primitive-admin 1.1.0-alpha.73 → 1.1.0-alpha.74

package/dist/src/lib/workflow-usage.d.ts

@@ -0,0 +1,198 @@
+/**
+ * `primitive analytics workflow-usage` — the value-in / value-out half
+ * (#3130, criteria 2 and 3 of `projects/workflow-usage/intent.md`).
+ *
+ * The per-app report is the server's (#3132,
+ * `GET /admin/api/apps/{appId}/workflows/usage`). What lives here is
+ * everything the CLI decides for itself: the `--window-days` mirror, the
+ * cross-app merge the intent puts on the client rather than in a cross-tenant
+ * endpoint, and the table layout. Keeping it pure means the merge — the part
+ * a live test can only observe through a whole shared table — is provable
+ * exactly, with no server and no doubles.
+ */
+export declare const USAGE_CLI_MIN_WINDOW_DAYS = 1;
+export declare const USAGE_CLI_MAX_WINDOW_DAYS = 45;
+export declare const USAGE_CLI_DEFAULT_WINDOW_DAYS = 30;
+/** The one `--window-days` rejection: names the range and the default. */
+export declare const WINDOW_DAYS_FLAG_ERROR: string;
+/** `--all-apps` answers a different question than one app's report. */
+export declare const ALL_APPS_CONFLICT_ERROR: string;
+/**
+ * The role gate's refusal.
+ *
+ * `GET /admin/api/apps` has no role filter and the per-app usage endpoint
+ * admits any admin assigned to the app, so an app admin who happens to be
+ * assigned to every app would otherwise receive the aggregate. The gate is a
+ * role check, not a hoped-for 403 (D3130-002).
+ */
+export declare const ALL_APPS_SUPER_ADMIN_ERROR = "--all-apps is super-admin only. Run it without --all-apps for one app's report.";
+export interface UsageWorkflowRef {
+    workflowId: string;
+    workflowKey: string;
+}
+export interface UsageKindRow {
+    kind: string;
+    workflows: number;
+    runs: number;
+}
+export interface UsageErrorEntry extends UsageWorkflowRef {
+    resource: "config" | "runs";
+    message: string;
+}
+/** The frozen response body of `GET .../workflows/usage` (#3132). */
+export interface WorkflowUsageReport {
+    windowDays: number;
+    workflowCount: number;
+    runsInWindow: number;
+    items: UsageKindRow[];
+    syncCallable: UsageWorkflowRef[];
+    idleWorkflows: UsageWorkflowRef[];
+    truncated: UsageWorkflowRef[];
+    errors: UsageErrorEntry[];
+    complete: boolean;
+}
+/** A workflow reference in the merge: the same ref, plus its app. */
+export interface MergedWorkflowRef extends UsageWorkflowRef {
+    appId: string;
+}
+/** A merged kind row: `apps` is the number of apps that configure the kind. */
+export interface MergedKindRow {
+    kind: string;
+    workflows: number;
+    apps: number;
+    runs: number;
+}
+/**
+ * A merged error. `resource: "app"` is the CLI's own: the app was listed but
+ * its report could not be read, so the merge is answering over fewer apps
+ * than it counted and says so.
+ */
+export interface MergedErrorEntry {
+    appId: string;
+    workflowId?: string;
+    workflowKey?: string;
+    resource: "config" | "runs" | "app";
+    message: string;
+}
+/** The merged shape, frozen for #3131. */
+export interface MergedUsageReport {
+    windowDays: number;
+    apps: number;
+    workflowCount: number;
+    runsInWindow: number;
+    items: MergedKindRow[];
+    syncCallable: MergedWorkflowRef[];
+    idleWorkflows: MergedWorkflowRef[];
+    truncated: MergedWorkflowRef[];
+    errors: MergedErrorEntry[];
+    complete: boolean;
+}
+/** One app's outcome: its report, or why the CLI could not read it. */
+export type PerAppUsageResult = {
+    appId: string;
+    report: WorkflowUsageReport;
+} | {
+    appId: string;
+    error: string;
+};
+export type WindowDaysFlag = {
+    omitted: true;
+    effective: number;
+} | {
+    omitted: false;
+    effective: number;
+} | {
+    error: string;
+};
+/**
+ * Validate the raw `--window-days` string against the frozen contract.
+ *
+ * Deliberately NOT `parseInt`, which the analytics siblings use: `parseInt`
+ * turns `1.5` into `1` and `46abc` into `46`, so the server's strict `/^\d+$/`
+ * check would never see what the user typed. `omitted` tells the caller to
+ * leave the query parameter off entirely (the server applies its own default)
+ * while still giving the merge a well-defined window to report.
+ */
+export declare function parseWindowDaysFlag(raw: string | undefined): WindowDaysFlag;
+/**
+ * The same two spellings the server accepts (`admin-api.ts`).
+ *
+ * Deliberately the lenient pair rather than the canonical `super-admin`-only
+ * rule: the data this command reads is gated server-side by
+ * `requireAppAccess`, which treats BOTH spellings as super-admin, so a legacy
+ * `superadmin` account can already read every app's report one app at a time.
+ * A stricter client-side gate would refuse a merge of exactly the reports the
+ * server hands that account anyway — a false refusal, not a boundary. The gate
+ * exists to make the APP-ADMIN refusal deterministic (D3130-002); enforcement
+ * stays where it is.
+ */
+export declare function isSuperAdminRole(role: string | null | undefined): boolean;
+/**
+ * How many times `--all-apps` drains the global apps list before merging.
+ *
+ * `GET /admin/api/apps` paginates by re-scanning `App.iterateAll()` from the
+ * start of each page, so a table that changes while it is walked both repeats
+ * and DROPS rows. Measured against the dev table with three apps seeded and
+ * left untouched: 2 of 10 single drains missed one of them, while the union of
+ * two consecutive drains missed none in 9 of 9 samples and three in 8 of 8.
+ * One drain is therefore not a sound basis for a report that claims to cover
+ * every app.
+ */
+export declare const GLOBAL_APPS_MAX_DRAINS = 3;
+/** An app as the global list identifies it. */
+export interface GlobalAppRef {
+    appId: string;
+    name: string;
+}
+/**
+ * Drain the apps list until it converges, and return the union.
+ *
+ * The union is what makes a dropped app unlikely: each drain independently
+ * loses a different row, so an app has to be missed by every drain to be
+ * missed by the merge. Draining stops as soon as a drain after the first adds
+ * nothing new — the enumeration agreed with itself — and otherwise at
+ * `maxDrains`, because on a table where apps are continuously created there is
+ * no fixed point to wait for and a report is more useful than a hang.
+ *
+ * Left deliberately independent of the merge's `complete` flag: `complete`
+ * answers "was every app's report readable", and no client-side walk of this
+ * route can promise more than the union above.
+ */
+export declare function drainAppsUntilConverged(drain: () => Promise<GlobalAppRef[]>, maxDrains?: number): Promise<GlobalAppRef[]>;
+/**
+ * Whether a per-app failure ends the walk.
+ *
+ * A 400, 401 or 403 says the caller cannot ask this question — of this app
+ * today, of any app tomorrow — so continuing would print a merged report over
+ * a silently chosen subset, which answers a different question. Anything else
+ * (5xx, a network blip) is recorded as an `app` error and the walk continues.
+ */
+export declare function isAbortStatus(status: number | undefined | null): boolean;
+/**
+ * Merge one report per app into the cross-app answer.
+ *
+ * `windowDays` is the caller's effective window, not any report's, so the
+ * merge is well-defined over zero apps. `apps` is the number of apps LISTED,
+ * including any whose report failed — a count that shrank silently would
+ * misreport the scope of the answer.
+ */
+export declare function mergeUsageReports(windowDays: number, results: PerAppUsageResult[]): MergedUsageReport;
+/**
+ * One printed block. `heading` goes to stderr (the CLI's `heading()`), `body`
+ * to stdout, so a table-mode run still pipes its data cleanly.
+ */
+export interface UsageOutputBlock {
+    heading?: string;
+    body: string;
+}
+/**
+ * The single-app table: the audit script's sections, in the script's order,
+ * in the CLI's `formatTable` idiom.
+ */
+export declare function renderUsageReport(report: WorkflowUsageReport): UsageOutputBlock[];
+/** The merged table: the same sections, with an APPS column and `appId/` refs. */
+export declare function renderMergedUsageReport(report: MergedUsageReport): UsageOutputBlock[];
+/** An incomplete report is still printed — and still fails (intent). */
+export declare function usageExitCode(report: {
+    complete: boolean;
+}): number;

package/dist/src/lib/workflow-usage.js

@@ -0,0 +1,312 @@
+/**
+ * `primitive analytics workflow-usage` — the value-in / value-out half
+ * (#3130, criteria 2 and 3 of `projects/workflow-usage/intent.md`).
+ *
+ * The per-app report is the server's (#3132,
+ * `GET /admin/api/apps/{appId}/workflows/usage`). What lives here is
+ * everything the CLI decides for itself: the `--window-days` mirror, the
+ * cross-app merge the intent puts on the client rather than in a cross-tenant
+ * endpoint, and the table layout. Keeping it pure means the merge — the part
+ * a live test can only observe through a whole shared table — is provable
+ * exactly, with no server and no doubles.
+ */
+import { formatTable } from "./output.js";
+// ── The window contract ──────────────────────────────────────────────
+//
+// Mirrored from `src/workflows/usage-report.ts`, not imported: the CLI is a
+// separately published package and does not depend on the worker's sources.
+// The range is frozen by the intent's window-days decision (45 is the
+// `WorkflowRun` retention), so the mirror cannot drift out from under the
+// server. It exists because an `--all-apps` merge over zero apps has no
+// request to carry the server's validation or its default.
+export const USAGE_CLI_MIN_WINDOW_DAYS = 1;
+export const USAGE_CLI_MAX_WINDOW_DAYS = 45;
+export const USAGE_CLI_DEFAULT_WINDOW_DAYS = 30;
+/** The one `--window-days` rejection: names the range and the default. */
+export const WINDOW_DAYS_FLAG_ERROR = `--window-days must be an integer between ${USAGE_CLI_MIN_WINDOW_DAYS} and ` +
+    `${USAGE_CLI_MAX_WINDOW_DAYS} (workflow runs are retained for ` +
+    `${USAGE_CLI_MAX_WINDOW_DAYS} days); omit it for the default of ` +
+    `${USAGE_CLI_DEFAULT_WINDOW_DAYS}.`;
+/** `--all-apps` answers a different question than one app's report. */
+export const ALL_APPS_CONFLICT_ERROR = "--all-apps merges every app, so it cannot be combined with an app argument " +
+    "or --app. Drop one of them.";
+/**
+ * The role gate's refusal.
+ *
+ * `GET /admin/api/apps` has no role filter and the per-app usage endpoint
+ * admits any admin assigned to the app, so an app admin who happens to be
+ * assigned to every app would otherwise receive the aggregate. The gate is a
+ * role check, not a hoped-for 403 (D3130-002).
+ */
+export const ALL_APPS_SUPER_ADMIN_ERROR = "--all-apps is super-admin only. Run it without --all-apps for one app's report.";
+/**
+ * Validate the raw `--window-days` string against the frozen contract.
+ *
+ * Deliberately NOT `parseInt`, which the analytics siblings use: `parseInt`
+ * turns `1.5` into `1` and `46abc` into `46`, so the server's strict `/^\d+$/`
+ * check would never see what the user typed. `omitted` tells the caller to
+ * leave the query parameter off entirely (the server applies its own default)
+ * while still giving the merge a well-defined window to report.
+ */
+export function parseWindowDaysFlag(raw) {
+    if (raw === undefined) {
+        return { omitted: true, effective: USAGE_CLI_DEFAULT_WINDOW_DAYS };
+    }
+    if (!/^\d+$/.test(raw))
+        return { error: WINDOW_DAYS_FLAG_ERROR };
+    const value = Number.parseInt(raw, 10);
+    if (value < USAGE_CLI_MIN_WINDOW_DAYS || value > USAGE_CLI_MAX_WINDOW_DAYS) {
+        return { error: WINDOW_DAYS_FLAG_ERROR };
+    }
+    return { omitted: false, effective: value };
+}
+// ── The walk ─────────────────────────────────────────────────────────
+/**
+ * The same two spellings the server accepts (`admin-api.ts`).
+ *
+ * Deliberately the lenient pair rather than the canonical `super-admin`-only
+ * rule: the data this command reads is gated server-side by
+ * `requireAppAccess`, which treats BOTH spellings as super-admin, so a legacy
+ * `superadmin` account can already read every app's report one app at a time.
+ * A stricter client-side gate would refuse a merge of exactly the reports the
+ * server hands that account anyway — a false refusal, not a boundary. The gate
+ * exists to make the APP-ADMIN refusal deterministic (D3130-002); enforcement
+ * stays where it is.
+ */
+export function isSuperAdminRole(role) {
+    return role === "super-admin" || role === "superadmin";
+}
+/**
+ * How many times `--all-apps` drains the global apps list before merging.
+ *
+ * `GET /admin/api/apps` paginates by re-scanning `App.iterateAll()` from the
+ * start of each page, so a table that changes while it is walked both repeats
+ * and DROPS rows. Measured against the dev table with three apps seeded and
+ * left untouched: 2 of 10 single drains missed one of them, while the union of
+ * two consecutive drains missed none in 9 of 9 samples and three in 8 of 8.
+ * One drain is therefore not a sound basis for a report that claims to cover
+ * every app.
+ */
+export const GLOBAL_APPS_MAX_DRAINS = 3;
+/**
+ * Drain the apps list until it converges, and return the union.
+ *
+ * The union is what makes a dropped app unlikely: each drain independently
+ * loses a different row, so an app has to be missed by every drain to be
+ * missed by the merge. Draining stops as soon as a drain after the first adds
+ * nothing new — the enumeration agreed with itself — and otherwise at
+ * `maxDrains`, because on a table where apps are continuously created there is
+ * no fixed point to wait for and a report is more useful than a hang.
+ *
+ * Left deliberately independent of the merge's `complete` flag: `complete`
+ * answers "was every app's report readable", and no client-side walk of this
+ * route can promise more than the union above.
+ */
+export async function drainAppsUntilConverged(drain, maxDrains = GLOBAL_APPS_MAX_DRAINS) {
+    const union = new Map();
+    for (let attempt = 0; attempt < Math.max(1, maxDrains); attempt++) {
+        const before = union.size;
+        for (const app of await drain()) {
+            // Deduplicate by appId: one drain hands the same app back on two pages
+            // whenever the list shifts under the cursor (5-15% of rows, measured),
+            // and a merged report that counted an app twice would report runs
+            // nobody started.
+            if (!app.appId || union.has(app.appId))
+                continue;
+            union.set(app.appId, app);
+        }
+        if (attempt > 0 && union.size === before)
+            break;
+    }
+    return [...union.values()];
+}
+/**
+ * Whether a per-app failure ends the walk.
+ *
+ * A 400, 401 or 403 says the caller cannot ask this question — of this app
+ * today, of any app tomorrow — so continuing would print a merged report over
+ * a silently chosen subset, which answers a different question. Anything else
+ * (5xx, a network blip) is recorded as an `app` error and the walk continues.
+ */
+export function isAbortStatus(status) {
+    return status === 400 || status === 401 || status === 403;
+}
+// ── The merge ────────────────────────────────────────────────────────
+function byAppThenKey(a, b) {
+    if (a.appId !== b.appId)
+        return a.appId < b.appId ? -1 : 1;
+    return a.workflowKey < b.workflowKey ? -1 : a.workflowKey > b.workflowKey ? 1 : 0;
+}
+function withApp(appId, refs) {
+    return (refs || []).map((ref) => ({
+        appId,
+        workflowId: ref.workflowId,
+        workflowKey: ref.workflowKey,
+    }));
+}
+/**
+ * Merge one report per app into the cross-app answer.
+ *
+ * `windowDays` is the caller's effective window, not any report's, so the
+ * merge is well-defined over zero apps. `apps` is the number of apps LISTED,
+ * including any whose report failed — a count that shrank silently would
+ * misreport the scope of the answer.
+ */
+export function mergeUsageReports(windowDays, results) {
+    const perKind = new Map();
+    const syncCallable = [];
+    const idleWorkflows = [];
+    const truncated = [];
+    const errors = [];
+    let workflowCount = 0;
+    let runsInWindow = 0;
+    let complete = true;
+    for (const result of results) {
+        if ("error" in result) {
+            errors.push({
+                appId: result.appId,
+                resource: "app",
+                message: result.error,
+            });
+            complete = false;
+            continue;
+        }
+        const { appId, report } = result;
+        workflowCount += report.workflowCount || 0;
+        runsInWindow += report.runsInWindow || 0;
+        if (report.complete === false)
+            complete = false;
+        for (const row of report.items || []) {
+            const merged = perKind.get(row.kind) || {
+                workflows: 0,
+                runs: 0,
+                apps: new Set(),
+            };
+            merged.workflows += row.workflows;
+            merged.runs += row.runs;
+            merged.apps.add(appId);
+            perKind.set(row.kind, merged);
+        }
+        syncCallable.push(...withApp(appId, report.syncCallable));
+        idleWorkflows.push(...withApp(appId, report.idleWorkflows));
+        truncated.push(...withApp(appId, report.truncated));
+        for (const entry of report.errors || []) {
+            errors.push({
+                appId,
+                workflowId: entry.workflowId,
+                workflowKey: entry.workflowKey,
+                resource: entry.resource,
+                message: entry.message,
+            });
+        }
+    }
+    const items = [...perKind.entries()]
+        .map(([kind, row]) => ({
+        kind,
+        workflows: row.workflows,
+        apps: row.apps.size,
+        runs: row.runs,
+    }))
+        // The endpoint's comparator, and the audit script's: runs desc, then
+        // workflows desc, then `localeCompare` asc.
+        .sort((a, b) => b.runs - a.runs ||
+        b.workflows - a.workflows ||
+        a.kind.localeCompare(b.kind));
+    errors.sort((a, b) => (a.appId < b.appId ? -1 : a.appId > b.appId ? 1 : 0) ||
+        ((a.workflowKey ?? "") < (b.workflowKey ?? "")
+            ? -1
+            : (a.workflowKey ?? "") > (b.workflowKey ?? "")
+                ? 1
+                : 0) ||
+        (a.resource < b.resource ? -1 : a.resource > b.resource ? 1 : 0));
+    return {
+        windowDays,
+        apps: results.length,
+        workflowCount,
+        runsInWindow,
+        items,
+        syncCallable: syncCallable.sort(byAppThenKey),
+        idleWorkflows: idleWorkflows.sort(byAppThenKey),
+        truncated: truncated.sort(byAppThenKey),
+        errors,
+        complete,
+    };
+}
+const NONE = "  (none)";
+function refLine(ref, appId) {
+    const prefix = appId ? `${appId}/` : "";
+    return `  ${prefix}${ref.workflowKey} (${ref.workflowId})`;
+}
+function listBlock(title, refs) {
+    return {
+        heading: `${title} (${refs.length})`,
+        body: refs.length ? refs.map((ref) => refLine(ref, ref.appId)).join("\n") : NONE,
+    };
+}
+function errorLine(entry) {
+    const prefix = entry.appId ? `${entry.appId}/` : "";
+    const subject = entry.workflowKey
+        ? `${prefix}${entry.workflowKey} (${entry.workflowId})`
+        : (entry.appId ?? "");
+    return `  ${subject} ${entry.resource}: ${entry.message}`;
+}
+function errorBlock(entries) {
+    return {
+        heading: `Errors (${entries.length})`,
+        body: entries.length ? entries.map(errorLine).join("\n") : NONE,
+    };
+}
+/**
+ * The single-app table: the audit script's sections, in the script's order,
+ * in the CLI's `formatTable` idiom.
+ */
+export function renderUsageReport(report) {
+    return [
+        {
+            body: `workflows ${report.workflowCount}  ` +
+                `runs in window ${report.runsInWindow}  ` +
+                `window ${report.windowDays} days`,
+        },
+        {
+            heading: "Step kinds",
+            body: formatTable(report.items, [
+                { header: "KIND", key: "kind" },
+                { header: "WORKFLOWS", key: "workflows", align: "right" },
+                { header: "RUNS", key: "runs", align: "right" },
+            ]),
+        },
+        listBlock("Sync-callable workflows", report.syncCallable),
+        listBlock("Idle workflows (no runs in window)", report.idleWorkflows),
+        listBlock("Truncated workflows (run scan cap reached)", report.truncated),
+        errorBlock(report.errors),
+    ];
+}
+/** The merged table: the same sections, with an APPS column and `appId/` refs. */
+export function renderMergedUsageReport(report) {
+    return [
+        {
+            body: `apps ${report.apps}  ` +
+                `workflows ${report.workflowCount}  ` +
+                `runs in window ${report.runsInWindow}  ` +
+                `window ${report.windowDays} days`,
+        },
+        {
+            heading: "Step kinds",
+            body: formatTable(report.items, [
+                { header: "KIND", key: "kind" },
+                { header: "WORKFLOWS", key: "workflows", align: "right" },
+                { header: "APPS", key: "apps", align: "right" },
+                { header: "RUNS", key: "runs", align: "right" },
+            ]),
+        },
+        listBlock("Sync-callable workflows", report.syncCallable),
+        listBlock("Idle workflows (no runs in window)", report.idleWorkflows),
+        listBlock("Truncated workflows (run scan cap reached)", report.truncated),
+        errorBlock(report.errors),
+    ];
+}
+/** An incomplete report is still printed — and still fails (intent). */
+export function usageExitCode(report) {
+    return report.complete ? 0 : 1;
+}
+//# sourceMappingURL=workflow-usage.js.map

package/dist/src/lib/workflow-usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-usage.js","sourceRoot":"","sources":["../../../src/lib/workflow-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GACjC,4CAA4C,yBAAyB,OAAO;IAC5E,GAAG,yBAAyB,mCAAmC;IAC/D,GAAG,yBAAyB,qCAAqC;IACjE,GAAG,6BAA6B,GAAG,CAAC;AAEtC,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAClC,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,iFAAiF,CAAC;AAuFpF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,yBAAyB,IAAI,KAAK,GAAG,yBAAyB,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAQxC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC,EACpC,YAAoB,sBAAsB;IAE1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB;YAClB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiC;IAC7D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED,wEAAwE;AAExE,SAAS,YAAY,CACnB,CAAyC,EACzC,CAAyC;IAEzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAwB;IACtD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACjC,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3C,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;YAAE,QAAQ,GAAG,KAAK,CAAC;QAEhD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI;gBACtC,SAAS,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,GAAG,EAAU;aACxB,CAAC;YACF,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAoB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI;QACJ,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;QACH,qEAAqE;QACrE,4CAA4C;SAC3C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI;QACf,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/B,CAAC;IAEJ,MAAM,CAAC,IAAI,CACT,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YAC5C,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnE,CAAC;IAEF,OAAO;QACL,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,aAAa;QACb,YAAY;QACZ,KAAK;QACL,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,SAAS,OAAO,CAAC,GAAqB,EAAE,KAAc;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO,KAAK,MAAM,GAAG,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAChB,KAAa,EACb,IAAkD;IAElD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG;QACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAMlB;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,GAAG;QACvD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxB,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CACjB,OAME;IAEF,OAAO;QACL,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,GAAG;QACrC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,OAAO;QACL;YACE,IAAI,EACF,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CACrC,MAAyB;IAEzB,OAAO;QACL;YACE,IAAI,EACF,QAAQ,MAAM,CAAC,IAAI,IAAI;gBACvB,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;gBAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/types/index.d.ts

@@ -7,8 +7,6 @@ export interface Credentials {
     email: string;
     role: "admin" | "super-admin";
     name?: string;
-    currentAppId?: string;
-    currentAppName?: string;
     globalAdminAppId?: string;
 }
 export interface AppSummary {
@@ -353,7 +351,10 @@ export interface AnalyticsTopUsersResponse {
     limit: number;
     results: Array<{
         userUlid: string;
+        /** First event ever recorded for the user — does not move with windowDays (#3126). */
         firstSeen: string;
+        /** First event inside windowDays — the window-relative counterpart. */
+        firstSeenInWindow: string;
         lastSeen: string;
         eventCount: number;
     }>;
@@ -577,5 +578,14 @@ export interface SyncState {
             contentHash?: string;
             semanticHash?: string;
         }>;
+        functions?: Record<string, {
+            id: string;
+            modifiedAt: string;
+            contentHash?: string;
+            semanticHash?: string;
+            envelopeHash?: string;
+            activeConfigId?: string;
+            sources?: string[];
+        }>;
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.1.0-alpha.73",
+  "version": "1.1.0-alpha.74",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {
@@ -58,6 +58,7 @@
     "@inquirer/search": "^4.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
+    "esbuild": "0.25.12",
     "inquirer": "^9.2.12",
     "js-bao": "^0.5.1",
     "mime-types": "^2.1.35",