IAAI,aAAa,KAAK,SAAS,CAAC;IAEjD,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO;YACL,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAC5D,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IACE,aAAa;QACb,aAAa,KAAK,aAAa;QAC/B,CAAC,OAAO,CAAC,SAAS;QAClB,OAAO,CAAC,KAAK,EACb,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO;YACL,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,WAAW,CAAC,SAAS,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,OAAO;QACL,SAAS,EAAE,aAAa,IAAI,aAAa;QACzC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC7C,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC"}

package/dist/src/lib/resolve-owner.d.ts

@@ -0,0 +1,19 @@
+/**
+ * One email → userId resolution for every `--owner` flag the CLI carries.
+ *
+ * It lived inside `commands/documents.ts` from #2763 until #3641 gave
+ * `collections create` the same flag. Two copies of a lookup would be two
+ * chances to reintroduce the failure #2763 removed — the old admin-only list
+ * wrapper flattened every error, including a 403, into "no such user" — so it
+ * moved here whole rather than being written a second time.
+ */
+import { ApiClient } from "./api-client.js";
+/**
+ * Resolve a `--owner` value to a userId. A value containing "@" is looked up
+ * by exact email through the member-accessible `users/lookup` endpoint
+ * (issue #2763); anything else is already a user id and is passed through.
+ * Failures throw with the server's own message — a permission problem must
+ * not read as "no such user", which is how the old admin-only lookup
+ * reported it.
+ */
+export declare function resolveOwnerUserId(client: ApiClient, appId: string, owner: string): Promise<string>;

package/dist/src/lib/resolve-owner.js

@@ -0,0 +1,20 @@
+import { info } from "./output.js";
+/**
+ * Resolve a `--owner` value to a userId. A value containing "@" is looked up
+ * by exact email through the member-accessible `users/lookup` endpoint
+ * (issue #2763); anything else is already a user id and is passed through.
+ * Failures throw with the server's own message — a permission problem must
+ * not read as "no such user", which is how the old admin-only lookup
+ * reported it.
+ */
+export async function resolveOwnerUserId(client, appId, owner) {
+    if (!owner.includes("@"))
+        return owner;
+    const lookup = await client.lookupUserByEmail(appId, owner);
+    if (!lookup?.exists || !lookup.user) {
+        throw new Error(`No app user found with email "${owner}" in app ${appId}.`);
+    }
+    info(`Resolved owner email to userId: ${lookup.user.userId}`);
+    return lookup.user.userId;
+}
+//# sourceMappingURL=resolve-owner.js.map

package/dist/src/lib/resolve-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-owner.js","sourceRoot":"","sources":["../../../src/lib/resolve-owner.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAiB,EACjB,KAAa,EACb,KAAa;IAEb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC5B,CAAC"}

package/dist/src/lib/resolve-platform.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Pure resolution of the target platforms for `primitive init`.
+ *
+ * Background (issue #1009): `primitive init` must become platform-aware. The
+ * commander `-p, --platform` option no longer carries a `"web"` default, so an
+ * omitted flag is `undefined` and distinguishable from an explicit
+ * `--platform web`. Resolution follows a 4-case interactivity contract:
+ *
+ *   (a) explicit `--platform` flag set        -> use it (never prompt)
+ *   (b) init-config TOML present (configPlatform may be set) -> use config
+ *       value, else fall back to "web" (never prompt)
+ *   (c) interactive TTY, no flag, no config    -> prompt with `checkbox`
+ *   (d) non-TTY, no flag, no config            -> fall back to "web" WITHOUT
+ *       hanging and WITHOUT the `ERR_USE_AFTER_CLOSE` crash that
+ *       `@inquirer/prompts` throws on a closed/piped stdin (same hazard family
+ *       hardened in #972/#999 — see `confirm-prompt.ts`).
+ *
+ * Issue #2890 makes the resolved value a LIST: one Primitive app can have a web
+ * client and a native client, and `primitive init my-app --platform web,ios`
+ * scaffolds both into one repository. A single platform is just a list of one,
+ * so the contract above is unchanged — and the interactive case is a
+ * multi-select rather than a single-select.
+ *
+ * Extracting the decision into a pure function (with injectable `isTTY` /
+ * `promptFn`, mirroring `confirm-prompt.ts`) makes the otherwise
+ * terminal-dependent interactivity contract unit-testable.
+ */
+export type Platform = "web" | "ios";
+/**
+ * Every platform `--platform` accepts, in the order a run processes them: the
+ * web client is configured first (it owns the dev-port step). Parsing
+ * normalizes to this order, so `--platform ios,web` and `--platform web,ios`
+ * scaffold the same repository.
+ */
+export declare const SUPPORTED_PLATFORMS: readonly ["web", "ios"];
+/** Prompt thunk returning the chosen platforms. Injectable for testing. */
+export type PlatformPromptFn = () => Promise<Platform[]>;
+export interface ParsePlatformsResult {
+    /** Whether the value named a valid, duplicate-free, non-empty platform set. */
+    ok: boolean;
+    /** The validated platforms in canonical order; empty when `ok` is false. */
+    platforms: Platform[];
+    /** A user-facing message naming the supported set; set when `ok` is false. */
+    error?: string;
+}
+/**
+ * Parses a `--platform` flag value (`"web"`, `"web,ios"`) or an init-config
+ * `platform` key (a string or a TOML array) into a validated platform list.
+ *
+ * Returns a result rather than throwing so `validateInitConfig` can collect the
+ * message alongside its other errors and the flag path can print it and exit.
+ */
+export declare function parsePlatformList(raw: string | readonly string[]): ParsePlatformsResult;
+export interface ResolvePlatformsOptions {
+    /** Parsed `--platform` flag, or `undefined` when omitted. */
+    flag?: Platform[];
+    /** Parsed `platform` key from a loaded `.primitive-init.toml`, if any. */
+    configPlatform?: Platform[];
+    /**
+     * Whether a non-interactive init-config file is in effect. When `true`, the
+     * prompt is skipped entirely (case b) regardless of TTY.
+     */
+    hasConfig: boolean;
+    /** Whether stdin is an interactive TTY. Inject `false` to exercise case (d). */
+    isTTY: boolean;
+    /** Prompt function used only in the interactive case (c). */
+    promptFn: PlatformPromptFn;
+}
+/**
+ * Resolve the target platforms per the 4-case interactivity contract above.
+ *
+ * @returns a non-empty list of platforms to scaffold.
+ */
+export declare function resolvePlatforms(options: ResolvePlatformsOptions): Promise<Platform[]>;