@desplega.ai/agent-swarm 2.5.1 → 2.5.3

package/dist/{cli-y3zyaee5.js → cli-1fc85mvt.js}

@@ -9,21 +9,21 @@ import {
   init_active_sessions,
   getSteeringMessageById2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-z2dv25mf.js";
+} from "./cli-99xgw26r.js";
 import {
   findUserById,
   findUserByExternalId,
   init_users
-} from "./cli-gwcf52gz.js";
+} from "./cli-e8jyq7d8.js";
 import {
   isRbacEnabled,
   can,
   init_rbac
-} from "./cli-ba8ne1es.js";
+} from "./cli-4rvr7zfx.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -503,7 +503,7 @@ function route(def) {
       try {
         const rawBody = def.body ? await parseBody(req, def.maxBodyBytes) : undefined;
         if (def.session && "bodyTaskIds" in def.session) {
-          const { bodySessionDenial } = await import("./session-access-jzx2z9h5.js");
+          const { bodySessionDenial } = await import("./session-access-7f21ekq9.js");
           const denial = await bodySessionDenial(req, def.session.bodyTaskIds(rawBody));
           if (denial) {
             jsonError(res, denial, 403);

package/dist/{cli-v2g93k4v.js → cli-210xd1f4.js}

@@ -7,20 +7,20 @@ import {
   tierConfigKey,
   init_model_tier_keys,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
 import {
   ensureRbacSeedsSynced2,
   init_rbac_roles
-} from "./cli-z2dv25mf.js";
+} from "./cli-99xgw26r.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-9mm5ade4.js";
+} from "./cli-fsdprwrg.js";
 import {
   MODEL_TIERS,
   DEFAULT_MODEL_TIER_MAP,
   ProviderNameSchema,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mz9afxxf.js";
 
 // src/be/boot-seeds.ts
 init_db3();

package/dist/{cli-sn1vbtg2.js → cli-25j01dpj.js}

@@ -2,17 +2,17 @@ import {
   getKv2,
   upsertKv2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
 import {
   resolveIdentity,
   recordUnmappedIdentity
-} from "./cli-kcsd1ez8.js";
+} from "./cli-aecdcr77.js";
 import {
   findUserByExternalId,
   findOrCreateUserByEmail,
   linkIdentity,
   init_users
-} from "./cli-gwcf52gz.js";
+} from "./cli-e8jyq7d8.js";
 
 // src/slack/enrich.ts
 init_db3();

package/dist/{cli-n6kmqngw.js → cli-35gtk1p6.js}

@@ -1,6 +1,6 @@
 import {
   Anthropic
-} from "./cli-3qv8naq8.js";
+} from "./cli-p6zs9h4y.js";
 import {
   checkToolLoop
 } from "./cli-0726awxw.js";

package/dist/{cli-r9fy0ddc.js → cli-3ngdk5te.js}

@@ -6,7 +6,7 @@ import {
   getResolvedConfig2,
   getAllUsers2,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{cli-z63a269p.js → cli-40jsnrjm.js}

@@ -21,7 +21,7 @@ import {
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mz9afxxf.js";
 import {
   getOpenRouterBaseUrl,
   getOpenRouterAttributionHeaders,
@@ -66,7 +66,7 @@ function addDshStepUsage(acc, step) {
 // src/providers/dsh-adapter.ts
 init_openrouter_base_url();
 init_secret_scrubber();
-var DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.2";
+var DSH_PACKAGE = "@deepseek-ai/dsh@0.2.1-rc.3";
 function checkDshCredentials2(env) {
   return env.DEEPSEEK_API_KEY?.trim() || env.OPENROUTER_API_KEY?.trim() ? { ready: true, missing: [], satisfiedBy: "env" } : {
     ready: false,

package/dist/{cli-ba8ne1es.js → cli-4rvr7zfx.js}

@@ -317,10 +317,12 @@ var init_legacy_policy = __esm(() => {
     "script.api.update": leadOnly,
     "script.api.rotate": leadOnly,
     "script.api.delete": leadOnly,
+    "schedule.deferral.update.any": leadOrResourceOwner,
     "runtime_pool.write": operatorOrUser,
     "runtime_pool.bind": leadOrOperatorOrUser,
     "runtime_controller.write": operatorOrUser,
     "agent.token.manage": operatorOrUser,
+    "user.role.manage": operatorOrUser,
     "extension.write": extensionWrite,
     "extension.activate": extensionActivation,
     "extension.install.inline": leadOrOperatorOrUser
@@ -374,6 +376,10 @@ var init_permissions = __esm(() => {
       description: "Mint, rotate, or revoke an agent-bound worker token.",
       namespace: "agent"
     },
+    "user.role.manage": {
+      description: "Assign or remove a person's RBAC roles.",
+      namespace: "user"
+    },
     "task.cancel.any": {
       description: "Cancel any task (beyond tasks the caller created).",
       namespace: "task"
@@ -678,6 +684,10 @@ var init_permissions = __esm(() => {
       description: "Delete an external script API endpoint.",
       namespace: "script"
     },
+    "schedule.deferral.update.any": {
+      description: "Change a defer-task schedule the caller did not create.",
+      namespace: "schedule"
+    },
     "runtime_pool.write": {
       description: "Create, update, or delete runtime pools (image, provider kind, placement).",
       namespace: "runtime_pool"

package/dist/{cli-qfm6my86.js → cli-502eqv93.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-22rmcjkg.js";
+} from "./cli-y561h5a9.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-xd4eqtr2.js → cli-6n8axjv1.js}

@@ -1,7 +1,7 @@
 import {
   RuntimeProviderKindSchema,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mz9afxxf.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";

package/dist/{cli-hadv0725.js → cli-8s5wx3nz.js}

@@ -18,7 +18,7 @@ import {
 import {
   applyOpenRouterBaseUrlOverride2,
   buildOpenAICompatibleProviderBlock2
-} from "./cli-stxdrqs2.js";
+} from "./cli-avdvgcay.js";
 import {
   fetchInstalledMcpServers
 } from "./cli-bst1vp7e.js";
@@ -43,7 +43,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-22rmcjkg.js";
+} from "./cli-y561h5a9.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{cli-z2dv25mf.js → cli-99xgw26r.js}

@@ -1,12 +1,14 @@
 import {
   getDb2,
   getDbClient2,
+  invalidateTelemetryUserRole,
+  init_telemetry_identity,
   init_db3
-} from "./cli-q9pzwxvk.js";
+} from "./cli-kxawjrxg.js";
 import {
   PermissionVerbSchema,
   init_rbac
-} from "./cli-ba8ne1es.js";
+} from "./cli-4rvr7zfx.js";
 import {
   init_env_flag
 } from "./cli-cebvbc9t.js";
@@ -15,6 +17,16 @@ import {
 } from "./cli-242037k3.js";
 
 // src/be/rbac-roles.ts
+function roleRowToUserRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    isBuiltin: row.isBuiltin === 1,
+    grantsAll: row.grantsAll === 1,
+    createdAt: row.createdAt
+  };
+}
 function validateBuiltinVerb(roleName, verb) {
   const parsed = PermissionVerbSchema.safeParse(verb);
   if (!parsed.success) {
@@ -69,6 +81,88 @@ async function getUserGrant2(userId) {
   }
   return { grantsAll: false, verbs };
 }
+async function listUserRoles2(userId) {
+  const rows = await getDbClient2().query(`SELECT r.id, r.name, r.description, r.isBuiltin, r.grantsAll, r.createdAt
+     FROM principal_roles pr
+     JOIN roles r ON r.id = pr.roleId
+     WHERE pr.principalType = 'user' AND pr.principalId = ?
+     ORDER BY r.name`, [userId]);
+  return rows.map(roleRowToUserRole);
+}
+async function listRbacRoles2() {
+  const client = getDbClient2();
+  const roles = await client.query("SELECT id, name, description, isBuiltin, grantsAll, createdAt FROM roles ORDER BY name");
+  const perms = await client.query("SELECT roleId, verb FROM role_permissions ORDER BY verb");
+  return roles.map((row) => ({
+    ...roleRowToUserRole(row),
+    primary: PRIMARY_ROLE_NAMES2.includes(row.name),
+    verbs: perms.filter((p) => p.roleId === row.id).map((p) => p.verb)
+  }));
+}
+async function assertNotLastAdmin2(userId) {
+  const client = getDbClient2();
+  const self = await client.get(`SELECT COUNT(*) AS n
+     FROM users u
+     JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+     JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+     WHERE u.status = 'active' AND u.id = ?`, [userId]);
+  if ((self?.n ?? 0) === 0)
+    return;
+  const others = await client.get(`SELECT COUNT(DISTINCT u.id) AS n
+     FROM users u
+     JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+     JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+     WHERE u.status = 'active' AND u.id <> ?`, [userId]);
+  if ((others?.n ?? 0) === 0)
+    throw new LastAdminError2;
+}
+async function setUserRoles2(userId, roleNames, actorUserId) {
+  const names = [...new Set(roleNames)];
+  if (names.filter((name) => PRIMARY_ROLE_NAMES2.includes(name)).length !== 1) {
+    throw new InvalidRoleSetError2(`Pick exactly one primary role: ${PRIMARY_ROLE_NAMES2.join(", ")}`);
+  }
+  return getDbClient2().transaction(async (tx) => {
+    const wanted = [];
+    for (const name of names) {
+      const row = await tx.get("SELECT id, name, grantsAll FROM roles WHERE name = ?", [name]);
+      if (!row)
+        throw new InvalidRoleSetError2(`Unknown role: ${name}`);
+      wanted.push(row);
+    }
+    const current = await tx.query(`SELECT r.id, r.name, r.grantsAll
+       FROM principal_roles pr JOIN roles r ON r.id = pr.roleId
+       WHERE pr.principalType = 'user' AND pr.principalId = ?
+       ORDER BY r.name`, [userId]);
+    const wantsAll = wanted.some((r) => r.grantsAll === 1);
+    if (current.some((r) => r.grantsAll === 1) && !wantsAll) {
+      const user = await tx.get("SELECT status FROM users WHERE id = ?", [
+        userId
+      ]);
+      if (user?.status === "active") {
+        const others = await tx.get(`SELECT COUNT(DISTINCT u.id) AS n
+           FROM users u
+           JOIN principal_roles pr ON pr.principalType = 'user' AND pr.principalId = u.id
+           JOIN roles r ON r.id = pr.roleId AND r.grantsAll = 1
+           WHERE u.status = 'active' AND u.id <> ?`, [userId]);
+        if ((others?.n ?? 0) === 0)
+          throw new LastAdminError2;
+      }
+    }
+    const wantedIds = new Set(wanted.map((r) => r.id));
+    for (const row of current) {
+      if (!wantedIds.has(row.id)) {
+        await tx.run(`DELETE FROM principal_roles
+           WHERE principalType = 'user' AND principalId = ? AND roleId = ?`, [userId, row.id]);
+      }
+    }
+    for (const row of wanted) {
+      await tx.run(`INSERT OR IGNORE INTO principal_roles (principalType, principalId, roleId, created_by)
+         VALUES ('user', ?, ?, ?)`, [userId, row.id, actorUserId]);
+    }
+    getDbClient2().afterCommit(() => invalidateTelemetryUserRole(userId));
+    return { before: current.map((r) => r.name), after: wanted.map((r) => r.name).sort() };
+  });
+}
 function ensureRbacSeedsSynced2(opts) {
   const db = getDb2();
   const desiredVerbsByRoleId = validatedBuiltinVerbSets();
@@ -145,7 +239,7 @@ function ensureRbacSeedsSynced2(opts) {
   }
   return stats;
 }
-var DEFAULT_ROLE_ID = "rbac-role-admin", BUILTIN_ROLES, CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
+var DEFAULT_ROLE_ID = "rbac-role-admin", BUILTIN_ROLES, PRIMARY_ROLE_NAMES2, CREATE_USER_DEFAULT_ROLE_TRIGGER_SQL = `
 CREATE TRIGGER IF NOT EXISTS trg_users_default_role
 AFTER INSERT ON users
 BEGIN
@@ -153,9 +247,10 @@ BEGIN
   SELECT 'user', NEW.id, 'rbac-role-admin'
   WHERE EXISTS (SELECT 1 FROM roles WHERE id = 'rbac-role-admin');
 END;
-`, loggedInvalidGrantVerbs;
+`, loggedInvalidGrantVerbs, InvalidRoleSetError2, LastAdminError2;
 var init_rbac_roles = __esm(() => {
   init_rbac();
+  init_telemetry_identity();
   init_env_flag();
   init_db3();
   BUILTIN_ROLES = [
@@ -183,9 +278,25 @@ var init_rbac_roles = __esm(() => {
         "session.share",
         "session.presence"
       ]
+    },
+    {
+      id: "rbac-role-viewer",
+      name: "viewer",
+      description: "Read-only: no task, approval or script writes.",
+      isBuiltin: true,
+      grantsAll: false,
+      verbs: ["favorite.write.own", "session.presence"]
     }
   ];
+  PRIMARY_ROLE_NAMES2 = ["admin", "requester", "viewer"];
   loggedInvalidGrantVerbs = new Set;
+  InvalidRoleSetError2 = class InvalidRoleSetError2 extends Error {
+  };
+  LastAdminError2 = class LastAdminError2 extends Error {
+    constructor() {
+      super("last_admin");
+    }
+  };
 });
 
-export { getUserGrant2, ensureRbacSeedsSynced2, init_rbac_roles };
+export { PRIMARY_ROLE_NAMES2, getUserGrant2, listUserRoles2, listRbacRoles2, InvalidRoleSetError2, LastAdminError2, assertNotLastAdmin2, setUserRoles2, ensureRbacSeedsSynced2, init_rbac_roles };

package/dist/{cli-jpxsrxcb.js → cli-9s05422w.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-rh5smt8t.js";
+} from "./cli-mz9afxxf.js";
 
 // src/utils/amp-models.ts
 init_types();