@desplega.ai/agent-swarm 1.113.0 → 1.115.0

package/dist/rbac-roles-mwcwhbxc.js

@@ -0,0 +1,283 @@
+import {
+  PermissionVerbSchema
+} from "./cli-86fdnerz.js";
+import {
+  getDb,
+  init_db
+} from "./cli-15y7qhzp.js";
+import"./cli-z2zcxes1.js";
+import"./cli-bw80ck94.js";
+import"./cli-xz9aq0rf.js";
+import"./cli-b23axgz4.js";
+import"./cli-4j2mrzag.js";
+import"./cli-p9swy5t3.js";
+
+// src/be/rbac-roles.ts
+init_db();
+var DEFAULT_ROLE_ID = "rbac-role-admin";
+var BUILTIN_ROLES = [
+  {
+    id: DEFAULT_ROLE_ID,
+    name: "admin",
+    description: "Full access including verb-less routes (legacy-equivalent default).",
+    isBuiltin: true,
+    grantsAll: true,
+    verbs: []
+  },
+  {
+    id: "rbac-role-requester",
+    name: "requester",
+    description: "Own-task lifecycle: what legacy policy grants user principals.",
+    isBuiltin: true,
+    grantsAll: false,
+    verbs: [
+      "task.create.own",
+      "task.read.own",
+      "task.cancel.own",
+      "task.action.own",
+      "task.fs.mutate",
+      "favorite.write.own"
+    ]
+  }
+];
+var CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
+CREATE TRIGGER IF NOT EXISTS trg_users_default_role
+AFTER INSERT ON users
+BEGIN
+  INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+  SELECT 'user', NEW.id, 'rbac-role-admin'
+  WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
+END;
+`;
+function roleRowToUserRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    isBuiltin: row.isBuiltin === 1,
+    grantsAll: row.grantsAll === 1,
+    createdAt: row.createdAt
+  };
+}
+function requireRoleId(roleName) {
+  const row = getDb().prepare("SELECT id FROM roles WHERE name = ?").get(roleName);
+  if (!row) {
+    throw new Error(`Unknown RBAC role: ${roleName}`);
+  }
+  return row.id;
+}
+function validateBuiltinVerb(roleName, verb) {
+  const parsed = PermissionVerbSchema.safeParse(verb);
+  if (!parsed.success) {
+    throw new Error(`Invalid RBAC permission verb "${verb}" in built-in role "${roleName}"`);
+  }
+  return parsed.data;
+}
+function validatedBuiltinVerbSets() {
+  const byRoleId = new Map;
+  for (const role of BUILTIN_ROLES) {
+    const verbs = new Set;
+    for (const verb of role.verbs) {
+      verbs.add(validateBuiltinVerb(role.name, verb));
+    }
+    byRoleId.set(role.id, verbs);
+  }
+  return byRoleId;
+}
+var loggedInvalidGrantVerbs = new Set;
+function parseDatabaseGrantVerb(roleId, verb) {
+  const parsed = PermissionVerbSchema.safeParse(verb);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  const logKey = `${roleId}:${verb}`;
+  if (!loggedInvalidGrantVerbs.has(logKey)) {
+    loggedInvalidGrantVerbs.add(logKey);
+    console.error(`[rbac] Ignoring invalid role_permissions verb "${verb}" for roleId="${roleId}". ` + "Invalid RBAC verbs grant nothing; remove or repair the row.");
+  }
+  return null;
+}
+function getUserGrant(userId) {
+  const rows = getDb().prepare(`SELECT r.id AS roleId, r.grantsAll, rp.verb
+       FROM principal_roles pr
+       JOIN roles r ON r.id = pr.roleId
+       LEFT JOIN role_permissions rp ON rp.roleId = r.id
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.grantsAll DESC`).all(userId);
+  if (rows.length === 0) {
+    return { grantsAll: false, verbs: new Set };
+  }
+  const verbs = new Set;
+  for (const row of rows) {
+    if (row.grantsAll === 1) {
+      return { grantsAll: true, verbs: new Set };
+    }
+    if (row.verb) {
+      const verb = parseDatabaseGrantVerb(row.roleId, row.verb);
+      if (verb) {
+        verbs.add(verb);
+      }
+    }
+  }
+  return { grantsAll: false, verbs };
+}
+function attachRole(userId, roleName) {
+  const db = getDb();
+  db.transaction(() => {
+    const roleId = requireRoleId(roleName);
+    db.prepare(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+       VALUES ('user', ?, ?)`).run(userId, roleId);
+  })();
+}
+function detachRole(userId, roleName) {
+  const db = getDb();
+  db.transaction(() => {
+    const roleId = requireRoleId(roleName);
+    db.prepare(`DELETE FROM principal_roles
+       WHERE principalType = 'user' AND principalId = ? AND roleId = ?`).run(userId, roleId);
+  })();
+}
+function listUserRoles(userId) {
+  return getDb().prepare(`SELECT r.id, r.name, r.description, r.isBuiltin, r.grantsAll, r.createdAt
+       FROM principal_roles pr
+       JOIN roles r ON r.id = pr.roleId
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.name`).all(userId).map(roleRowToUserRole);
+}
+function ensureRbacSeedsSynced(opts) {
+  const db = getDb();
+  const desiredVerbsByRoleId = validatedBuiltinVerbSets();
+  const insertRole = db.prepare(`INSERT OR IGNORE INTO roles (id, name, description, isBuiltin, grantsAll)
+     VALUES (?, ?, ?, 1, ?)`);
+  const updateRole = db.prepare(`UPDATE roles
+     SET name = ?, description = ?, isBuiltin = 1, grantsAll = ?, lastUpdatedAt = CURRENT_TIMESTAMP
+     WHERE id = ?
+       AND (
+         name <> ?
+         OR COALESCE(description, '') <> COALESCE(?, '')
+         OR isBuiltin <> 1
+         OR grantsAll <> ?
+       )`);
+  const selectRoleById = db.prepare("SELECT id, name FROM roles WHERE id = ?");
+  const selectRoleByName = db.prepare("SELECT id, name FROM roles WHERE name = ?");
+  const selectRolePermissions = db.prepare("SELECT verb FROM role_permissions WHERE roleId = ?");
+  const deleteRolePermission = db.prepare("DELETE FROM role_permissions WHERE roleId = ? AND verb = ?");
+  const insertRolePermission = db.prepare("INSERT OR IGNORE INTO role_permissions (roleId, verb) VALUES (?, ?)");
+  const backfillDefaultRoleForZeroRoleUsers = db.prepare(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId)
+     SELECT 'user', u.id, ?
+     FROM users u
+     WHERE NOT EXISTS (
+       SELECT 1
+       FROM principal_roles pr
+       WHERE pr.principalType = 'user'
+         AND pr.principalId = u.id
+     )`);
+  const stats = {
+    rolesInserted: 0,
+    rolesUpdated: 0,
+    permissionsInserted: 0,
+    permissionsDeleted: 0,
+    usersBackfilled: 0
+  };
+  db.transaction(() => {
+    for (const role of BUILTIN_ROLES) {
+      const grantsAll = role.grantsAll ? 1 : 0;
+      const insertResult = insertRole.run(role.id, role.name, role.description, grantsAll);
+      stats.rolesInserted += insertResult.changes;
+      if (insertResult.changes === 0) {
+        const updateResult = updateRole.run(role.name, role.description, grantsAll, role.id, role.name, role.description, grantsAll);
+        stats.rolesUpdated += updateResult.changes;
+      }
+    }
+    for (const role of BUILTIN_ROLES) {
+      const row = selectRoleById.get(role.id);
+      if (row) {
+        continue;
+      }
+      const colliding = selectRoleByName.get(role.name);
+      if (colliding) {
+        throw new Error(`RBAC built-in role "${role.name}" (${role.id}) is missing because role ` + `"${colliding.name}" (${colliding.id}) already uses that name. ` + "Rename or remove the conflicting role, then rerun `rbac bootstrap`.");
+      }
+      throw new Error(`RBAC built-in role "${role.name}" (${role.id}) is missing after seed sync. ` + "Rerun `rbac bootstrap`; if it still fails, inspect the roles table.");
+    }
+    for (const role of BUILTIN_ROLES) {
+      const desiredVerbs = desiredVerbsByRoleId.get(role.id) ?? new Set;
+      const existingRows = selectRolePermissions.all(role.id);
+      for (const row of existingRows) {
+        if (!desiredVerbs.has(row.verb)) {
+          stats.permissionsDeleted += deleteRolePermission.run(role.id, row.verb).changes;
+        }
+      }
+      for (const verb of desiredVerbs) {
+        stats.permissionsInserted += insertRolePermission.run(role.id, verb).changes;
+      }
+    }
+    db.run(CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL);
+    stats.usersBackfilled += backfillDefaultRoleForZeroRoleUsers.run(DEFAULT_ROLE_ID).changes;
+  })();
+  if (!opts?.quiet) {
+    console.log(`[rbac] seed sync: roles inserted=${stats.rolesInserted}, updated=${stats.rolesUpdated}; permissions inserted=${stats.permissionsInserted}, deleted=${stats.permissionsDeleted}; trigger=ensured; users backfilled=${stats.usersBackfilled}`);
+  }
+  return stats;
+}
+function describeRbacFlag() {
+  const raw = process.env.RBAC_ENABLED;
+  if (raw === undefined)
+    return "unset (off)";
+  return `${raw} (${raw === "true" ? "on" : "off"})`;
+}
+function printRolesTable(rows) {
+  const tableRows = rows.map((row) => [
+    row.name,
+    row.isBuiltin === 1 ? "yes" : "no",
+    row.grantsAll === 1 ? "yes" : "no",
+    String(row.verbCount),
+    String(row.attachedUserCount)
+  ]);
+  const headers = ["name", "builtin", "grantsAll", "verbs", "attachedUsers"];
+  const widths = headers.map((header, column) => Math.max(header.length, ...tableRows.map((row) => row[column]?.length ?? 0)));
+  const format = (row) => row.map((cell, column) => cell.padEnd(widths[column] ?? cell.length)).join("  ");
+  console.log("Roles:");
+  console.log(format(headers));
+  console.log(format(widths.map((width) => "-".repeat(width))));
+  for (const row of tableRows) {
+    console.log(format(row));
+  }
+}
+function getRbacRoleSummary() {
+  return getDb().prepare(`SELECT
+         r.name,
+         r.isBuiltin,
+         r.grantsAll,
+         COUNT(DISTINCT rp.verb) AS verbCount,
+         COUNT(DISTINCT CASE WHEN pr.principalType = 'user' THEN pr.principalId END)
+           AS attachedUserCount
+       FROM roles r
+       LEFT JOIN role_permissions rp ON rp.roleId = r.id
+       LEFT JOIN principal_roles pr ON pr.roleId = r.id
+       GROUP BY r.id, r.name, r.isBuiltin, r.grantsAll
+       ORDER BY r.isBuiltin DESC, r.name`).all();
+}
+async function runRbacCliCommand(args) {
+  const subcommand = args[0];
+  if (args.length !== 1 || subcommand !== "bootstrap") {
+    throw new Error(`Unknown RBAC command: ${args.join(" ") || "(none)"}`);
+  }
+  const stats = ensureRbacSeedsSynced({ quiet: true });
+  const roles = getRbacRoleSummary();
+  console.log("RBAC bootstrap complete");
+  console.log(`RBAC_ENABLED: ${describeRbacFlag()}`);
+  console.log(`Users backfilled this run: ${stats.usersBackfilled}`);
+  console.log("");
+  printRolesTable(roles);
+}
+export {
+  runRbacCliCommand,
+  listUserRoles,
+  getUserGrant,
+  ensureRbacSeedsSynced,
+  detachRole,
+  attachRole,
+  DEFAULT_ROLE_ID,
+  BUILTIN_ROLES
+};

package/dist/{seed-pricing-1r1y1xkq.js → seed-pricing-h2kdq4cq.js}

@@ -1,12 +1,12 @@
 import {
   buildModelsDevSeedRows,
   seedPricingFromModelsDev
-} from "./cli-tbw13sx8.js";
-import"./cli-ncfgsqbd.js";
+} from "./cli-tece6zgm.js";
+import"./cli-15y7qhzp.js";
 import"./cli-z2zcxes1.js";
-import"./cli-q21d49ac.js";
-import"./cli-anrj584m.js";
-import"./cli-c3frqf65.js";
+import"./cli-bw80ck94.js";
+import"./cli-xz9aq0rf.js";
+import"./cli-b23axgz4.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/{setup-mkcgkjf7.js → setup-8506q97w.js}

@@ -4,14 +4,14 @@ import {
   createDefaultMcpJson,
   createDefaultSettingsLocal,
   createHooksConfig
-} from "./cli-y6mrptcn.js";
+} from "./cli-cnwssmsr.js";
 import {
   require_jsx_dev_runtime
 } from "./cli-wx82tw1k.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
-import"./cli-c3frqf65.js";
+import"./cli-b23axgz4.js";
 import {
   Box_default,
   Spinner,

package/dist/{worker-351sze63.js → worker-4r5c6zyb.js}

@@ -1,63 +1,67 @@
 import {
   runAgent
-} from "./cli-mq580e06.js";
-import"./cli-ceewqajw.js";
-import"./cli-6wscj9z0.js";
-import"./cli-2r7s8jhp.js";
-import"./cli-07er7wrs.js";
-import"./cli-yv9dttkh.js";
+} from "./cli-zsrdty74.js";
 import"./cli-tyfxrrdd.js";
-import"./cli-a0t7vapf.js";
+import"./cli-bc89my0z.js";
 import"./cli-yazx6hap.js";
+import"./cli-wh91zby6.js";
 import"./cli-r94z9p1z.js";
-import"./cli-d6n0thxw.js";
+import"./cli-e7306swv.js";
 import"./cli-hx1dcevq.js";
+import"./cli-sznberje.js";
+import"./cli-07er7wrs.js";
+import"./cli-d6n0thxw.js";
+import"./cli-yv9dttkh.js";
 import {
   getEnabledCapabilities
-} from "./cli-4xyj9jtq.js";
+} from "./cli-hrhye2rm.js";
 import"./cli-1z7048dy.js";
-import"./cli-dcfyyh3t.js";
+import"./cli-ftyf58xj.js";
 import"./cli-tk9vyqzh.js";
 import"./cli-gz9sbyk3.js";
-import"./cli-2fc97xm5.js";
-import"./cli-psrqtw2m.js";
+import"./cli-mnbgv3w7.js";
 import"./cli-tng3131n.js";
+import"./cli-psrqtw2m.js";
 import"./cli-zm7njwzd.js";
 import"./cli-tghre7g6.js";
-import"./cli-tkmm5nf9.js";
-import"./cli-bgef578c.js";
-import"./cli-36ymmpmp.js";
-import"./cli-tbw13sx8.js";
-import"./cli-r5g6ngtn.js";
+import"./cli-e61fs2hp.js";
+import"./cli-3samkyap.js";
+import"./cli-tece6zgm.js";
+import"./cli-52fg7s7x.js";
+import"./cli-86fdnerz.js";
+import"./cli-dcca6j8m.js";
 import"./cli-fad8m16k.js";
-import"./cli-gtkqc144.js";
-import"./cli-z46pnksz.js";
+import"./cli-shvaxw27.js";
+import"./cli-q1rx7g0d.js";
 import"./cli-f14fvzag.js";
-import"./cli-qwgtacd6.js";
-import"./cli-30bbaveh.js";
-import"./cli-f3qa069v.js";
+import"./cli-r9f6ngrf.js";
+import"./cli-jkhwmmgg.js";
+import"./cli-cmw9rzy5.js";
+import"./cli-7xje5amz.js";
 import"./cli-q25ejbyn.js";
-import"./cli-bgvskydy.js";
-import"./cli-trmapn9k.js";
+import"./cli-t0vqevnm.js";
+import"./cli-0pygq9r1.js";
+import"./cli-tffvrh6j.js";
+import"./cli-pet3aev6.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
-import"./cli-h3k622d0.js";
-import"./cli-6xd0bvf8.js";
+import"./cli-6aq8xhvm.js";
+import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
-import"./cli-y4ycrnjc.js";
+import"./cli-k3y4z3h5.js";
 import"./cli-dh55d5fg.js";
-import"./cli-ncfgsqbd.js";
+import"./cli-15y7qhzp.js";
 import"./cli-z2zcxes1.js";
-import"./cli-q21d49ac.js";
-import"./cli-anrj584m.js";
-import"./cli-c3frqf65.js";
+import"./cli-bw80ck94.js";
+import"./cli-xz9aq0rf.js";
+import"./cli-b23axgz4.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-9aryf9tv.js";
 import"./cli-7zd05xb4.js";
 import"./cli-xw7p4wkq.js";
-import"./cli-4wgngmwv.js";
 import"./cli-zyxs93y9.js";
+import"./cli-4wgngmwv.js";
 import"./cli-m6pzzhqr.js";
 import"./cli-7wmybrt5.js";
 import"./cli-p9swy5t3.js";