@elevasis/sdk 1.35.1 → 1.36.0

package/dist/cli.cjs

@@ -45807,7 +45807,7 @@ function wrapAction(commandName, fn) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "1.35.1",
+  version: "1.36.0",
   description: "SDK for building Elevasis organization resources",
   type: "module",
   bin: {
@@ -52198,6 +52198,166 @@ function registerSessionCommands(program3) {
   registerSessionEnd(program3);
 }
 
+// src/cli/commands/grant/grant.ts
+init_source();
+init_config();
+function printJson8(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function appendQuery7(params, key, value) {
+  if (value === void 0 || value === null || value === "" || value === false) return;
+  params.set(key, String(value));
+}
+function endpointWithQuery7(endpoint, params) {
+  const query = params.toString();
+  return query ? `${endpoint}?${query}` : endpoint;
+}
+function parseJson2(value, label) {
+  if (value === void 0) return void 0;
+  try {
+    return JSON.parse(value);
+  } catch (error46) {
+    const message = error46 instanceof Error ? error46.message : String(error46);
+    throw new Error(`Invalid JSON for ${label}: ${message}`);
+  }
+}
+function parsePositiveInt(value, label) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return parsed;
+}
+function parseOrigins(value) {
+  if (value === void 0) return void 0;
+  const origins = value.split(",").map((origin) => origin.trim()).filter(Boolean);
+  return origins.length > 0 ? origins : void 0;
+}
+function deriveSlugFromResourceId(resourceId) {
+  const slug = resourceId.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (!slug) {
+    throw new Error("--resource must contain at least one alphanumeric character when --slug is omitted");
+  }
+  return slug;
+}
+function getPublicPath(slug) {
+  return `/public/agents/${encodeURIComponent(slug)}`;
+}
+function resolvePublicUrl(slug, publicBaseUrl) {
+  const path3 = getPublicPath(slug);
+  const baseUrl = publicBaseUrl ?? process.env.ELEVASIS_PUBLIC_BASE_URL ?? process.env.ELEVASIS_PUBLIC_APP_URL;
+  if (!baseUrl) return path3;
+  try {
+    return new URL(path3, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).toString();
+  } catch {
+    throw new Error("--public-base-url must be a valid URL");
+  }
+}
+function printGrant(grant) {
+  const status = grant.isDisabled ? "disabled" : "active";
+  console.log(source_default.white(`  ${source_default.bold(grant.slug)}  ${source_default.gray(status)}`));
+  console.log(source_default.gray(`    Agent:    ${grant.resourceId}`));
+  console.log(source_default.gray(`    Mode:     ${grant.mode}${grant.requiresCode ? " (code required)" : ""}`));
+  console.log(source_default.gray(`    Origins:  ${grant.allowedOrigins.length > 0 ? grant.allowedOrigins.join(", ") : "any"}`));
+  console.log(source_default.gray(`    Limits:   turns=${grant.maxTurnsPerSession}, sessions/visitor=${grant.maxSessionsPerVisitor}`));
+  if (grant.expiresAt) console.log(source_default.gray(`    Expires:  ${new Date(grant.expiresAt).toLocaleString()}`));
+  if (grant.disabledAt) console.log(source_default.gray(`    Disabled: ${new Date(grant.disabledAt).toLocaleString()}`));
+}
+function registerGrantList(program3) {
+  program3.command("grant:list").description("List public/code-gated agent access grants").option("--resource-id <id>", "Filter by agent resource ID").option("--include-disabled", "Include disabled grants").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:list", async (options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const params = new URLSearchParams();
+      appendQuery7(params, "resourceId", options.resourceId);
+      appendQuery7(params, "includeDisabled", options.includeDisabled ? "true" : void 0);
+      const result = await apiGet(
+        endpointWithQuery7("/api/external/agent-access-grants", params),
+        apiUrl
+      );
+      if (options.json) {
+        printJson8(result);
+        return;
+      }
+      if (result.grants.length === 0) {
+        console.log(source_default.yellow("No agent access grants found."));
+        return;
+      }
+      console.log(source_default.cyan(`Agent access grants (${result.grants.length} of ${result.total}):`));
+      for (const grant of result.grants) {
+        printGrant(grant);
+        console.log();
+      }
+    })
+  );
+}
+function registerGrantCreate(program3) {
+  program3.command("grant:create").description("Create a public/code-gated agent access grant").requiredOption("--resource <id>", "Agent resource ID to expose").option("--slug <slug>", "Public slug; defaults to normalized --resource").option("--mode <mode>", "Access mode: public | code", "public").option("--code <code>", "Access code for --mode code").option("--origins <origins>", "Comma-separated allowed origins; omit for any origin").option("--expires-at <iso>", "ISO timestamp when the grant expires").option("--max-turns <number>", "Maximum turns per public session").option("--max-sessions <number>", "Maximum sessions per visitor").option("--branding <json>", "Branding metadata JSON object").option("--capture-fields <json>", "Capture fields JSON array").option("--tool-policy <json>", "Tool policy JSON object").option("--public-base-url <url>", "Client public app base URL for printed public URL").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:create", async (options) => {
+      const mode = options.mode ?? "public";
+      if (mode !== "public" && mode !== "code") {
+        throw new Error("--mode must be public or code");
+      }
+      if (mode === "code" && !options.code) {
+        throw new Error("--code is required when --mode code");
+      }
+      const slug = options.slug ?? deriveSlugFromResourceId(options.resource);
+      const body = {
+        resourceId: options.resource,
+        slug,
+        mode
+      };
+      if (options.code) body.code = options.code;
+      if (options.expiresAt) body.expiresAt = options.expiresAt;
+      const allowedOrigins = parseOrigins(options.origins);
+      if (allowedOrigins) body.allowedOrigins = allowedOrigins;
+      const maxTurns = parsePositiveInt(options.maxTurns, "--max-turns");
+      if (maxTurns !== void 0) body.maxTurnsPerSession = maxTurns;
+      const maxSessions = parsePositiveInt(options.maxSessions, "--max-sessions");
+      if (maxSessions !== void 0) body.maxSessionsPerVisitor = maxSessions;
+      const branding = parseJson2(options.branding, "--branding");
+      if (branding !== void 0) body.branding = branding;
+      const captureFields = parseJson2(options.captureFields, "--capture-fields");
+      if (captureFields !== void 0) body.captureFields = captureFields;
+      const toolPolicy = parseJson2(options.toolPolicy, "--tool-policy");
+      if (toolPolicy !== void 0) body.toolPolicy = toolPolicy;
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const result = await apiPost("/api/external/agent-access-grants", body, apiUrl);
+      if (options.json) {
+        printJson8(result.grant);
+        return;
+      }
+      console.log(source_default.green(`Created agent access grant ${result.grant.slug}.`));
+      console.log(source_default.gray(`  Public URL: ${resolvePublicUrl(result.grant.slug, options.publicBaseUrl)}`));
+      printGrant(result.grant);
+    })
+  );
+}
+function registerGrantDisable(program3) {
+  program3.command("grant:disable <slug>").description("Disable an agent access grant without deleting it").option("--api-url <url>", "API base URL").option("--json", "Output as JSON").action(
+    wrapAction("grant:disable", async (slug, options) => {
+      const apiUrl = resolveApiUrl(options.apiUrl);
+      const result = await apiPost(
+        `/api/external/agent-access-grants/${encodeURIComponent(slug)}/disable`,
+        {},
+        apiUrl
+      );
+      if (options.json) {
+        printJson8(result.grant);
+        return;
+      }
+      console.log(source_default.green(`Disabled agent access grant ${result.grant.slug}.`));
+    })
+  );
+}
+
+// src/cli/commands/grant/index.ts
+function registerGrantCommands(program3) {
+  registerGrantList(program3);
+  registerGrantCreate(program3);
+  registerGrantDisable(program3);
+}
+
 // src/cli/commands/om/index.ts
 function registerOmScaffoldCommands(program3) {
   program3.command("om:scaffold:system").description("Guide creation of a new system entry in core/config/organization-model/systems.ts").option("--id <path>", "dot-notated system path, e.g. sales.crm (prompted if absent)").option("--title <title>", "display title (prompted if absent)").option("--kind <kind>", "system kind: operational | analytical | support (prompted if absent)").option("--api-backed", "emit apiInterface block and remind to add resource IDs").option("--dry-run", "print proposed TypeScript block without writing").action(async (opts) => {
@@ -52450,6 +52610,9 @@ Commands:
   elevasis-sdk session:list                         List agent sessions
   elevasis-sdk session:get <id>                     Get session details
   elevasis-sdk session:end <id>                     End an active agent session
+  elevasis-sdk grant:list                           List public/code-gated agent access grants
+  elevasis-sdk grant:create --resource <id>       Create an agent access grant
+  elevasis-sdk grant:disable <slug>                  Disable an agent access grant
   elevasis-sdk acquisition:list:list                 List acquisition lists
   elevasis-sdk acquisition:deal:list                 List acquisition deals
   elevasis-sdk knowledge:generate                   Generate knowledge nodes from MDX files
@@ -52487,6 +52650,7 @@ registerQueueCommands(program2);
 registerScheduleCommands(program2);
 registerAgentCommands(program2);
 registerSessionCommands(program2);
+registerGrantCommands(program2);
 registerAcquisitionCommands(program2);
 registerKnowledgeCommands(program2);
 registerRequestCommands(program2);

package/dist/test-utils/index.d.ts

@@ -10797,7 +10797,7 @@ type TypedAdapter<TMap extends ToolMethodMap$1> = {
  *
  *   Parent -> Worker:  { type: 'abort' }                               (graceful abort before terminate)
  *
- *   Worker -> Parent:  { type: 'log', entry: { level, message, timestamp, executionId } }
+ *   Worker -> Parent:  { type: 'log', entry: { level, message, timestamp, executionId, context? } }
  *
  *   Worker -> Parent:  { type: 'tool-call', id, tool, method, params, credential? }
  *   Parent -> Worker:  { type: 'tool-result', id, result?, error?, code? }

package/dist/test-utils/index.js

@@ -10203,10 +10203,10 @@ async function executeWorkflow(workflow, input, context) {
 }
 function buildWorkerExecutionContext(params) {
   const { executionId } = params;
-  const postLog = (level, message) => {
+  const postLog = (level, message, logContext) => {
     parentPort.postMessage({
       type: "log",
-      entry: { level, message, timestamp: (/* @__PURE__ */ new Date()).toISOString(), executionId }
+      entry: { level, message, timestamp: (/* @__PURE__ */ new Date()).toISOString(), executionId, context: logContext }
     });
   };
   return {
@@ -10221,21 +10221,21 @@ function buildWorkerExecutionContext(params) {
     signal: params.signal,
     store: /* @__PURE__ */ new Map(),
     logger: {
-      debug: (msg) => {
+      debug: (msg, logContext) => {
         console.log(`[debug] ${msg}`);
-        postLog("info", msg);
+        postLog("info", msg, logContext);
       },
-      info: (msg) => {
+      info: (msg, logContext) => {
         console.log(`[info] ${msg}`);
-        postLog("info", msg);
+        postLog("info", msg, logContext);
       },
-      warn: (msg) => {
+      warn: (msg, logContext) => {
         console.warn(`[warn] ${msg}`);
-        postLog("warn", msg);
+        postLog("warn", msg, logContext);
       },
-      error: (msg) => {
+      error: (msg, logContext) => {
         console.error(`[error] ${msg}`);
-        postLog("error", msg);
+        postLog("error", msg, logContext);
       }
     },
     onMessageEvent: async (event) => {

package/dist/types/worker/index.d.ts

@@ -16,7 +16,7 @@
  *
  *   Parent -> Worker:  { type: 'abort' }                               (graceful abort before terminate)
  *
- *   Worker -> Parent:  { type: 'log', entry: { level, message, timestamp, executionId } }
+ *   Worker -> Parent:  { type: 'log', entry: { level, message, timestamp, executionId, context? } }
  *
  *   Worker -> Parent:  { type: 'tool-call', id, tool, method, params, credential? }
  *   Parent -> Worker:  { type: 'tool-result', id, result?, error?, code? }

package/dist/worker/index.js

@@ -6874,10 +6874,10 @@ async function executeWorkflow(workflow, input, context) {
 }
 function buildWorkerExecutionContext(params) {
   const { executionId } = params;
-  const postLog = (level, message) => {
+  const postLog = (level, message, logContext) => {
     parentPort.postMessage({
       type: "log",
-      entry: { level, message, timestamp: (/* @__PURE__ */ new Date()).toISOString(), executionId }
+      entry: { level, message, timestamp: (/* @__PURE__ */ new Date()).toISOString(), executionId, context: logContext }
     });
   };
   return {
@@ -6892,21 +6892,21 @@ function buildWorkerExecutionContext(params) {
     signal: params.signal,
     store: /* @__PURE__ */ new Map(),
     logger: {
-      debug: (msg) => {
+      debug: (msg, logContext) => {
         console.log(`[debug] ${msg}`);
-        postLog("info", msg);
+        postLog("info", msg, logContext);
       },
-      info: (msg) => {
+      info: (msg, logContext) => {
         console.log(`[info] ${msg}`);
-        postLog("info", msg);
+        postLog("info", msg, logContext);
       },
-      warn: (msg) => {
+      warn: (msg, logContext) => {
         console.warn(`[warn] ${msg}`);
-        postLog("warn", msg);
+        postLog("warn", msg, logContext);
       },
-      error: (msg) => {
+      error: (msg, logContext) => {
         console.error(`[error] ${msg}`);
-        postLog("error", msg);
+        postLog("error", msg, logContext);
       }
     },
     onMessageEvent: async (event) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/sdk",
-  "version": "1.35.1",
+  "version": "1.36.0",
   "description": "SDK for building Elevasis organization resources",
   "type": "module",
   "bin": {
@@ -58,9 +58,9 @@
     "tsup": "^8.0.0",
     "typescript": "5.9.2",
     "zod": "^4.1.0",
-    "@repo/core": "0.48.1",
-    "@repo/eslint-config": "0.0.0",
-    "@repo/typescript-config": "0.0.0"
+    "@repo/core": "0.49.0",
+    "@repo/typescript-config": "0.0.0",
+    "@repo/eslint-config": "0.0.0"
   },
   "scripts": {
     "lint": "eslint src --max-warnings 0",

package/reference/claude-config/registries/skill-coverage.json

@@ -11,6 +11,7 @@
     "agent": "operator-facing deployed-agent introspection",
     "session": "operator-facing session introspection",
     "queue": "HITL approval queue — surfaced in the UI",
+    "grant": "operator-facing public agent access management",
     "schedule": "operator-facing scheduler control",
     "note": "CLI-only in tenant context; /notes is monorepo-internal, not propagated",
     "ui": "infra-only dev toggle (ui:use-local / ui:use-published)",

package/reference/claude-config/sync-notes/2026-06-12-agent-grants-visualizer-operations.md

@@ -0,0 +1,30 @@
+# Agent grants, execution visualizer, and Operations sidebar release train
+
+This train publishes coordinated platform updates across `@elevasis/core`, `@elevasis/ui`,
+and `@elevasis/sdk`, then syncs the external template baseline.
+
+## What changes for tenant projects
+
+1. `@elevasis/sdk` adds `grant:list`, `grant:create`, and `grant:disable` for
+   managing public/code-gated agent access grants through the platform API.
+2. `@elevasis/ui` adds shared agent public/private controls and improves the
+   agent execution visualizer with per-iteration tool activity.
+3. `@elevasis/core` adds the grant audit activity contract used by platform
+   activity feeds.
+4. The template `.claude/registries/skill-coverage.json` now explicitly waives
+   the `grant` CLI domain as operator-facing access-management tooling.
+
+## Operator action
+
+- Run the prepared external sync manifest from the SDK ship artifact.
+- Verify each derived project updates `.claude/registries/skill-coverage.json`.
+- After package baselines are bumped, verify derived package manifests point at
+  the newly published `@elevasis/core`, `@elevasis/ui`, and `@elevasis/sdk`
+  versions selected by the release steps.
+
+## Manual-review exclusions
+
+Operations sidebar root-route parity for `external/nirvana-marketing` and
+`external/ZentaraHQ` is intentionally excluded from this ship train. Their
+root routes are project-specific merge-managed surfaces and should be reviewed
+manually before adopting the template Operations manifest mount.