@granular-software/sdk 0.4.60 → 0.4.62

package/dist/index.mjs

@@ -12273,6 +12273,7 @@ var StateTransitionInputBindingSchema = external_exports.lazy(
 );
 var StateTransitionActionSchema = external_exports.object({
   effect: external_exports.string().min(1),
+  providerLabel: external_exports.string().optional(),
   input: external_exports.record(external_exports.string(), StateTransitionInputBindingSchema).optional()
 }).strict();
 var StateTransitionAssigneeSchema = external_exports.object({
@@ -14760,6 +14761,15 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
         is_final: Boolean!
         history: [StateMachineTransitionEvent!]!
         instances_in_state(state: String!): [Model!]!
+        instance_population(state: String!, page: Int = 1, per_page: Int = 50): StateMachineInstancePopulation!
+      }
+
+      type StateMachineInstancePopulation {
+        count: Int!
+        instances: [Model!]!
+        page: Int!
+        per_page: Int!
+        has_more: Boolean!
       }
 
       type StateMachineState {
@@ -14968,6 +14978,13 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
             value.model.target || value.model,
             value.name,
             state
+          ),
+          instance_population: async (value, { state, page, per_page }) => await stateMachines.instancePopulation(
+            value.model.target || value.model,
+            value.name,
+            state,
+            page,
+            per_page
           )
         }
       };
@@ -18002,11 +18019,16 @@ var Granular = class _Granular {
           `${methodName}() requires at least one permission so the SDK can ensure assignments for new users.`
         );
       }
-      for (const profileName of user.permissions) {
-        const profileId = await this.ensurePermissionProfile(
-          sandbox.sandboxId,
-          profileName
+      const permissionProfileIds = [];
+      for (const profileReference of user.permissions) {
+        permissionProfileIds.push(
+          await this.ensurePermissionProfile(
+            sandbox.sandboxId,
+            profileReference
+          )
         );
+      }
+      for (const profileId of permissionProfileIds) {
         await this.ensureAssignment(
           user.granularId,
           sandbox.sandboxId,
@@ -19011,25 +19033,37 @@ var Granular = class _Granular {
     }
   }
   /**
-   * Ensure a permission profile exists for a sandbox, creating it if needed.
-   * If profileName matches an existing profile name, returns its ID.
-   * Otherwise, creates a v1 source-profile file shape with an allow default.
+   * Resolve an existing permission profile by exact name or ID.
+   *
+   * `allow-all` is the sole compatibility profile that the SDK may provision
+   * automatically. Every other missing reference fails closed so a typo or
+   * untrusted role value cannot become an allow-default profile.
    */
-  async ensurePermissionProfile(sandboxId, profileName) {
-    try {
-      const profiles = await this.permissionProfiles.list(sandboxId);
-      const existing = profiles.find((p) => p.name === profileName);
-      if (existing) {
-        return existing.permissionProfileId;
-      }
-    } catch {
+  async ensurePermissionProfile(sandboxId, profileReference) {
+    const normalizedReference = typeof profileReference === "string" ? profileReference.trim() : "";
+    if (!normalizedReference) {
+      throw new Error(
+        "Permission profile references must be non-empty names or IDs."
+      );
+    }
+    const profiles = await this.permissionProfiles.list(sandboxId);
+    const existing = profiles.find(
+      (profile) => profile.name === normalizedReference || profile.permissionProfileId === normalizedReference
+    );
+    if (existing) {
+      return existing.permissionProfileId;
+    }
+    if (normalizedReference !== "allow-all") {
+      throw new Error(
+        `Permission profile "${normalizedReference}" was not found in sandbox ${sandboxId}. Provision it with granular build or granular deploy before calling openEnvironment(). Only the reserved "allow-all" profile can be created automatically.`
+      );
     }
     const created = await this.permissionProfiles.create(sandboxId, {
-      name: profileName,
+      name: normalizedReference,
       rules: {
         schemaVersion: 1,
-        name: profileName,
-        description: profileName === "allow-all" ? "Every declared action is visible unless a manifest policy denies it." : `Generated permission profile ${profileName}`,
+        name: normalizedReference,
+        description: "Every declared action is visible unless a manifest policy denies it.",
         defaults: { actionPolicy: "allow" },
         actions: []
       }