primitive-admin 1.1.0 → 1.2.0-alpha.1

package/dist/src/commands/settings.js

@@ -0,0 +1,54 @@
+/**
+ * `primitive settings` — the app-settings READER (issue #1033, Phase 2;
+ * narrowed to a reader by #2645).
+ *
+ * App settings are authored in `app.toml` and applied with `sync push`, so
+ * this group carries the one thing the file cannot answer: what the server is
+ * actually running. `settings get` renders the server-effective settings —
+ * `get` rather than `show`, so the read verb is the same word on every
+ * configuration surface.
+ *
+ * `settings pull`, `settings diff` and `settings push` are gone. They operated
+ * on the same `app.toml` and the same `entities.app` hash `sync` owns, so they
+ * were a second pathway to one piece of state; `sync pull|diff|push --only app`
+ * is the single one. The remaining command logic lives in
+ * `sync-app-settings.ts`, shared with `sync`.
+ */
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId } from "../lib/config.js";
+import { showAppSettings } from "./sync-app-settings.js";
+export function registerSettingsCommands(program) {
+    const settings = program
+        .command("settings")
+        .description("View the app settings the server is running")
+        .addHelpText("after", `
+Examples:
+  $ primitive settings get                  # Render current server settings
+  $ primitive settings get --json           # Machine-readable
+  $ primitive sync pull --only app          # Write server settings to app.toml
+  $ primitive config set app app.baseUrl=https://example.com
+  $ primitive sync diff --only app          # Show local app.toml vs server
+  $ primitive sync push --only app          # Apply app.toml edits to the server
+
+app.toml is the ONLY way to manage app configuration (issue #2645): a full
+\`sync push\` applies it, and \`sync push --only app\` applies it alone.
+\`primitive config fields app\` lists its keys, types and defaults. The Google OAuth
+client secret is an ordinary [auth] key holding a reference into the app's
+secret store, never the secret itself: store the value with
+'primitive secrets set GOOGLE_CLIENT_SECRET --value <secret>', then set
+googleClientSecret = "{{secrets.GOOGLE_CLIENT_SECRET}}" in app.toml. A literal
+secret there is rejected by the server.
+`);
+    // settings get
+    settings
+        .command("get")
+        .description("Show the current server-effective app settings")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        await showAppSettings(new ApiClient(), resolvedAppId, options);
+    });
+}
+//# sourceMappingURL=settings.js.map

package/dist/src/commands/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/commands/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;CAiBL,CACI,CAAC;IAEJ,eAAe;IACf,QAAQ;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,eAAe,CAAC,IAAI,SAAS,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/sync.d.ts

@@ -676,8 +676,8 @@ export declare function serializeBlobBucket(bucket: any, logger?: (message: stri
  *
  * EXACT extraction of the inline builder shared by the existing-update and
  * 409-adopt branches — do NOT "clean up" the truthiness checks on the access
- * model. The server treats `preset` and `accessPolicy` as mutually exclusive,
- * only clears `ruleSetId` when a preset/accessPolicy is also present, and
+ * model. The server treats `preset` and `ruleSetId` as mutually exclusive,
+ * only clears `ruleSetId` when a preset is also present, and
  * refuses to leave a bucket with no access model or a blank name — so those
  * fields are not clearable. `bucketKey` and `ttlTier` are immutable and never
  * sent. Both call sites must go through this helper so their field sets never
@@ -706,9 +706,6 @@ export declare function buildBlobBucketUpdatePayload(bucket: any): any;
  * first-wins rule: making the file's meaning depend on entry order is the kind
  * of implicit behavior this issue exists to remove, and silently picking one
  * would let the repo claim something the server does not do.
- *
- * `isActive` is accepted as a legacy spelling — the create leg read it before
- * pull ever wrote a marker, so a hand-authored file carrying it keeps working.
  */
 export declare function promptActiveConfigName(configs: any[]): string | undefined;
 /**
@@ -1554,7 +1551,7 @@ export declare function hashLocalConfigForDiff(spec: ConfigDiffSpec, parsedToml:
  * Hash a SERVER entity the same way, by serializing it into the file `sync
  * pull` would write and hashing that — so the two sides are normalized
  * identically by construction, and a legacy encoding on disk (a JSON-string
- * operation, an id-based rule-set reference) is not a false `Modified`.
+ * operation) is not a false `Modified`.
  *
  * `extra` carries the sibling rows a type's file also holds: a database type's
  * operations and subscriptions, which the list response does not include.
@@ -2104,11 +2101,40 @@ export interface TestCaseLookupMaps {
     configIdToName: Map<string, string>;
     promptIdToKey: Map<string, string>;
 }
+/**
+ * A test-case reference the id→name lookups could not name (#3998): the TOML
+ * key it is authored under, the wire field it is stored in, and the raw id.
+ */
+export interface TestCaseUnresolvedReference {
+    tomlKey: "configName" | "evaluatorPromptKey" | "evaluatorConfigName";
+    field: "configId" | "evaluatorPromptId" | "evaluatorConfigId";
+    id: string;
+}
+/**
+ * The sidecar `config pull` writes for one server record. It never emits an id
+ * key (#3998): a reference the lookups cannot name is written as an empty name
+ * and reported through `onUnresolved`, and `pullTestCasesForBlock` declines to
+ * write such a case rather than unpin it on disk.
+ */
 export declare function serializeTestCase(testCase: any, lookupMaps?: TestCaseLookupMaps, options?: {
     /** The sidecar path the warning names, e.g. `prompts/greet.tests/a.toml`. */
     file?: string;
     logger?: (message: string) => void;
+    /** Called with the references the lookups could not name, when any. */
+    onUnresolved?: (references: TestCaseUnresolvedReference[]) => void;
 }): string;
+/**
+ * The rendering of a server record that the comparison parses (#3998) — never
+ * written to disk.
+ *
+ * It differs from the file pull writes in one place: a reference the lookups
+ * cannot name carries its raw id in the NAME slot. A live case pinned to a
+ * deleted or unlistable configuration must stay a difference against an
+ * unpinned file; projecting it as "no reference" would read the pair as Synced,
+ * and the next content edit would push `configId: null` and clear the pin in
+ * silence.
+ */
+export declare function serializeTestCaseForComparison(testCase: any, lookupMaps?: TestCaseLookupMaps): string;
 export declare function parseTestCaseToml(tomlData: any): any;
 /**
  * Pull server-side `Script` rows into `transforms/*.rhai` and record
@@ -2258,12 +2284,55 @@ export declare function pullFunctions(client: ApiClient, appId: string, configDi
      */
     items: any[];
 }>;
+/**
+ * A listed test case `config pull` did NOT write, because a reference could not
+ * be named (#3998). Its existing sidecar files (`preservedSlugs`, those still
+ * on disk) and its prior sync-state records were kept as they were.
+ */
+export interface TestCaseUnwritten {
+    blockType: TestBlockType;
+    blockKey: string;
+    /** The file name the case would be written to now. */
+    slug: string;
+    name: string;
+    testCaseId: string;
+    references: TestCaseUnresolvedReference[];
+    preservedSlugs: string[];
+}
+/**
+ * The id→name lookups `config pull` writes test-case references through
+ * (#3998).
+ *
+ * The prompt half is built from EVERY prompt's detail — the pull fetches them
+ * all before `--only` filters the list — so a judge prompt outside the
+ * selection still names. Configurations come from the pulled blocks (a case
+ * pins one of its own block's) and from every prompt (a judge's config is the
+ * judge prompt's). An entry without both an id and a name is skipped.
+ */
+export declare function testCaseLookupMapsForPull(input: {
+    prompts: ReadonlyArray<{
+        promptId?: string;
+        promptKey?: string;
+        configs?: ReadonlyArray<{
+            configId?: string;
+            configName?: string;
+        }> | null;
+    }>;
+    configs: ReadonlyArray<{
+        configId?: string;
+        configName?: string;
+    }>;
+}): TestCaseLookupMaps;
 /** The outcome of one block's test-case pull (#2769). */
 export type TestCasePullOutcome = 
-/** The listing succeeded; `count` cases were written and stale files removed. */
+/**
+ * The listing succeeded; `count` cases were written and stale files removed.
+ * `unwritten` are the listed cases skipped for an unresolvable reference.
+ */
 {
     ok: true;
     count: number;
+    unwritten: TestCaseUnwritten[];
 }
 /** The listing failed: nothing was written, and the caller preserves state. */
  | {
@@ -2339,6 +2408,7 @@ export declare function pullTestCasesForBlocks(params: {
 }): Promise<{
     count: number;
     skippedBlocks: string[];
+    unwritten: TestCaseUnwritten[];
 }>;
 interface PushResolutionMaps {
     promptKeyToId: Map<string, string>;