primitive-admin 1.1.0-alpha.86 → 1.1.0-alpha.87

package/dist/src/lib/generated-sdk-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-sdk-types.js","sourceRoot":"","sources":["../../../src/lib/generated-sdk-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kyhHAAkyhH,CAAC"}
+{"version":3,"file":"generated-sdk-types.js","sourceRoot":"","sources":["../../../src/lib/generated-sdk-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,0u9GAA0u9G,CAAC"}

package/dist/src/lib/logout-admin-session.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Revoke the stored admin session on the server — `primitive logout` (#3885).
+ *
+ * Logout used to delete the local credentials file and nothing else, so the
+ * refresh token it held stayed valid for its whole 30-day sliding life. Now the
+ * CLI posts that refresh token to `POST /admin/api/auth/logout`, which revokes
+ * its session, and clears the local file only once the server has answered.
+ *
+ * Like `refresh-admin-credentials.ts`, this module does the HTTP exchange and
+ * classifies the answer; it neither prints nor touches the credentials store.
+ * The caller decides:
+ *
+ *   - `revoked`: the server ended the session (or had nothing to end) — clear.
+ *   - `already-invalid`: 401, the stored token was refused outright — nothing
+ *     is left to revoke, so clear.
+ *   - a thrown `LogoutError`: the server could not be reached or did not
+ *     answer usably — the session may still be live, so KEEP the credentials
+ *     so a re-run can revoke it.
+ */
+import type { Credentials } from "../types/index.js";
+export type LogoutOutcome = {
+    kind: "revoked";
+    revoked: string[];
+} | {
+    kind: "already-invalid";
+    status: number;
+};
+export declare class LogoutError extends Error {
+    statusCode?: number;
+    cause?: unknown;
+    constructor(message: string, statusCode?: number, cause?: unknown);
+}
+export declare function logoutAdminSession(credentials: Credentials): Promise<LogoutOutcome>;

package/dist/src/lib/logout-admin-session.js

@@ -0,0 +1,70 @@
+/**
+ * Revoke the stored admin session on the server — `primitive logout` (#3885).
+ *
+ * Logout used to delete the local credentials file and nothing else, so the
+ * refresh token it held stayed valid for its whole 30-day sliding life. Now the
+ * CLI posts that refresh token to `POST /admin/api/auth/logout`, which revokes
+ * its session, and clears the local file only once the server has answered.
+ *
+ * Like `refresh-admin-credentials.ts`, this module does the HTTP exchange and
+ * classifies the answer; it neither prints nor touches the credentials store.
+ * The caller decides:
+ *
+ *   - `revoked`: the server ended the session (or had nothing to end) — clear.
+ *   - `already-invalid`: 401, the stored token was refused outright — nothing
+ *     is left to revoke, so clear.
+ *   - a thrown `LogoutError`: the server could not be reached or did not
+ *     answer usably — the session may still be live, so KEEP the credentials
+ *     so a re-run can revoke it.
+ */
+import { fetchWithTLS } from "./fetch.js";
+export class LogoutError extends Error {
+    statusCode;
+    cause;
+    constructor(message, statusCode, cause) {
+        super(message);
+        this.statusCode = statusCode;
+        this.cause = cause;
+        this.name = "LogoutError";
+    }
+}
+export async function logoutAdminSession(credentials) {
+    const url = `${credentials.serverUrl}/admin/api/auth/logout`;
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (credentials.globalAdminAppId) {
+        headers["X-Global-Admin-App-Id"] = credentials.globalAdminAppId;
+    }
+    let response;
+    try {
+        response = await fetchWithTLS(url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(credentials.refreshToken ? { refreshToken: credentials.refreshToken } : {}),
+        });
+    }
+    catch (cause) {
+        const reason = cause instanceof Error && cause.message ? cause.message : String(cause);
+        throw new LogoutError(`Could not reach ${credentials.serverUrl}: ${reason}.`, undefined, cause);
+    }
+    if (response.status === 401) {
+        return { kind: "already-invalid", status: 401 };
+    }
+    if (!response.ok) {
+        throw new LogoutError(`${credentials.serverUrl} answered ${response.status}.`, response.status);
+    }
+    let revoked = [];
+    try {
+        const body = (await response.json());
+        if (Array.isArray(body?.revoked)) {
+            revoked = body.revoked.filter((id) => typeof id === "string");
+        }
+    }
+    catch {
+        // A server before #3885 answers `{ success: true }` or nothing usable:
+        // it revoked nothing, and there is nothing more to do.
+    }
+    return { kind: "revoked", revoked };
+}
+//# sourceMappingURL=logout-admin-session.js.map

package/dist/src/lib/logout-admin-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-admin-session.js","sourceRoot":"","sources":["../../../src/lib/logout-admin-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAO1C,MAAM,OAAO,WAAY,SAAQ,KAAK;IAG3B;IACA;IAHT,YACE,OAAe,EACR,UAAmB,EACnB,KAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAwB;IAExB,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,wBAAwB,CAAC;IAC7D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3E;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,IAAI,WAAW,CACnB,mBAAmB,WAAW,CAAC,SAAS,KAAK,MAAM,GAAG,EACtD,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CACnB,GAAG,WAAW,CAAC,SAAS,aAAa,QAAQ,CAAC,MAAM,GAAG,EACvD,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAW,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,uDAAuD;IACzD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/src/lib/refresh-admin-credentials.d.ts

@@ -45,8 +45,16 @@ export declare class RefreshError extends Error {
     kind: RefreshFailureKind;
     statusCode?: number;
     cause?: unknown;
-    constructor(message: string, kind: RefreshFailureKind, statusCode?: number, cause?: unknown);
+    /** The server's machine-readable `code`, when it sent one. */
+    code?: string;
+    constructor(message: string, kind: RefreshFailureKind, statusCode?: number, cause?: unknown, 
+    /** The server's machine-readable `code`, when it sent one. */
+    code?: string);
 }
+/** The refresh token's session was revoked (logout or `auth sessions revoke`). */
+export declare const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
+/** Any other refused refresh. */
+export declare const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
 /**
  * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
  * `Credentials` object — the caller is responsible for persistence via

package/dist/src/lib/refresh-admin-credentials.js

@@ -37,14 +37,22 @@ export class RefreshError extends Error {
     kind;
     statusCode;
     cause;
-    constructor(message, kind, statusCode, cause) {
+    code;
+    constructor(message, kind, statusCode, cause, 
+    /** The server's machine-readable `code`, when it sent one. */
+    code) {
         super(message);
         this.kind = kind;
         this.statusCode = statusCode;
         this.cause = cause;
+        this.code = code;
         this.name = "RefreshError";
     }
 }
+/** The refresh token's session was revoked (logout or `auth sessions revoke`). */
+export const SESSION_REVOKED_MESSAGE = "This session was revoked. Run 'primitive login'.";
+/** Any other refused refresh. */
+export const REFRESH_EXPIRED_MESSAGE = "Refresh token expired. Run 'primitive login'.";
 /**
  * Exchange the stored refresh token for a fresh `accessToken`. Returns a new
  * `Credentials` object — the caller is responsible for persistence via
@@ -86,7 +94,19 @@ export async function refreshAdminCredentials(credentials) {
         throw new RefreshError(`Network error refreshing token: ${reason}.`, "network", undefined, cause);
     }
     if (!response.ok) {
-        throw new RefreshError("Refresh token expired. Run 'primitive login'.", "unauthorized", response.status);
+        // #3885: a refresh of a revoked session answers 401 with code
+        // SESSION_REVOKED; say so, rather than calling the token expired.
+        let code;
+        try {
+            const body = (await response.json());
+            code = typeof body?.code === "string" ? body.code : undefined;
+        }
+        catch {
+            // Not JSON: no code to report.
+        }
+        throw new RefreshError(code === "SESSION_REVOKED"
+            ? SESSION_REVOKED_MESSAGE
+            : REFRESH_EXPIRED_MESSAGE, "unauthorized", response.status, undefined, code);
     }
     const data = (await response.json());
     const accessToken = data?.accessToken || data?.jwt;

package/dist/src/lib/refresh-admin-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAJT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAGtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,+CAA+C,EAC/C,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh-admin-credentials.js","sourceRoot":"","sources":["../../../src/lib/refresh-admin-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,YAAa,SAAQ,KAAK;IAG5B;IACA;IACA;IAEA;IANT,YACE,OAAe,EACR,IAAwB,EACxB,UAAmB,EACnB,KAAe;IACtB,8DAA8D;IACvD,IAAa;QAEpB,KAAK,CAAC,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAoB;QACxB,eAAU,GAAV,UAAU,CAAS;QACnB,UAAK,GAAL,KAAK,CAAU;QAEf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kDAAkD,CAAC;AAErD,iCAAiC;AACjC,MAAM,CAAC,MAAM,uBAAuB,GAClC,+CAA+C,CAAC;AAElD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAwB;IAExB,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,iDAAiD,EACjD,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,WAAW,CAAC,SAAS,yBAAyB,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjC,OAAO,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;IAClE,CAAC;IAED,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mCAAmC,MAAM,GAAG,EAC5C,SAAS,EACT,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,8DAA8D;QAC9D,kEAAkE;QAClE,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;YAC5C,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,IAAI,KAAK,iBAAiB;YACxB,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,uBAAuB,EAC3B,cAAc,EACd,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC5C,MAAM,WAAW,GAAuB,IAAI,EAAE,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC;IACvE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,cAAc,EACd,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,WAAW;QACd,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QAC3D,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/lib/storage-pending-retry.d.ts

@@ -0,0 +1,26 @@
+/**
+ * #3835 — ask again when the server could not confirm its OWN write.
+ *
+ * A create whose row dynamo-bao wrote but could not read back, and whose
+ * consistent confirm read could not vouch for it either, is answered
+ * `503 STORAGE_CONSISTENCY_PENDING` (`src/services/readback-confirm.ts`): the
+ * write may well have landed, and nothing about the request was wrong. A push
+ * that records that as "could not be applied" exits 1 over a change that is
+ * very likely on the server already.
+ *
+ * Only that typed code is retried — a client that retries on it must not also
+ * retry on everything else a 503 covers — and only a bounded number of times,
+ * after which the transient itself is what the caller reports.
+ */
+/** The code the server's read-back transient carries. */
+export declare const STORAGE_CONSISTENCY_PENDING = "STORAGE_CONSISTENCY_PENDING";
+export declare function isStorageConsistencyPending(err: unknown): boolean;
+/**
+ * Run `fn`, and run it again while it fails with the storage-consistency
+ * transient. Any other failure — including the 409 a retried create meets when
+ * its first attempt's row holds the key — is thrown to the caller unchanged.
+ */
+export declare function retryOnStoragePending<T>(fn: () => Promise<T>, opts?: {
+    attempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<T>;

package/dist/src/lib/storage-pending-retry.js

@@ -0,0 +1,42 @@
+/**
+ * #3835 — ask again when the server could not confirm its OWN write.
+ *
+ * A create whose row dynamo-bao wrote but could not read back, and whose
+ * consistent confirm read could not vouch for it either, is answered
+ * `503 STORAGE_CONSISTENCY_PENDING` (`src/services/readback-confirm.ts`): the
+ * write may well have landed, and nothing about the request was wrong. A push
+ * that records that as "could not be applied" exits 1 over a change that is
+ * very likely on the server already.
+ *
+ * Only that typed code is retried — a client that retries on it must not also
+ * retry on everything else a 503 covers — and only a bounded number of times,
+ * after which the transient itself is what the caller reports.
+ */
+import { ApiError } from "./api-client.js";
+/** The code the server's read-back transient carries. */
+export const STORAGE_CONSISTENCY_PENDING = "STORAGE_CONSISTENCY_PENDING";
+const DEFAULT_ATTEMPTS = 3;
+const BASE_DELAY_MS = 250;
+export function isStorageConsistencyPending(err) {
+    return err instanceof ApiError && err.code === STORAGE_CONSISTENCY_PENDING;
+}
+/**
+ * Run `fn`, and run it again while it fails with the storage-consistency
+ * transient. Any other failure — including the 409 a retried create meets when
+ * its first attempt's row holds the key — is thrown to the caller unchanged.
+ */
+export async function retryOnStoragePending(fn, opts = {}) {
+    const attempts = Math.max(1, opts.attempts ?? DEFAULT_ATTEMPTS);
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (attempt >= attempts || !isStorageConsistencyPending(err))
+                throw err;
+            await sleep(BASE_DELAY_MS * 2 ** (attempt - 1));
+        }
+    }
+}
+//# sourceMappingURL=storage-pending-retry.js.map

package/dist/src/lib/storage-pending-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-pending-retry.js","sourceRoot":"","sources":["../../../src/lib/storage-pending-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,yDAAyD;AACzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,OAAO,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAoB,EACpB,OAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IAChE,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,QAAQ,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxE,MAAM,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/lib/workflow-usage.d.ts

@@ -20,10 +20,10 @@ export declare const ALL_APPS_CONFLICT_ERROR: string;
 /**
  * The role gate's refusal.
  *
- * `GET /admin/api/apps` has no role filter and the per-app usage endpoint
- * admits any admin assigned to the app, so an app admin who happens to be
- * assigned to every app would otherwise receive the aggregate. The gate is a
- * role check, not a hoped-for 403 (D3130-002).
+ * `GET /admin/api/apps` is super-admin only (#3882), so the server refuses
+ * anyone else the list this command walks. The client checks the same role
+ * first so the refusal is this message, before any request, rather than a
+ * server 403 mid-command (D3130-002).
  */
 export declare const ALL_APPS_SUPER_ADMIN_ERROR = "--all-apps is super-admin only. Run it without --all-apps for one app's report.";
 export interface UsageWorkflowRef {
@@ -115,16 +115,14 @@ export type WindowDaysFlag = {
  */
 export declare function parseWindowDaysFlag(raw: string | undefined): WindowDaysFlag;
 /**
- * The same two spellings the server accepts (`admin-api.ts`).
+ * The strict `super-admin` rule the server's `GET /admin/api/apps` gate
+ * applies (`requireSuperAdmin` in `admin-api.ts`, #3882).
  *
- * Deliberately the lenient pair rather than the canonical `super-admin`-only
- * rule: the data this command reads is gated server-side by
- * `requireAppAccess`, which treats BOTH spellings as super-admin, so a legacy
- * `superadmin` account can already read every app's report one app at a time.
- * A stricter client-side gate would refuse a merge of exactly the reports the
- * server hands that account anyway — a false refusal, not a boundary. The gate
- * exists to make the APP-ADMIN refusal deterministic (D3130-002); enforcement
- * stays where it is.
+ * D3130-002 accepted the legacy `superadmin` spelling too, because the server
+ * then served that account everything `--all-apps` reads. Since #3882 the
+ * server refuses that account the global app list, so a lenient check here
+ * would only defer the same refusal to a server 403. The client refuses first,
+ * with `ALL_APPS_SUPER_ADMIN_ERROR`; enforcement stays server-side.
  */
 export declare function isSuperAdminRole(role: string | null | undefined): boolean;
 /**

package/dist/src/lib/workflow-usage.js

@@ -33,10 +33,10 @@ export const ALL_APPS_CONFLICT_ERROR = "--all-apps merges every app, so it canno
 /**
  * The role gate's refusal.
  *
- * `GET /admin/api/apps` has no role filter and the per-app usage endpoint
- * admits any admin assigned to the app, so an app admin who happens to be
- * assigned to every app would otherwise receive the aggregate. The gate is a
- * role check, not a hoped-for 403 (D3130-002).
+ * `GET /admin/api/apps` is super-admin only (#3882), so the server refuses
+ * anyone else the list this command walks. The client checks the same role
+ * first so the refusal is this message, before any request, rather than a
+ * server 403 mid-command (D3130-002).
  */
 export const ALL_APPS_SUPER_ADMIN_ERROR = "--all-apps is super-admin only. Run it without --all-apps for one app's report.";
 /**
@@ -62,19 +62,17 @@ export function parseWindowDaysFlag(raw) {
 }
 // ── The walk ─────────────────────────────────────────────────────────
 /**
- * The same two spellings the server accepts (`admin-api.ts`).
+ * The strict `super-admin` rule the server's `GET /admin/api/apps` gate
+ * applies (`requireSuperAdmin` in `admin-api.ts`, #3882).
  *
- * Deliberately the lenient pair rather than the canonical `super-admin`-only
- * rule: the data this command reads is gated server-side by
- * `requireAppAccess`, which treats BOTH spellings as super-admin, so a legacy
- * `superadmin` account can already read every app's report one app at a time.
- * A stricter client-side gate would refuse a merge of exactly the reports the
- * server hands that account anyway — a false refusal, not a boundary. The gate
- * exists to make the APP-ADMIN refusal deterministic (D3130-002); enforcement
- * stays where it is.
+ * D3130-002 accepted the legacy `superadmin` spelling too, because the server
+ * then served that account everything `--all-apps` reads. Since #3882 the
+ * server refuses that account the global app list, so a lenient check here
+ * would only defer the same refusal to a server 403. The client refuses first,
+ * with `ALL_APPS_SUPER_ADMIN_ERROR`; enforcement stays server-side.
  */
 export function isSuperAdminRole(role) {
-    return role === "super-admin" || role === "superadmin";
+    return role === "super-admin";
 }
 /**
  * How many times `--all-apps` drains the global apps list before merging.

package/dist/src/lib/workflow-usage.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-usage.js","sourceRoot":"","sources":["../../../src/lib/workflow-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GACjC,4CAA4C,yBAAyB,OAAO;IAC5E,GAAG,yBAAyB,mCAAmC;IAC/D,GAAG,yBAAyB,qCAAqC;IACjE,GAAG,6BAA6B,GAAG,CAAC;AAEtC,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAClC,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,iFAAiF,CAAC;AAuFpF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,yBAAyB,IAAI,KAAK,GAAG,yBAAyB,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,OAAO,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAQxC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC,EACpC,YAAoB,sBAAsB;IAE1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB;YAClB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiC;IAC7D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED,wEAAwE;AAExE,SAAS,YAAY,CACnB,CAAyC,EACzC,CAAyC;IAEzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAwB;IACtD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACjC,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3C,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;YAAE,QAAQ,GAAG,KAAK,CAAC;QAEhD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI;gBACtC,SAAS,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,GAAG,EAAU;aACxB,CAAC;YACF,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAoB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI;QACJ,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;QACH,qEAAqE;QACrE,4CAA4C;SAC3C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI;QACf,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/B,CAAC;IAEJ,MAAM,CAAC,IAAI,CACT,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YAC5C,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnE,CAAC;IAEF,OAAO;QACL,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,aAAa;QACb,YAAY;QACZ,KAAK;QACL,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,SAAS,OAAO,CAAC,GAAqB,EAAE,KAAc;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO,KAAK,MAAM,GAAG,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAChB,KAAa,EACb,IAAkD;IAElD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG;QACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAMlB;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,GAAG;QACvD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxB,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CACjB,OAME;IAEF,OAAO;QACL,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,GAAG;QACrC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,OAAO;QACL;YACE,IAAI,EACF,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CACrC,MAAyB;IAEzB,OAAO;QACL;YACE,IAAI,EACF,QAAQ,MAAM,CAAC,IAAI,IAAI;gBACvB,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;gBAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"workflow-usage.js","sourceRoot":"","sources":["../../../src/lib/workflow-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,2DAA2D;AAE3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GACjC,4CAA4C,yBAAyB,OAAO;IAC5E,GAAG,yBAAyB,mCAAmC;IAC/D,GAAG,yBAAyB,qCAAqC;IACjE,GAAG,6BAA6B,GAAG,CAAC;AAEtC,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAClC,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,iFAAiF,CAAC;AAuFpF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,yBAAyB,IAAI,KAAK,GAAG,yBAAyB,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,OAAO,IAAI,KAAK,aAAa,CAAC;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAQxC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAoC,EACpC,YAAoB,sBAAsB;IAE1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChC,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB;YAClB,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiC;IAC7D,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED,wEAAwE;AAExE,SAAS,YAAY,CACnB,CAAyC,EACzC,CAAyC;IAEzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAwB;IACtD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,MAAM,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACjC,aAAa,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC3C,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;YAAE,QAAQ,GAAG,KAAK,CAAC;QAEhD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI;gBACtC,SAAS,EAAE,CAAC;gBACZ,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,IAAI,GAAG,EAAU;aACxB,CAAC;YACF,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;YAClC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAoB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI;QACJ,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;QACH,qEAAqE;QACrE,4CAA4C;SAC3C,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI;QACf,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/B,CAAC;IAEJ,MAAM,CAAC,IAAI,CACT,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YAC5C,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC7C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CAAC;QACR,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnE,CAAC;IAEF,OAAO;QACL,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,aAAa;QACb,YAAY;QACZ,KAAK;QACL,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC;QAC/C,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,SAAS,OAAO,CAAC,GAAqB,EAAE,KAAc;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO,KAAK,MAAM,GAAG,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,UAAU,GAAG,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAChB,KAAa,EACb,IAAkD;IAElD,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG;QACpC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAMlB;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;QAC/B,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,GAAG;QACvD,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxB,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CACjB,OAME;IAEF,OAAO;QACL,OAAO,EAAE,WAAW,OAAO,CAAC,MAAM,GAAG;QACrC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA2B;IAC3D,OAAO;QACL;YACE,IAAI,EACF,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CACrC,MAAyB;IAEzB,OAAO;QACL;YACE,IAAI,EACF,QAAQ,MAAM,CAAC,IAAI,IAAI;gBACvB,aAAa,MAAM,CAAC,aAAa,IAAI;gBACrC,kBAAkB,MAAM,CAAC,YAAY,IAAI;gBACzC,UAAU,MAAM,CAAC,UAAU,OAAO;SACrC;QACD;YACE,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC/B,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;gBAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;SACH;QACD,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,YAAY,CAAC;QACzD,SAAS,CAAC,oCAAoC,EAAE,MAAM,CAAC,aAAa,CAAC;QACrE,SAAS,CAAC,4CAA4C,EAAE,MAAM,CAAC,SAAS,CAAC;QACzE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primitive-admin",
-  "version": "1.1.0-alpha.86",
+  "version": "1.1.0-alpha.87",
   "description": "CLI for administering Primitive applications",
   "type": "module",
   "bin": {
@@ -60,7 +60,7 @@
     "commander": "^12.1.0",
     "esbuild": "0.25.12",
     "inquirer": "^9.2.12",
-    "js-bao": "0.7.0-alpha.9",
+    "js-bao": "0.7.0-alpha.10",
     "mime-types": "^2.1.35",
     "open": "^10.0.3",
     "smol-toml": "1.7.0",