primitive-admin 1.1.0-alpha.71 → 1.1.0-alpha.72

package/dist/src/lib/web-url.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The app's web counterpart, as a normalized web origin (#2982).
+ *
+ * One environment value with two jobs on the iOS side: the emailed sign-in
+ * link points at `<webUrl>/oauth/callback`, and the same origin is what an
+ * incoming universal link is trusted from. Both jobs need an ORIGIN, not just
+ * a URL that parses:
+ *
+ *   - https except loopback, the same rule the server applies to every
+ *     redirect URI (`src/auth/redirect-uri.ts`) — an origin that cannot be
+ *     allow-listed turns every sign-in request into a 400;
+ *   - no path, query or fragment: the web client derives its callback from its
+ *     own origin plus `/oauth/callback` and has no base-path mode, and the
+ *     `apple-app-site-association` component matches that exact path;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateServerUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt.
+ *
+ * This is the surface that EXPLAINS a rejection. The same rule is applied
+ * silently — value or nothing — by every reader that feeds `primitive.json`
+ * without going through the CLI: `normalizeWebOrigin` in `env-resolver-core.ts`
+ * (which cannot import this file; it is copied verbatim into a package that
+ * must not depend on the CLI), its bash/python3 port in the Swift template's
+ * `resolve-primitive-config.sh`, and `PrimitiveAppState.linksBaseURL` as the
+ * app's own floor. `web-url-parity` in the project-config tests pins that the
+ * two TypeScript halves accept and normalize exactly the same values.
+ */
+/**
+ * Validates a web origin. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export declare function validateWebUrl(value: string): string | true;
+/**
+ * The origin form of an already-validated web URL: lowercased host, explicit
+ * port kept, no trailing slash — so `https://app.example.com/` and
+ * `https://app.example.com` are stored, compared and joined identically.
+ */
+export declare function normalizeWebUrl(value: string): string;

package/dist/src/lib/web-url.js

@@ -0,0 +1,76 @@
+/**
+ * The app's web counterpart, as a normalized web origin (#2982).
+ *
+ * One environment value with two jobs on the iOS side: the emailed sign-in
+ * link points at `<webUrl>/oauth/callback`, and the same origin is what an
+ * incoming universal link is trusted from. Both jobs need an ORIGIN, not just
+ * a URL that parses:
+ *
+ *   - https except loopback, the same rule the server applies to every
+ *     redirect URI (`src/auth/redirect-uri.ts`) — an origin that cannot be
+ *     allow-listed turns every sign-in request into a 400;
+ *   - no path, query or fragment: the web client derives its callback from its
+ *     own origin plus `/oauth/callback` and has no base-path mode, and the
+ *     `apple-app-site-association` component matches that exact path;
+ *   - no credentials, which have no business in a link that goes out by email.
+ *
+ * Returns the `string | true` shape `@inquirer/prompts` expects, like
+ * `validateServerUrl`, so the same function backs the flag check, the project
+ * config's field validation and any future prompt.
+ *
+ * This is the surface that EXPLAINS a rejection. The same rule is applied
+ * silently — value or nothing — by every reader that feeds `primitive.json`
+ * without going through the CLI: `normalizeWebOrigin` in `env-resolver-core.ts`
+ * (which cannot import this file; it is copied verbatim into a package that
+ * must not depend on the CLI), its bash/python3 port in the Swift template's
+ * `resolve-primitive-config.sh`, and `PrimitiveAppState.linksBaseURL` as the
+ * app's own floor. `web-url-parity` in the project-config tests pins that the
+ * two TypeScript halves accept and normalize exactly the same values.
+ */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+/** The example every message ends with, so a rejection is actionable. */
+const SHAPE = "e.g. https://app.example.com (or http://localhost:5173 in dev)";
+/**
+ * Validates a web origin. Returns `true` when valid, otherwise the message to
+ * show the user.
+ */
+export function validateWebUrl(value) {
+    if (typeof value !== "string" || !value.trim()) {
+        return `Web URL cannot be empty — ${SHAPE}`;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return `Please enter an absolute URL — ${SHAPE}`;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        return `Web URL must be http(s) — ${SHAPE}`;
+    }
+    if (url.protocol === "http:" && !LOOPBACK_HOSTS.has(url.hostname)) {
+        return `Web URL must use https outside localhost — the server refuses a non-loopback http redirect URI (${SHAPE})`;
+    }
+    if (url.username || url.password) {
+        return `Web URL must not carry credentials — ${SHAPE}`;
+    }
+    if (url.pathname !== "/" && url.pathname !== "") {
+        return `Web URL must be an origin with no path — the web app serves its sign-in callback on its own origin (${SHAPE})`;
+    }
+    if (url.search) {
+        return `Web URL must not carry a query — ${SHAPE}`;
+    }
+    if (url.hash) {
+        return `Web URL must not carry a fragment — ${SHAPE}`;
+    }
+    return true;
+}
+/**
+ * The origin form of an already-validated web URL: lowercased host, explicit
+ * port kept, no trailing slash — so `https://app.example.com/` and
+ * `https://app.example.com` are stored, compared and joined identically.
+ */
+export function normalizeWebUrl(value) {
+    return new URL(value).origin;
+}
+//# sourceMappingURL=web-url.js.map

package/dist/src/lib/web-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-url.js","sourceRoot":"","sources":["../../../src/lib/web-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,KAAK,GAAG,gEAAgE,CAAC;AAE/E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,6BAA6B,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,OAAO,6BAA6B,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,mGAAmG,KAAK,GAAG,CAAC;IACrH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,wCAAwC,KAAK,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,uGAAuG,KAAK,GAAG,CAAC;IACzH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,oCAAoC,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,uCAAuC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC"}

package/dist/src/lib/workflow-field-descriptor.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Classification of the `WorkflowDefinition` field surface (issue #2326,
+ * Phase 1 of #1976).
+ *
+ * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
+ * happening — the server grows a `[workflow]`-level config field (`syncCallable`
+ * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
+ * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
+ * `WorkflowDefinition` model must appear in exactly one of the three groups
+ * below. The generated artifact `generated-workflow-model-fields.ts` carries the
+ * model's real field list (parsed from `models.yaml` at build time), and
+ * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
+ *
+ *     synced ∪ structural ∪ internal  ===  the model's fields
+ *
+ * so a new field hard-fails the guard until someone classifies it.
+ *
+ * ── Scope: declarative classification and coverage ONLY ──────────────────
+ * Decision of record (#1976, 2026-07-23): this table records WHICH fields
+ * exist, whether each is synced / structural / internal, and its `[workflow]`
+ * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
+ * stays outside the table. In particular this file deliberately does NOT encode
+ * as boolean knobs:
+ *   - the schema fields' native-TOML-table-vs-JSON-string parsing
+ *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
+ *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
+ *     owns that),
+ *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
+ *     channels, which are attached alongside the steps write and are not
+ *     `[workflow]`-table keys at all.
+ * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
+ * deliberately narrow.
+ *
+ * ── What Phase 1 does and does not do ───────────────────────────────────
+ * Phase 1 (this file) is the guard only. Making the push builder
+ * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
+ * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
+ * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
+ * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
+ */
+/** Value shape of a synced `[workflow]` key. Descriptive; behavior lives in the handlers. */
+export type WorkflowFieldType = "string" | "number" | "boolean" | "string[]" | "json";
+export interface WorkflowFieldDescriptor {
+    /** `WorkflowDefinition` model field name === the server payload key. */
+    field: string;
+    /** Key under the `[workflow]` table in workflow TOML (usually === `field`). */
+    tomlKey: string;
+    /** Value shape, for the Phase 2 handlers and for documentation. */
+    type: WorkflowFieldType;
+}
+/**
+ * The author-facing `[workflow]`-table config fields — the ones a workflow
+ * author manages as code and the CLI must round-trip.
+ */
+export declare const WORKFLOW_FIELD_DESCRIPTOR: readonly WorkflowFieldDescriptor[];
+/**
+ * Fields that ARE author-controlled but do not live in the `[workflow]` table —
+ * they travel through their own structural channel. Kept distinct from
+ * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
+ */
+export declare const WORKFLOW_FIELDS_STRUCTURAL: ReadonlySet<string>;
+/**
+ * Fields the server owns: identity, ownership, timestamps, computed pointers,
+ * and the deprecated draft/revision slot. None of these are ever sent by the
+ * CLI, and none belong in workflow TOML.
+ */
+export declare const WORKFLOW_FIELDS_INTERNAL: ReadonlySet<string>;
+/**
+ * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
+ * Recorded explicitly so "classified" is never mistaken for "implemented".
+ * `lock` was wired by #1972; `templateMissingMarker` was removed from the
+ * platform by #2643, so the set is now empty.
+ */
+export declare const SYNCED_NOT_YET_WIRED: ReadonlySet<string>;
+/** Descriptor `field` names, for coverage/parity checks. */
+export declare const WORKFLOW_SYNCED_FIELDS: ReadonlySet<string>;
+/** Look up a synced field's descriptor by model field name. */
+export declare function getWorkflowFieldDescriptor(field: string): WorkflowFieldDescriptor | undefined;
+/**
+ * Model fields that are classified in NONE of synced / structural / internal —
+ * i.e. a field someone added to `models.yaml` without deciding how the CLI
+ * treats it. Non-empty is a hard failure in the drift guard.
+ */
+export declare function findUnclassifiedWorkflowFields(modelFields: readonly string[]): string[];
+/**
+ * Classifications that no longer correspond to a model field — i.e. a field
+ * removed from `models.yaml` while the CLI still classifies it. Also a hard
+ * failure: a stale classification must not silently pass, or the coverage
+ * claim quietly stops meaning anything.
+ */
+export declare function findStaleWorkflowClassifications(modelFields: readonly string[]): string[];

package/dist/src/lib/workflow-field-descriptor.js

@@ -0,0 +1,153 @@
+/**
+ * Classification of the `WorkflowDefinition` field surface (issue #2326,
+ * Phase 1 of #1976).
+ *
+ * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
+ * happening — the server grows a `[workflow]`-level config field (`syncCallable`
+ * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
+ * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
+ * `WorkflowDefinition` model must appear in exactly one of the three groups
+ * below. The generated artifact `generated-workflow-model-fields.ts` carries the
+ * model's real field list (parsed from `models.yaml` at build time), and
+ * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
+ *
+ *     synced ∪ structural ∪ internal  ===  the model's fields
+ *
+ * so a new field hard-fails the guard until someone classifies it.
+ *
+ * ── Scope: declarative classification and coverage ONLY ──────────────────
+ * Decision of record (#1976, 2026-07-23): this table records WHICH fields
+ * exist, whether each is synced / structural / internal, and its `[workflow]`
+ * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
+ * stays outside the table. In particular this file deliberately does NOT encode
+ * as boolean knobs:
+ *   - the schema fields' native-TOML-table-vs-JSON-string parsing
+ *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
+ *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
+ *     owns that),
+ *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
+ *     channels, which are attached alongside the steps write and are not
+ *     `[workflow]`-table keys at all.
+ * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
+ * deliberately narrow.
+ *
+ * ── What Phase 1 does and does not do ───────────────────────────────────
+ * Phase 1 (this file) is the guard only. Making the push builder
+ * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
+ * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
+ * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
+ * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
+ */
+/**
+ * The author-facing `[workflow]`-table config fields — the ones a workflow
+ * author manages as code and the CLI must round-trip.
+ */
+export const WORKFLOW_FIELD_DESCRIPTOR = [
+    { field: "name", tomlKey: "name", type: "string" },
+    { field: "status", tomlKey: "status", type: "string" },
+    { field: "description", tomlKey: "description", type: "string" },
+    // JSON Schema objects. TOML may present them as an inline table OR as a
+    // JSON string; the push builder owns that parse (not a knob here).
+    { field: "inputSchema", tomlKey: "inputSchema", type: "json" },
+    { field: "outputSchema", tomlKey: "outputSchema", type: "json" },
+    { field: "perUserMaxRunning", tomlKey: "perUserMaxRunning", type: "number" },
+    { field: "perUserMaxQueued", tomlKey: "perUserMaxQueued", type: "number" },
+    { field: "perAppMaxRunning", tomlKey: "perAppMaxRunning", type: "number" },
+    { field: "perAppMaxQueued", tomlKey: "perAppMaxQueued", type: "number" },
+    { field: "queueTtlSeconds", tomlKey: "queueTtlSeconds", type: "number" },
+    { field: "dequeueOrder", tomlKey: "dequeueOrder", type: "string" },
+    {
+        field: "requiresClientApply",
+        tomlKey: "requiresClientApply",
+        type: "boolean",
+    },
+    // Create-only on the wire (#807: update sends it as a deferred second PATCH
+    // once the new steps are live). That sequencing is the payload builder's job.
+    { field: "syncCallable", tomlKey: "syncCallable", type: "boolean" },
+    { field: "accessRule", tomlKey: "accessRule", type: "string" },
+    { field: "runAs", tomlKey: "runAs", type: "string" },
+    // #1518/#1972 — declarative run-scoped lock. `[workflow.lock]` inline table
+    // on the TOML side, JSON on the wire; validated server-side by
+    // `parseWorkflowLock` (decision of record #6: no client-side mirror validator).
+    { field: "lock", tomlKey: "lock", type: "json" },
+    // #1078 Tier 1b — StringSetField on the model, string array in TOML/JSON.
+    { field: "capabilities", tomlKey: "capabilities", type: "string[]" },
+];
+/**
+ * Fields that ARE author-controlled but do not live in the `[workflow]` table —
+ * they travel through their own structural channel. Kept distinct from
+ * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
+ */
+export const WORKFLOW_FIELDS_STRUCTURAL = new Set([
+    // The workflow's identity. Comes from the TOML file name / `--key`, and is
+    // attached by the caller rather than spread from the `[workflow]` table.
+    "workflowKey",
+    // #1304 — JSON declared-access manifest, derived from the workflow's CEL
+    // fields and attached alongside the steps write, not typed by the author.
+    "metadataManifest",
+]);
+/**
+ * Fields the server owns: identity, ownership, timestamps, computed pointers,
+ * and the deprecated draft/revision slot. None of these are ever sent by the
+ * CLI, and none belong in workflow TOML.
+ */
+export const WORKFLOW_FIELDS_INTERNAL = new Set([
+    // Identity / ownership / timestamps — assigned by the server.
+    "workflowId",
+    "appId",
+    "createdBy",
+    "createdAt",
+    "modifiedAt",
+    // Pointer to the active WorkflowConfiguration — server-computed on publish.
+    "activeConfigId",
+    // DEPRECATED in models.yaml: the legacy revision + draft slot, kept for
+    // migration/backward compatibility. Server-managed; never author-authored.
+    "latestRevision",
+    "stepsR2Key",
+    "draftStepsR2Key",
+    "draftInputSchema",
+    "draftOutputSchema",
+    "draftModifiedAt",
+]);
+/**
+ * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
+ * Recorded explicitly so "classified" is never mistaken for "implemented".
+ * `lock` was wired by #1972; `templateMissingMarker` was removed from the
+ * platform by #2643, so the set is now empty.
+ */
+export const SYNCED_NOT_YET_WIRED = new Set([]);
+/** Descriptor `field` names, for coverage/parity checks. */
+export const WORKFLOW_SYNCED_FIELDS = new Set(WORKFLOW_FIELD_DESCRIPTOR.map((d) => d.field));
+/** Look up a synced field's descriptor by model field name. */
+export function getWorkflowFieldDescriptor(field) {
+    return WORKFLOW_FIELD_DESCRIPTOR.find((d) => d.field === field);
+}
+/**
+ * Model fields that are classified in NONE of synced / structural / internal —
+ * i.e. a field someone added to `models.yaml` without deciding how the CLI
+ * treats it. Non-empty is a hard failure in the drift guard.
+ */
+export function findUnclassifiedWorkflowFields(modelFields) {
+    return modelFields
+        .filter((f) => !WORKFLOW_SYNCED_FIELDS.has(f) &&
+        !WORKFLOW_FIELDS_STRUCTURAL.has(f) &&
+        !WORKFLOW_FIELDS_INTERNAL.has(f))
+        .sort();
+}
+/**
+ * Classifications that no longer correspond to a model field — i.e. a field
+ * removed from `models.yaml` while the CLI still classifies it. Also a hard
+ * failure: a stale classification must not silently pass, or the coverage
+ * claim quietly stops meaning anything.
+ */
+export function findStaleWorkflowClassifications(modelFields) {
+    const known = new Set(modelFields);
+    return [
+        ...WORKFLOW_SYNCED_FIELDS,
+        ...WORKFLOW_FIELDS_STRUCTURAL,
+        ...WORKFLOW_FIELDS_INTERNAL,
+    ]
+        .filter((f) => !known.has(f))
+        .sort();
+}
+//# sourceMappingURL=workflow-field-descriptor.js.map

package/dist/src/lib/workflow-field-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-field-descriptor.js","sourceRoot":"","sources":["../../../src/lib/workflow-field-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAmBH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAuC;IAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClD,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtD,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChE,wEAAwE;IACxE,mEAAmE;IACnE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9D,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IAChE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClE;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;KAChB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;IACnE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9D,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,+DAA+D;IAC/D,gFAAgF;IAChF,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAChD,0EAA0E;IAC1E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5D,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,yEAAyE;IACzE,0EAA0E;IAC1E,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,8DAA8D;IAC9D,YAAY;IACZ,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS,EAAE,CAAC,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAChE,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC9C,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,0BAA0B,CACxC,KAAa;IAEb,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAA8B;IAE9B,OAAO,WAAW;SACf,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,wBAAwB;KAC5B;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.1.0-alpha.71",
+  "version": "1.1.0-alpha.72",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {