@elevasis/sdk 1.35.0 → 1.36.0

package/dist/cli.cjs

@@ -24975,6 +24975,8 @@ function ora(options) {
 var import_path2 = require("path");
 var import_promises = require("fs/promises");
 var import_fs2 = require("fs");
+var import_crypto = require("crypto");
+var import_url = require("url");
 init_source();
 
 // ../../node_modules/.pnpm/zod@4.1.12/node_modules/zod/v4/classic/external.js
@@ -45805,7 +45807,7 @@ function wrapAction(commandName, fn) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "1.35.0",
+  version: "1.36.0",
   description: "SDK for building Elevasis organization resources",
   type: "module",
   bin: {
@@ -45883,8 +45885,8 @@ var package_default = {
 var SDK_VERSION = package_default.version;
 
 // src/cli/commands/deploy.ts
-function getEsbuild() {
-  const consumerRequire = (0, import_module.createRequire)(resolvePackageRelative("package.json"));
+function getEsbuild(packageRoot = getPackageRoot()) {
+  const consumerRequire = (0, import_module.createRequire)((0, import_path2.resolve)(packageRoot, "package.json"));
   return consumerRequire("esbuild");
 }
 function resolveBareSpecifier(specifier, importer) {
@@ -45951,10 +45953,11 @@ function createBundleWorkspaceTsPlugin() {
     }
   };
 }
-async function loadTsModule(filePath) {
-  const esbuild = getEsbuild();
-  const absPath = resolvePackageRelative(filePath);
-  const tmpOut = (0, import_path2.resolve)(getPackageRoot(), `.elevasis-tmp-${Date.now()}.mjs`);
+async function loadTsModule(filePath, options = {}) {
+  const packageRoot = options.packageRoot ?? getPackageRoot();
+  const esbuild = getEsbuild(packageRoot);
+  const absPath = (0, import_path2.isAbsolute)(filePath) ? filePath : (0, import_path2.resolve)(packageRoot, filePath);
+  const tmpOut = (0, import_path2.resolve)(packageRoot, `.elevasis-tmp-${process.pid}-${Date.now()}-${(0, import_crypto.randomUUID)()}.mjs`);
   try {
     await esbuild.build({
       entryPoints: [absPath],
@@ -45967,8 +45970,7 @@ async function loadTsModule(filePath) {
       plugins: [createBundleWorkspaceTsPlugin()],
       logLevel: "silent"
     });
-    const fileUrl = `file:///${tmpOut.replace(/\\/g, "/")}`;
-    return await import(fileUrl);
+    return await import((0, import_url.pathToFileURL)(tmpOut).href);
   } finally {
     try {
       const { unlinkSync: unlinkSync3 } = await import("fs");
@@ -49813,13 +49815,13 @@ init_config();
 var import_path3 = require("path");
 var import_fs3 = require("fs");
 var ORG_MODEL_REL_PATH = "core/config/organization-model.ts";
-async function loadOrgModel(projectRoot) {
+async function loadOrgModel(projectRoot, options = {}) {
   const orgModelPath = (0, import_path3.resolve)(projectRoot, ORG_MODEL_REL_PATH);
   if (!(0, import_fs3.existsSync)(orgModelPath)) {
     return DEFAULT_ORGANIZATION_MODEL;
   }
   try {
-    const mod = await loadTsModule(orgModelPath);
+    const mod = await loadTsModule(orgModelPath, { packageRoot: options.packageRoot });
     const model = mod["organizationModel"] ?? mod["canonicalOrganizationModel"] ?? mod["default"];
     if (model && typeof model === "object" && "systems" in model) {
       return model;
@@ -52196,6 +52198,166 @@ function registerSessionCommands(program3) {
   registerSessionEnd(program3);
 }
 
+// src/cli/commands/grant/grant.ts
+init_source();
+init_config();
+function printJson8(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function appendQuery7(params, key, value) {
+  if (value === void 0 || value === null || value === "" || value === false) return;
+  params.set(key, String(value));
+}
+function endpointWithQuery7(endpoint, params) {
+  const query = params.toString();
+  return query ? `${endpoint}?${query}` : endpoint;
+}
+function parseJson2(value, label) {
+  if (value === void 0) return void 0;
+  try {
+    return JSON.parse(value);
+  } catch (error46) {
+    const message = error46 instanceof Error ? error46.message : String(error46);
+    throw new Error(`Invalid JSON for ${label}: ${message}`);
+  }
+}
+function parsePositiveInt(value, label) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return parsed;
+}
+function parseOrigins(value) {
+  if (value === void 0) return void 0;
+  const origins = value.split(",").map((origin) => origin.trim()).filter(Boolean);
+  return origins.length > 0 ? origins : void 0;
+}
+function deriveSlugFromResourceId(resourceId) {
+  const slug = resourceId.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!slug) {
+    throw new Error("--resource must contain at least one alphanumeric character when --slug is omitted");
+  }
+  return slug;
+}
+function getPublicPath(slug) {
+  return `/public/agents/${encodeURIComponent(slug)}`;
+}
+function resolvePublicUrl(slug, publicBaseUrl) {
+  const path3 = getPublicPath(slug);
+  const baseUrl = publicBaseUrl ?? process.env.ELEVASIS_PUBLIC_BASE_URL ?? process.env.ELEVASIS_PUBLIC_APP_URL;
+  if (!baseUrl) return path3;
+  try {
+    return new URL(path3, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).toString();
+  } catch {
+    throw new Error("--public-base-url must be a valid URL");
+  }
+}
+function printGrant(grant) {
+  const status = grant.isDisabled ? "disabled" : "active";
+  console.log(source_default.white(`  ${source_default.bold(grant.slug)}  ${source_default.gray(status)}`));
+  console.log(source_default.gray(`    Agent:    ${grant.resourceId}`));
+  console.log(source_default.gray(`    Mode:     ${grant.mode}${grant.requiresCode ? " (code required)" : ""}`));
+  console.log(source_default.gray(`    Origins:  ${grant.allowedOrigins.length > 0 ? grant.allowedOrigins.join(", ") : "any"}`));
+  console.log(source_default.gray(`    Limits:   turns=${grant.maxTurnsPerSession}, sessions/visitor=${grant.maxSessionsPerVisitor}`));
+  if (grant.expiresAt) console.log(source_default.gray(`    Expires:  ${new Date(grant.expiresAt).toLocaleString()}`));
+  if (grant.disabledAt) console.log(source_default.gray(`    Disabled: ${new Date(grant.disabledAt).toLocaleString()}`));
+}
+function registerGrantList(program3) {
+  program3.command("grant:list").description("List public/code-gated agent access grants").option("--resource-id <id>", "Filter by agent resource ID").option("--include-disabled", "Include disabled grants").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:list", async (options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const params = new URLSearchParams();
+      appendQuery7(params, "resourceId", options.resourceId);
+      appendQuery7(params, "includeDisabled", options.includeDisabled ? "true" : void 0);
+      const result = await apiGet(
+        endpointWithQuery7("/api/external/agent-access-grants", params),
+        apiUrl
+      );
+      if (options.json) {
+        printJson8(result);
+        return;
+      }
+      if (result.grants.length === 0) {
+        console.log(source_default.yellow("No agent access grants found."));
+        return;
+      }
+      console.log(source_default.cyan(`Agent access grants (${result.grants.length} of ${result.total}):`));
+      for (const grant of result.grants) {
+        printGrant(grant);
+        console.log();
+      }
+    })
+  );
+}
+function registerGrantCreate(program3) {
+  program3.command("grant:create").description("Create a public/code-gated agent access grant").requiredOption("--resource <id>", "Agent resource ID to expose").option("--slug <slug>", "Public slug; defaults to normalized --resource").option("--mode <mode>", "Access mode: public | code", "public").option("--code <code>", "Access code for --mode code").option("--origins <origins>", "Comma-separated allowed origins; omit for any origin").option("--expires-at <iso>", "ISO timestamp when the grant expires").option("--max-turns <number>", "Maximum turns per public session").option("--max-sessions <number>", "Maximum sessions per visitor").option("--branding <json>", "Branding metadata JSON object").option("--capture-fields <json>", "Capture fields JSON array").option("--tool-policy <json>", "Tool policy JSON object").option("--public-base-url <url>", "Client public app base URL for printed public URL").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:create", async (options) => {
+      const mode = options.mode ?? "public";
+      if (mode !== "public" && mode !== "code") {
+        throw new Error("--mode must be public or code");
+      }
+      if (mode === "code" && !options.code) {
+        throw new Error("--code is required when --mode code");
+      }
+      const slug = options.slug ?? deriveSlugFromResourceId(options.resource);
+      const body = {
+        resourceId: options.resource,
+        slug,
+        mode
+      };
+      if (options.code) body.code = options.code;
+      if (options.expiresAt) body.expiresAt = options.expiresAt;
+      const allowedOrigins = parseOrigins(options.origins);
+      if (allowedOrigins) body.allowedOrigins = allowedOrigins;
+      const maxTurns = parsePositiveInt(options.maxTurns, "--max-turns");
+      if (maxTurns !== void 0) body.maxTurnsPerSession = maxTurns;
+      const maxSessions = parsePositiveInt(options.maxSessions, "--max-sessions");
+      if (maxSessions !== void 0) body.maxSessionsPerVisitor = maxSessions;
+      const branding = parseJson2(options.branding, "--branding");
+      if (branding !== void 0) body.branding = branding;
+      const captureFields = parseJson2(options.captureFields, "--capture-fields");
+      if (captureFields !== void 0) body.captureFields = captureFields;
+      const toolPolicy = parseJson2(options.toolPolicy, "--tool-policy");
+      if (toolPolicy !== void 0) body.toolPolicy = toolPolicy;
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const result = await apiPost("/api/external/agent-access-grants", body, apiUrl);
+      if (options.json) {
+        printJson8(result.grant);
+        return;
+      }
+      console.log(source_default.green(`Created agent access grant ${result.grant.slug}.`));
+      console.log(source_default.gray(`  Public URL: ${resolvePublicUrl(result.grant.slug, options.publicBaseUrl)}`));
+      printGrant(result.grant);
+    })
+  );
+}
+function registerGrantDisable(program3) {
+  program3.command("grant:disable <slug>").description("Disable an agent access grant without deleting it").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:disable", async (slug, options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const result = await apiPost(
+        `/api/external/agent-access-grants/${encodeURIComponent(slug)}/disable`,
+        {},
+        apiUrl
+      );
+      if (options.json) {
+        printJson8(result.grant);
+        return;
+      }
+      console.log(source_default.green(`Disabled agent access grant ${result.grant.slug}.`));
+    })
+  );
+}
+
+// src/cli/commands/grant/index.ts
+function registerGrantCommands(program3) {
+  registerGrantList(program3);
+  registerGrantCreate(program3);
+  registerGrantDisable(program3);
+}
+
 // src/cli/commands/om/index.ts
 function registerOmScaffoldCommands(program3) {
   program3.command("om:scaffold:system").description("Guide creation of a new system entry in core/config/organization-model/systems.ts").option("--id <path>", "dot-notated system path, e.g. sales.crm (prompted if absent)").option("--title <title>", "display title (prompted if absent)").option("--kind <kind>", "system kind: operational | analytical | support (prompted if absent)").option("--api-backed", "emit apiInterface block and remind to add resource IDs").option("--dry-run", "print proposed TypeScript block without writing").action(async (opts) => {
@@ -52315,14 +52477,22 @@ var JsonFileArgError = class extends Error {
     this.name = "JsonFileArgError";
   }
 };
+function isWindowsAbsolutePath(path3) {
+  return /^[A-Za-z]:[\\/]/.test(path3) || /^[/\\]{2}[^/\\]+[/\\][^/\\]+/.test(path3);
+}
+function resolveCliPath(base, path3) {
+  if (isWindowsAbsolutePath(path3)) return import_node_path16.win32.normalize(path3);
+  if ((0, import_node_path16.isAbsolute)(path3)) return path3;
+  if (isWindowsAbsolutePath(base)) return import_node_path16.win32.resolve(base, path3);
+  return (0, import_node_path16.resolve)(base, path3);
+}
 function resolveJsonFilePath(path3, options) {
   if (path3.trim() === "") {
     throw new JsonFileArgError("@json: requires a file path", "EMPTY_JSON_FILE_REF");
   }
-  if ((0, import_node_path16.isAbsolute)(path3)) return path3;
   const cwd = options.cwd ?? process.cwd();
   const projectRoot = (options.findProjectRoot ?? tryFindProjectRoot)(cwd);
-  return (0, import_node_path16.resolve)(projectRoot ?? cwd, path3);
+  return resolveCliPath(projectRoot ?? cwd, path3);
 }
 function readJsonFileReference(ref, options) {
   const relativeOrAbsolutePath = ref.slice(JSON_FILE_PREFIX.length);
@@ -52440,6 +52610,9 @@ Commands:
   elevasis-sdk session:list                         List agent sessions
   elevasis-sdk session:get <id>                     Get session details
   elevasis-sdk session:end <id>                     End an active agent session
+  elevasis-sdk grant:list                           List public/code-gated agent access grants
+  elevasis-sdk grant:create --resource <id>       Create an agent access grant
+  elevasis-sdk grant:disable <slug>                  Disable an agent access grant
   elevasis-sdk acquisition:list:list                 List acquisition lists
   elevasis-sdk acquisition:deal:list                 List acquisition deals
   elevasis-sdk knowledge:generate                   Generate knowledge nodes from MDX files
@@ -52477,6 +52650,7 @@ registerQueueCommands(program2);
 registerScheduleCommands(program2);
 registerAgentCommands(program2);
 registerSessionCommands(program2);
+registerGrantCommands(program2);
 registerAcquisitionCommands(program2);
 registerKnowledgeCommands(program2);
 registerRequestCommands(program2);

package/dist/index.d.ts

@@ -1428,9 +1428,6 @@ type Json = string | number | boolean | null | {
     [key: string]: Json | undefined;
 } | Json[];
 type Database = {
-    __InternalSupabase: {
-        PostgrestVersion: "12.2.3 (519615d)";
-    };
     public: {
         Tables: {
             acq_artifacts: {
@@ -2630,6 +2627,74 @@ type Database = {
                     }
                 ];
             };
+            agent_access_grants: {
+                Row: {
+                    allowed_origins: string[];
+                    branding: Json;
+                    capture_fields: Json;
+                    code_hash: string | null;
+                    code_salt: string | null;
+                    created_at: string;
+                    disabled_at: string | null;
+                    expires_at: string | null;
+                    id: string;
+                    max_sessions_per_visitor: number;
+                    max_turns_per_session: number;
+                    mode: string;
+                    organization_id: string;
+                    resource_id: string;
+                    slug: string;
+                    tool_policy: Json;
+                    updated_at: string;
+                };
+                Insert: {
+                    allowed_origins?: string[];
+                    branding?: Json;
+                    capture_fields?: Json;
+                    code_hash?: string | null;
+                    code_salt?: string | null;
+                    created_at?: string;
+                    disabled_at?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    max_sessions_per_visitor?: number;
+                    max_turns_per_session?: number;
+                    mode?: string;
+                    organization_id: string;
+                    resource_id: string;
+                    slug: string;
+                    tool_policy?: Json;
+                    updated_at?: string;
+                };
+                Update: {
+                    allowed_origins?: string[];
+                    branding?: Json;
+                    capture_fields?: Json;
+                    code_hash?: string | null;
+                    code_salt?: string | null;
+                    created_at?: string;
+                    disabled_at?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    max_sessions_per_visitor?: number;
+                    max_turns_per_session?: number;
+                    mode?: string;
+                    organization_id?: string;
+                    resource_id?: string;
+                    slug?: string;
+                    tool_policy?: Json;
+                    updated_at?: string;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "agent_access_grants_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    }
+                ];
+            };
             api_keys: {
                 Row: {
                     created_at: string | null;
@@ -3537,138 +3602,6 @@ type Database = {
                 };
                 Relationships: [];
             };
-            agent_access_grants: {
-                Row: {
-                    allowed_origins: string[];
-                    branding: Json;
-                    capture_fields: Json;
-                    code_hash: string | null;
-                    code_salt: string | null;
-                    created_at: string;
-                    disabled_at: string | null;
-                    expires_at: string | null;
-                    id: string;
-                    max_sessions_per_visitor: number;
-                    max_turns_per_session: number;
-                    mode: string;
-                    organization_id: string;
-                    resource_id: string;
-                    slug: string;
-                    tool_policy: Json;
-                    updated_at: string;
-                };
-                Insert: {
-                    allowed_origins?: string[];
-                    branding?: Json;
-                    capture_fields?: Json;
-                    code_hash?: string | null;
-                    code_salt?: string | null;
-                    created_at?: string;
-                    disabled_at?: string | null;
-                    expires_at?: string | null;
-                    id?: string;
-                    max_sessions_per_visitor?: number;
-                    max_turns_per_session?: number;
-                    mode?: string;
-                    organization_id: string;
-                    resource_id: string;
-                    slug: string;
-                    tool_policy?: Json;
-                    updated_at?: string;
-                };
-                Update: {
-                    allowed_origins?: string[];
-                    branding?: Json;
-                    capture_fields?: Json;
-                    code_hash?: string | null;
-                    code_salt?: string | null;
-                    created_at?: string;
-                    disabled_at?: string | null;
-                    expires_at?: string | null;
-                    id?: string;
-                    max_sessions_per_visitor?: number;
-                    max_turns_per_session?: number;
-                    mode?: string;
-                    organization_id?: string;
-                    resource_id?: string;
-                    slug?: string;
-                    tool_policy?: Json;
-                    updated_at?: string;
-                };
-                Relationships: [
-                    {
-                        foreignKeyName: "agent_access_grants_organization_id_fkey";
-                        columns: ["organization_id"];
-                        isOneToOne: false;
-                        referencedRelation: "organizations";
-                        referencedColumns: ["id"];
-                    }
-                ];
-            };
-            agent_chat_capabilities: {
-                Row: {
-                    created_at: string;
-                    expires_at: string;
-                    grant_id: string;
-                    id: string;
-                    organization_id: string;
-                    origin: string | null;
-                    resource_id: string;
-                    revoked_at: string | null;
-                    session_id: string | null;
-                    token_hash: string;
-                    visitor_id: string | null;
-                };
-                Insert: {
-                    created_at?: string;
-                    expires_at: string;
-                    grant_id: string;
-                    id?: string;
-                    organization_id: string;
-                    origin?: string | null;
-                    resource_id: string;
-                    revoked_at?: string | null;
-                    session_id?: string | null;
-                    token_hash: string;
-                    visitor_id?: string | null;
-                };
-                Update: {
-                    created_at?: string;
-                    expires_at?: string;
-                    grant_id?: string;
-                    id?: string;
-                    organization_id?: string;
-                    origin?: string | null;
-                    resource_id?: string;
-                    revoked_at?: string | null;
-                    session_id?: string | null;
-                    token_hash?: string;
-                    visitor_id?: string | null;
-                };
-                Relationships: [
-                    {
-                        foreignKeyName: "agent_chat_capabilities_grant_id_fkey";
-                        columns: ["grant_id"];
-                        isOneToOne: false;
-                        referencedRelation: "agent_access_grants";
-                        referencedColumns: ["id"];
-                    },
-                    {
-                        foreignKeyName: "agent_chat_capabilities_organization_id_fkey";
-                        columns: ["organization_id"];
-                        isOneToOne: false;
-                        referencedRelation: "organizations";
-                        referencedColumns: ["id"];
-                    },
-                    {
-                        foreignKeyName: "agent_chat_capabilities_session_id_fkey";
-                        columns: ["session_id"];
-                        isOneToOne: false;
-                        referencedRelation: "sessions";
-                        referencedColumns: ["session_id"];
-                    }
-                ];
-            };
             organizations: {
                 Row: {
                     config: Json;
@@ -4567,11 +4500,11 @@ type Database = {
                 Returns: undefined;
             };
             auth_jwt_claims: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: Json;
             };
             auth_uid_safe: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: string;
             };
             can_assign_role_in_org: {
@@ -4582,7 +4515,7 @@ type Database = {
                 Returns: boolean;
             };
             current_user_is_platform_admin: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: boolean;
             };
             current_user_shares_org_with: {
@@ -4592,11 +4525,11 @@ type Database = {
                 Returns: boolean;
             };
             current_user_supabase_id: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: string;
             };
             detect_stalled_executions: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: undefined;
             };
             execute_session_turn: {
@@ -4617,7 +4550,7 @@ type Database = {
                 }[];
             };
             get_platform_credential_kek: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: string;
             };
             get_storage_org_id: {
@@ -4627,7 +4560,7 @@ type Database = {
                 Returns: string;
             };
             get_workos_user_id: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: string;
             };
             has_org_access: {
@@ -4635,10 +4568,7 @@ type Database = {
                     action?: string;
                     org_id: string;
                     system_path: string;
-                };
-                Returns: boolean;
-            } | {
-                Args: {
+                } | {
                     action?: string;
                     system_path: string;
                 };
@@ -4674,15 +4604,15 @@ type Database = {
                 Returns: Json;
             };
             process_due_schedules: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: Json;
             };
             recompute_all_memberships: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: undefined;
             };
             repair_membership_role_assignments: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: {
                     membership_id: string;
                     organization_id: string;
@@ -4712,7 +4642,7 @@ type Database = {
                 Returns: string;
             };
             upsert_user_profile: {
-                Args: never;
+                Args: Record<PropertyKey, never>;
                 Returns: {
                     profile_display_name: string;
                     profile_email: string;