primitive-admin 1.2.0-alpha.0 → 1.2.0-alpha.2

package/dist/src/lib/sync-paths.d.ts

@@ -57,14 +57,49 @@ export declare function syncStatePath(configDir: string): string;
  * `syncStatePath`) and takes precedence from then on.
  */
 export declare function syncStateReadPath(configDir: string): string;
+/**
+ * The machine-local directory holding each machine-local environment's
+ * baseline (#4117): `<projectRoot>/.primitive/sync-state/<name>.json`.
+ */
+export declare const LOCAL_SYNC_STATE_DIR = "sync-state";
 /**
  * The directory holding this environment's TOML and its sync-state baseline:
  * `<projectRoot>/primitive/<env>/`, and nothing else, ever.
  *
+ * For a machine-local environment (#4117) `<env>` is the committed
+ * environment named by its `tree`: a child app edits its parent's tree. Its
+ * baseline is NOT in that directory — see `resolveSyncStateReadPath`.
+ *
  * Takes no arguments on purpose. An override parameter is the shape a second
  * resolution path grows back in.
  */
 export declare function resolveSyncDir(): string;
+/**
+ * A machine-local environment's own baseline. Kept out of the shared tree so
+ * a pull, push or init on the child never touches the committed environment's
+ * `.sync-state.json` (#4117).
+ */
+export declare function localSyncStatePathFor(projectRoot: string, name: string): string;
+/**
+ * The directory holding every snapshot backup of the environment `name`, across
+ * the apps it has named: `<projectRoot>/.primitive/backups/<name>/`.
+ */
+export declare function localBackupsRootFor(projectRoot: string, name: string): string;
+/**
+ * Where the current environment's sync-state baseline is READ from.
+ *
+ * A committed environment: `syncStateReadPath` over its tree, the legacy
+ * fallback included. A machine-local environment:
+ * `.primitive/sync-state/<name>.json`, with no fallback — a baseline in the
+ * shared tree is the committed environment's, never the child's.
+ */
+export declare function resolveSyncStateReadPath(): string;
+/**
+ * Where the current environment's sync-state baseline is WRITTEN: the tree's
+ * `.sync-state.json`, or a machine-local environment's own file (its
+ * directory created here, as the tree is by the commands that write it).
+ */
+export declare function resolveSyncStateWritePath(): string;
 /**
  * The snapshot-backups root for the slot a sync operation belongs to (issue
  * #578, Phase 1): the machine-local

package/dist/src/lib/sync-paths.js

@@ -25,7 +25,7 @@
  * environment is an error with a remedy rather than a different directory.
  */
 import { existsSync, mkdirSync } from "fs";
-import { join } from "path";
+import { dirname, join } from "path";
 import { requireCurrentEnvironment } from "./env-resolver.js";
 import { PROJECT_LOCAL_STATE_DIR, PROJECT_TREE_DIR } from "./env-resolver-core.js";
 /** The sync-state baseline, committed beside the environment's TOML (#3153). */
@@ -65,10 +65,19 @@ export function syncStateReadPath(configDir) {
     const legacy = join(configDir, LEGACY_SYNC_STATE_FILENAME);
     return existsSync(legacy) ? legacy : current;
 }
+/**
+ * The machine-local directory holding each machine-local environment's
+ * baseline (#4117): `<projectRoot>/.primitive/sync-state/<name>.json`.
+ */
+export const LOCAL_SYNC_STATE_DIR = "sync-state";
 /**
  * The directory holding this environment's TOML and its sync-state baseline:
  * `<projectRoot>/primitive/<env>/`, and nothing else, ever.
  *
+ * For a machine-local environment (#4117) `<env>` is the committed
+ * environment named by its `tree`: a child app edits its parent's tree. Its
+ * baseline is NOT in that directory — see `resolveSyncStateReadPath`.
+ *
  * Takes no arguments on purpose. An override parameter is the shape a second
  * resolution path grows back in.
  */
@@ -77,8 +86,52 @@ export function resolveSyncDir() {
     // Defence-in-depth: the environment name comes from a hand-edited config
     // file and is the only variable segment left in the tree path, so reject
     // separators and `..` before joining it into <projectRoot>/primitive/...
-    assertSafePathComponent(env.name, "environment name");
-    return join(env.projectRoot, PROJECT_TREE_DIR, env.name);
+    assertSafePathComponent(env.tree, "environment name");
+    return join(env.projectRoot, PROJECT_TREE_DIR, env.tree);
+}
+/**
+ * A machine-local environment's own baseline. Kept out of the shared tree so
+ * a pull, push or init on the child never touches the committed environment's
+ * `.sync-state.json` (#4117).
+ */
+export function localSyncStatePathFor(projectRoot, name) {
+    assertSafePathComponent(name, "environment name");
+    return join(projectRoot, PROJECT_LOCAL_STATE_DIR, LOCAL_SYNC_STATE_DIR, `${name}.json`);
+}
+/**
+ * The directory holding every snapshot backup of the environment `name`, across
+ * the apps it has named: `<projectRoot>/.primitive/backups/<name>/`.
+ */
+export function localBackupsRootFor(projectRoot, name) {
+    assertSafePathComponent(name, "environment name");
+    return join(projectRoot, PROJECT_LOCAL_STATE_DIR, "backups", name);
+}
+/**
+ * Where the current environment's sync-state baseline is READ from.
+ *
+ * A committed environment: `syncStateReadPath` over its tree, the legacy
+ * fallback included. A machine-local environment:
+ * `.primitive/sync-state/<name>.json`, with no fallback — a baseline in the
+ * shared tree is the committed environment's, never the child's.
+ */
+export function resolveSyncStateReadPath() {
+    const env = requireCurrentEnvironment();
+    if (env.local)
+        return localSyncStatePathFor(env.projectRoot, env.name);
+    return syncStateReadPath(resolveSyncDir());
+}
+/**
+ * Where the current environment's sync-state baseline is WRITTEN: the tree's
+ * `.sync-state.json`, or a machine-local environment's own file (its
+ * directory created here, as the tree is by the commands that write it).
+ */
+export function resolveSyncStateWritePath() {
+    const env = requireCurrentEnvironment();
+    if (!env.local)
+        return syncStatePath(resolveSyncDir());
+    const path = localSyncStatePathFor(env.projectRoot, env.name);
+    mkdirSync(dirname(path), { recursive: true });
+    return path;
 }
 /**
  * The snapshot-backups root for the slot a sync operation belongs to (issue
@@ -99,9 +152,8 @@ export function resolveSnapshotsRoot(options) {
     const env = requireCurrentEnvironment();
     // Same defence-in-depth as resolveSyncDir: never trust appId blindly when
     // building a file-system path.
-    assertSafePathComponent(env.name, "environment name");
     assertSafePathComponent(options.appId, "appId");
-    return join(env.projectRoot, PROJECT_LOCAL_STATE_DIR, "backups", env.name, options.appId);
+    return join(localBackupsRootFor(env.projectRoot, env.name), options.appId);
 }
 export function assertSafePathComponent(value, label) {
     if (typeof value !== "string" ||

package/dist/src/lib/sync-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-paths.js","sourceRoot":"","sources":["../../../src/lib/sync-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAOjE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,0EAA0E;IAC1E,+BAA+B;IAC/B,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CACT,GAAG,CAAC,WAAW,EACf,uBAAuB,EACvB,SAAS,EACT,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,KAAK,CACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAejE;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,UAA8C,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,sDAAsD;IACtD,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,UAAU;YAC7D,GAAG,UAAU,iBAAiB,SAAS,EAAE;QAC3C,CAAC,CAAC,aAAa,SAAS,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,GAAG,WAAW,qDAAqD;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,iCAAiC;QACnC,CAAC,CAAC,sEAAsE;YACtE,yEAAyE,CAAC;IAE9E,MAAM,OAAO,GACX,GAAG,UAAU,qDAAqD;QAClE,GAAG,WAAW,mBAAmB,KAAK,OAAO,WAAW,EAAE,CAAC;IAC7D,MAAM,UAAU,GACd,2BAA2B,UAAU,+BAA+B;QACpE,uCAAuC,WAAW,mBAAmB;QACrE,uEAAuE;QACvE,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,SAAS;QAChE,OAAO,WAAW,EAAE,CAAC;IAEvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"sync-paths.js","sourceRoot":"","sources":["../../../src/lib/sync-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACtD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAOjE;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,IAAY;IACrE,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,WAAW,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAY;IACnE,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,WAAW,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,qBAAqB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoC;IACvE,MAAM,GAAG,GAAG,yBAAyB,EAAE,CAAC;IACxC,0EAA0E;IAC1E,+BAA+B;IAC/B,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAClE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,EAAE,EACZ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAejE;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,UAA8C,EAAE;IAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,sDAAsD;IACtD,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,eAAe,UAAU,iBAAiB,SAAS,UAAU;YAC7D,GAAG,UAAU,iBAAiB,SAAS,EAAE;QAC3C,CAAC,CAAC,aAAa,SAAS,IAAI,UAAU,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ;QACpB,CAAC,CAAC,GAAG,WAAW,qDAAqD;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,iCAAiC;QACnC,CAAC,CAAC,sEAAsE;YACtE,yEAAyE,CAAC;IAE9E,MAAM,OAAO,GACX,GAAG,UAAU,qDAAqD;QAClE,GAAG,WAAW,mBAAmB,KAAK,OAAO,WAAW,EAAE,CAAC;IAC7D,MAAM,UAAU,GACd,2BAA2B,UAAU,+BAA+B;QACpE,uCAAuC,WAAW,mBAAmB;QACrE,uEAAuE;QACvE,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,SAAS;QAChE,OAAO,WAAW,EAAE,CAAC;IAEvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC"}

package/dist/src/lib/transient-retry.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Retry a request whose failure says nothing about the request itself.
+ *
+ * A 5xx, a 429, a 408 or a failure in transport (no status at all) is the
+ * server or the network having a bad moment: storage answering "internal
+ * error, please try again" is the common one. Every other status is an answer
+ * — a refusal, a validation failure, a missing resource — and asking again
+ * gets the same answer, so it is thrown at once.
+ *
+ * This is the CLI's one retry for such failures: the import's writes and the
+ * export's lookups both go through it.
+ *
+ * Only idempotent requests belong here. A retried request may have landed the
+ * first time with its response lost, so the second attempt must leave the
+ * server where one attempt would have: a read, a blob PUT with the same bytes,
+ * a Yjs state merge, an artifact upload to the same key.
+ */
+/** The waits between attempts: four attempts in all, about 7.5 s at most. */
+export declare const TRANSIENT_RETRY_DELAYS_MS: number[];
+/** Whether an HTTP status is the server having a bad moment, not an answer. */
+export declare function isTransientStatus(status: number): boolean;
+/** The HTTP status a thrown request carries, or `undefined` when it has none. */
+export declare function failureStatus(error: unknown): number | undefined;
+/** Whether a failed request is worth making again. */
+export declare function isTransientFailure(error: unknown): boolean;
+/**
+ * Run `attempt`, retrying a transient failure on the back-off schedule.
+ *
+ * `onRetry` is told about each failure that is about to be retried, so the
+ * caller can say so; the last failure, or the first that is not transient, is
+ * thrown unchanged. `sleep` performs each wait; a test can pass one that
+ * returns at once.
+ */
+export declare function withTransientRetry<T>(attempt: () => Promise<T>, onRetry?: (error: unknown, delayMs: number, attemptNumber: number) => void, delaysMs?: readonly number[], sleep?: (ms: number) => Promise<void>): Promise<T>;

package/dist/src/lib/transient-retry.js

@@ -0,0 +1,57 @@
+/**
+ * Retry a request whose failure says nothing about the request itself.
+ *
+ * A 5xx, a 429, a 408 or a failure in transport (no status at all) is the
+ * server or the network having a bad moment: storage answering "internal
+ * error, please try again" is the common one. Every other status is an answer
+ * — a refusal, a validation failure, a missing resource — and asking again
+ * gets the same answer, so it is thrown at once.
+ *
+ * This is the CLI's one retry for such failures: the import's writes and the
+ * export's lookups both go through it.
+ *
+ * Only idempotent requests belong here. A retried request may have landed the
+ * first time with its response lost, so the second attempt must leave the
+ * server where one attempt would have: a read, a blob PUT with the same bytes,
+ * a Yjs state merge, an artifact upload to the same key.
+ */
+/** The waits between attempts: four attempts in all, about 7.5 s at most. */
+export const TRANSIENT_RETRY_DELAYS_MS = [500, 2000, 5000];
+/** Whether an HTTP status is the server having a bad moment, not an answer. */
+export function isTransientStatus(status) {
+    return status >= 500 || status === 429 || status === 408;
+}
+/** The HTTP status a thrown request carries, or `undefined` when it has none. */
+export function failureStatus(error) {
+    const status = error?.statusCode ?? error?.status;
+    return typeof status === "number" ? status : undefined;
+}
+/** Whether a failed request is worth making again. */
+export function isTransientFailure(error) {
+    const status = failureStatus(error);
+    return status === undefined || isTransientStatus(status);
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Run `attempt`, retrying a transient failure on the back-off schedule.
+ *
+ * `onRetry` is told about each failure that is about to be retried, so the
+ * caller can say so; the last failure, or the first that is not transient, is
+ * thrown unchanged. `sleep` performs each wait; a test can pass one that
+ * returns at once.
+ */
+export async function withTransientRetry(attempt, onRetry, delaysMs = TRANSIENT_RETRY_DELAYS_MS, sleep = defaultSleep) {
+    for (let failures = 0;; failures++) {
+        try {
+            return await attempt();
+        }
+        catch (error) {
+            if (failures >= delaysMs.length || !isTransientFailure(error))
+                throw error;
+            const delayMs = delaysMs[failures];
+            onRetry?.(error, delayMs, failures + 1);
+            await sleep(delayMs);
+        }
+    }
+}
+//# sourceMappingURL=transient-retry.js.map

package/dist/src/lib/transient-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transient-retry.js","sourceRoot":"","sources":["../../../src/lib/transient-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAI,KAAa,EAAE,UAAU,IAAK,KAAa,EAAE,MAAM,CAAC;IACpE,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAClC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyB,EACzB,OAA0E,EAC1E,WAA8B,yBAAyB,EACvD,QAAuC,YAAY;IAEnD,KAAK,IAAI,QAAQ,GAAG,CAAC,GAAI,QAAQ,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/types/index.d.ts

@@ -8,6 +8,27 @@ export interface Credentials {
     role: "admin" | "super-admin";
     name?: string;
     globalAdminAppId?: string;
+    /**
+     * A 15-minute admin step-up held beside this login (#3889): used on a 403
+     * that names `admin`, revoked with it by `primitive logout`.
+     */
+    stepUp?: StepUpCredentials;
+    /**
+     * Where these credentials came from: `env` when `PRIMITIVE_TOKEN` supplied
+     * them (#3890), absent for a stored login. Credentials from the
+     * environment are never written to disk and never cause a stored login to
+     * be cleared.
+     */
+    source?: "env";
+}
+/** An admin step-up session's access token; it has no refresh token. */
+export interface StepUpCredentials {
+    accessToken: string;
+    expiresAt: string;
+    sessionId: string;
+    scope: string[];
+    /** The apps it is pinned to; empty when unpinned. */
+    apps: string[];
 }
 export interface AppSummary {
     appId: string;
@@ -51,10 +72,6 @@ export interface AppSettings {
     }> | null;
     hasPasskey?: boolean;
     emailSignInEnabled?: boolean;
-    /** @deprecated (#2884) Response-only; always equal to `emailSignInEnabled`. */
-    magicLinkEnabled?: boolean;
-    /** @deprecated (#2884) Response-only; always equal to `emailSignInEnabled`. */
-    otpEnabled?: boolean;
     appleSignInEnabled?: boolean | null;
     appleAudiences?: string[] | null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.2.0-alpha.0",
+  "version": "1.2.0-alpha.2",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {
@@ -60,13 +60,14 @@
     "commander": "^12.1.0",
     "esbuild": "0.25.12",
     "inquirer": "^9.2.12",
-    "js-bao": "0.12.0-alpha.0",
+    "js-bao": "0.12.0-alpha.2",
     "mime-types": "^2.1.35",
     "open": "^10.0.3",
     "smol-toml": "1.7.0",
     "tar": "^7.5.22",
     "typescript": "^5.7.2",
-    "ulid": "^2.4.0"
+    "ulid": "^2.4.0",
+    "yjs": "^13.6.18"
   },
   "devDependencies": {
     "@types/inquirer": "^9.0.9",