@granular-software/sdk 0.4.60 → 0.4.62

package/README.md

@@ -420,6 +420,14 @@ Built-in profiles are materialized by `granular init` and `granular pull`:
 - `confirm-all`: exposes every declared action but requires confirmation.
 - `deny-all`: exposes no executable actions.
 
+`openEnvironment({ permissions: [...] })` resolves each entry by exact profile
+name or profile ID. Unknown entries fail before the SDK writes an assignment;
+they are never generated as permissive profiles. The only compatibility
+exception is the explicit `allow-all` name, which the SDK may provision when it
+is missing. Sync custom, `confirm-all`, and `deny-all` profiles with
+`granular build` or `granular deploy` first. Map application roles to reviewed
+profile names or IDs instead of forwarding unchecked end-user input.
+
 Manifest-level logic policies live on effects and apply to every profile:
 
 ```json

package/dist/agent-evals.d.mts

@@ -1,5 +1,5 @@
-import { a as EnvironmentSession, G as Granular } from './client-DSkGcmmX.mjs';
-import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-CNe-Ff6U.mjs';
+import { a as EnvironmentSession, G as Granular } from './client-Dg0I_5B_.mjs';
+import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-C8OQnF6E.mjs';
 import { GranularAgentToolInfo, GeneratedJobCodeIssue, BuildGranularAgentSystemPromptInput, HarnessRenderedPrompt, HarnessRenderedContinuation, HarnessControllerBudgets } from './agent-harness.mjs';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';

package/dist/agent-evals.d.ts

@@ -1,5 +1,5 @@
-import { a as EnvironmentSession, G as Granular } from './client-BzgQvNyG.js';
-import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-CNe-Ff6U.js';
+import { a as EnvironmentSession, G as Granular } from './client-Bx5jIDGB.js';
+import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-C8OQnF6E.js';
 import { GranularAgentToolInfo, GeneratedJobCodeIssue, BuildGranularAgentSystemPromptInput, HarnessRenderedPrompt, HarnessRenderedContinuation, HarnessControllerBudgets } from './agent-harness.js';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';

package/dist/agent-evals.js

@@ -12274,6 +12274,7 @@ var StateTransitionInputBindingSchema = external_exports.lazy(
 );
 var StateTransitionActionSchema = external_exports.object({
   effect: external_exports.string().min(1),
+  providerLabel: external_exports.string().optional(),
   input: external_exports.record(external_exports.string(), StateTransitionInputBindingSchema).optional()
 }).strict();
 var StateTransitionAssigneeSchema = external_exports.object({
@@ -14761,6 +14762,15 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
         is_final: Boolean!
         history: [StateMachineTransitionEvent!]!
         instances_in_state(state: String!): [Model!]!
+        instance_population(state: String!, page: Int = 1, per_page: Int = 50): StateMachineInstancePopulation!
+      }
+
+      type StateMachineInstancePopulation {
+        count: Int!
+        instances: [Model!]!
+        page: Int!
+        per_page: Int!
+        has_more: Boolean!
       }
 
       type StateMachineState {
@@ -14969,6 +14979,13 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
             value.model.target || value.model,
             value.name,
             state
+          ),
+          instance_population: async (value, { state, page, per_page }) => await stateMachines.instancePopulation(
+            value.model.target || value.model,
+            value.name,
+            state,
+            page,
+            per_page
           )
         }
       };
@@ -17905,11 +17922,16 @@ var Granular = class _Granular {
           `${methodName}() requires at least one permission so the SDK can ensure assignments for new users.`
         );
       }
-      for (const profileName of user.permissions) {
-        const profileId = await this.ensurePermissionProfile(
-          sandbox.sandboxId,
-          profileName
+      const permissionProfileIds = [];
+      for (const profileReference of user.permissions) {
+        permissionProfileIds.push(
+          await this.ensurePermissionProfile(
+            sandbox.sandboxId,
+            profileReference
+          )
         );
+      }
+      for (const profileId of permissionProfileIds) {
         await this.ensureAssignment(
           user.granularId,
           sandbox.sandboxId,
@@ -18914,25 +18936,37 @@ var Granular = class _Granular {
     }
   }
   /**
-   * Ensure a permission profile exists for a sandbox, creating it if needed.
-   * If profileName matches an existing profile name, returns its ID.
-   * Otherwise, creates a v1 source-profile file shape with an allow default.
+   * Resolve an existing permission profile by exact name or ID.
+   *
+   * `allow-all` is the sole compatibility profile that the SDK may provision
+   * automatically. Every other missing reference fails closed so a typo or
+   * untrusted role value cannot become an allow-default profile.
    */
-  async ensurePermissionProfile(sandboxId, profileName) {
-    try {
-      const profiles = await this.permissionProfiles.list(sandboxId);
-      const existing = profiles.find((p) => p.name === profileName);
-      if (existing) {
-        return existing.permissionProfileId;
-      }
-    } catch {
+  async ensurePermissionProfile(sandboxId, profileReference) {
+    const normalizedReference = typeof profileReference === "string" ? profileReference.trim() : "";
+    if (!normalizedReference) {
+      throw new Error(
+        "Permission profile references must be non-empty names or IDs."
+      );
+    }
+    const profiles = await this.permissionProfiles.list(sandboxId);
+    const existing = profiles.find(
+      (profile) => profile.name === normalizedReference || profile.permissionProfileId === normalizedReference
+    );
+    if (existing) {
+      return existing.permissionProfileId;
+    }
+    if (normalizedReference !== "allow-all") {
+      throw new Error(
+        `Permission profile "${normalizedReference}" was not found in sandbox ${sandboxId}. Provision it with granular build or granular deploy before calling openEnvironment(). Only the reserved "allow-all" profile can be created automatically.`
+      );
     }
     const created = await this.permissionProfiles.create(sandboxId, {
-      name: profileName,
+      name: normalizedReference,
       rules: {
         schemaVersion: 1,
-        name: profileName,
-        description: profileName === "allow-all" ? "Every declared action is visible unless a manifest policy denies it." : `Generated permission profile ${profileName}`,
+        name: normalizedReference,
+        description: "Every declared action is visible unless a manifest policy denies it.",
         defaults: { actionPolicy: "allow" },
         actions: []
       }