@granular-software/sdk 0.4.61 → 0.4.63

package/README.md

@@ -420,6 +420,14 @@ Built-in profiles are materialized by `granular init` and `granular pull`:
 - `confirm-all`: exposes every declared action but requires confirmation.
 - `deny-all`: exposes no executable actions.
 
+`openEnvironment({ permissions: [...] })` resolves each entry by exact profile
+name or profile ID. Unknown entries fail before the SDK writes an assignment;
+they are never generated as permissive profiles. The only compatibility
+exception is the explicit `allow-all` name, which the SDK may provision when it
+is missing. Sync custom, `confirm-all`, and `deny-all` profiles with
+`granular build` or `granular deploy` first. Map application roles to reviewed
+profile names or IDs instead of forwarding unchecked end-user input.
+
 Manifest-level logic policies live on effects and apply to every profile:
 
 ```json

package/dist/agent-evals.d.mts

@@ -1,5 +1,5 @@
-import { a as EnvironmentSession, G as Granular } from './client-DSkGcmmX.mjs';
-import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-CNe-Ff6U.mjs';
+import { a as EnvironmentSession, G as Granular } from './client-lk-dmdKR.mjs';
+import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cY as RecordObjectOptions, dO as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, be as CreateEnvironmentData, aI as GranularOptions } from './spend-DtsHRNb5.mjs';
 import { GranularAgentToolInfo, GeneratedJobCodeIssue, BuildGranularAgentSystemPromptInput, HarnessRenderedPrompt, HarnessRenderedContinuation, HarnessControllerBudgets } from './agent-harness.mjs';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';

package/dist/agent-evals.d.ts

@@ -1,5 +1,5 @@
-import { a as EnvironmentSession, G as Granular } from './client-BzgQvNyG.js';
-import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cX as RecordObjectOptions, dN as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, bd as CreateEnvironmentData, aI as GranularOptions } from './spend-CNe-Ff6U.js';
+import { a as EnvironmentSession, G as Granular } from './client-KqJIH7WE.js';
+import { at as GranularSpendContext, ao as OpenAITokenSpend, P as Prompt, cY as RecordObjectOptions, dO as ManifestContent, d as SessionHeapSnapshot, T as ToolWithHandler, aP as ConnectOptions, be as CreateEnvironmentData, aI as GranularOptions } from './spend-DtsHRNb5.js';
 import { GranularAgentToolInfo, GeneratedJobCodeIssue, BuildGranularAgentSystemPromptInput, HarnessRenderedPrompt, HarnessRenderedContinuation, HarnessControllerBudgets } from './agent-harness.js';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';

package/dist/agent-evals.js

@@ -14762,6 +14762,15 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
         is_final: Boolean!
         history: [StateMachineTransitionEvent!]!
         instances_in_state(state: String!): [Model!]!
+        instance_population(state: String!, page: Int = 1, per_page: Int = 50): StateMachineInstancePopulation!
+      }
+
+      type StateMachineInstancePopulation {
+        count: Int!
+        instances: [Model!]!
+        page: Int!
+        per_page: Int!
+        has_more: Boolean!
       }
 
       type StateMachineState {
@@ -14970,6 +14979,13 @@ var stateMachineMetamodelPackage = defineMetamodelPackage({
             value.model.target || value.model,
             value.name,
             state
+          ),
+          instance_population: async (value, { state, page, per_page }) => await stateMachines.instancePopulation(
+            value.model.target || value.model,
+            value.name,
+            state,
+            page,
+            per_page
           )
         }
       };
@@ -15218,7 +15234,6 @@ function buildEffectMetamodelMutations(toolPath, spec) {
 // src/client.ts
 var DEFAULT_CONVERSATION_SESSION_LIST_LIMIT = 100;
 var MAX_CONVERSATION_SESSION_LIST_LIMIT = 500;
-var MAX_CONVERSATION_SESSION_LIST_OFFSET = 1e5;
 function requireUserEnvironmentSequence(value, field) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
     throw new Error(
@@ -15598,6 +15613,10 @@ var Environment = class _Environment {
   get sessions() {
     return {
       list: async (options = {}) => this.listSessions(options),
+      page: async (options = {}) => this.granular.listSessionsPage({
+        ...options,
+        environmentId: this.environmentId
+      }),
       create: async (options) => this.createSession(options),
       connect: async (sessionId, options) => this.connectSession(sessionId, options),
       reopen: async (sessionId, options) => this.reopenSession(sessionId, options),
@@ -15853,7 +15872,6 @@ var Environment = class _Environment {
       headers: {
         Authorization: `Bearer ${this._apiKey}`,
         "Content-Type": "application/json",
-        Connection: "close",
         ...options.headers
       }
     });
@@ -17377,8 +17395,7 @@ var EnvironmentSession = class extends Session {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
-              Authorization: `Bearer ${this.environment.authToken}`,
-              Connection: "close"
+              Authorization: `Bearer ${this.environment.authToken}`
             },
             body: JSON.stringify({
               reason: "sdk_disconnect_http_fallback",
@@ -17906,11 +17923,16 @@ var Granular = class _Granular {
           `${methodName}() requires at least one permission so the SDK can ensure assignments for new users.`
         );
       }
-      for (const profileName of user.permissions) {
-        const profileId = await this.ensurePermissionProfile(
-          sandbox.sandboxId,
-          profileName
+      const permissionProfileIds = [];
+      for (const profileReference of user.permissions) {
+        permissionProfileIds.push(
+          await this.ensurePermissionProfile(
+            sandbox.sandboxId,
+            profileReference
+          )
         );
+      }
+      for (const profileId of permissionProfileIds) {
         await this.ensureAssignment(
           user.granularId,
           sandbox.sandboxId,
@@ -18075,6 +18097,21 @@ var Granular = class _Granular {
    * List indexed sessions using ownership filters and bounded pagination.
    */
   async listSessions(options) {
+    const items = [];
+    let cursor = options.cursor?.trim() || void 0;
+    let pageCount = 0;
+    do {
+      const page = await this.listSessionsPage({ ...options, cursor });
+      items.push(...page.items);
+      cursor = page.nextCursor || void 0;
+      pageCount += 1;
+      if (pageCount > 1e4) {
+        throw new Error("Session pagination exceeded the safe page limit");
+      }
+    } while (cursor);
+    return items;
+  }
+  async listSessionsPage(options) {
     const environmentId = options.environmentId?.trim();
     const sandboxId = options.sandboxId?.trim();
     const subjectId = options.subjectId?.trim();
@@ -18102,17 +18139,14 @@ var Granular = class _Granular {
       1,
       MAX_CONVERSATION_SESSION_LIST_LIMIT
     );
-    const offset = boundedSessionListInteger(
-      options.offset,
-      "offset",
-      0,
-      0,
-      MAX_CONVERSATION_SESSION_LIST_OFFSET
-    );
+    const cursor = options.cursor?.trim();
+    if (options.cursor !== void 0 && !cursor) {
+      throw new Error("Session list cursor must be a non-empty string.");
+    }
     const query = new URLSearchParams({
-      limit: String(limit),
-      offset: String(offset)
+      limit: String(limit)
     });
+    if (cursor) query.set("cursor", cursor);
     if (environmentId) query.set("environmentId", environmentId);
     if (sandboxId) query.set("sandboxId", sandboxId);
     if (subjectId) query.set("userId", subjectId);
@@ -18120,11 +18154,13 @@ var Granular = class _Granular {
       query.set("sessionScope", options.sessionScope.trim());
     }
     if (status !== "all") query.set("status", status);
-    const res = await this.request(
-      `/control/sessions?${query.toString()}`
-    );
-    const items = Array.isArray(res.items) ? res.items : [];
-    return items.map((row) => this.normalizeConversationSession(row));
+    const res = await this.request(`/control/sessions?${query.toString()}`);
+    const items = Array.isArray(res.items) ? res.items.map((row) => this.normalizeConversationSession(row)) : [];
+    const nextCursor = res.nextCursor ?? null;
+    if (nextCursor === cursor) {
+      throw new Error("Session pagination cursor did not advance");
+    }
+    return { items, nextCursor };
   }
   /**
    * List active (open) sessions for an environment.
@@ -18151,9 +18187,6 @@ var Granular = class _Granular {
     if (typeof options.limit === "number") {
       query.set("limit", String(options.limit));
     }
-    if (typeof options.offset === "number") {
-      query.set("offset", String(options.offset));
-    }
     const state = await this.request(
       `/sdk/user-environment-state?${query.toString()}`
     );
@@ -18915,25 +18948,37 @@ var Granular = class _Granular {
     }
   }
   /**
-   * Ensure a permission profile exists for a sandbox, creating it if needed.
-   * If profileName matches an existing profile name, returns its ID.
-   * Otherwise, creates a v1 source-profile file shape with an allow default.
+   * Resolve an existing permission profile by exact name or ID.
+   *
+   * `allow-all` is the sole compatibility profile that the SDK may provision
+   * automatically. Every other missing reference fails closed so a typo or
+   * untrusted role value cannot become an allow-default profile.
    */
-  async ensurePermissionProfile(sandboxId, profileName) {
-    try {
-      const profiles = await this.permissionProfiles.list(sandboxId);
-      const existing = profiles.find((p) => p.name === profileName);
-      if (existing) {
-        return existing.permissionProfileId;
-      }
-    } catch {
+  async ensurePermissionProfile(sandboxId, profileReference) {
+    const normalizedReference = typeof profileReference === "string" ? profileReference.trim() : "";
+    if (!normalizedReference) {
+      throw new Error(
+        "Permission profile references must be non-empty names or IDs."
+      );
+    }
+    const profiles = await this.permissionProfiles.list(sandboxId);
+    const existing = profiles.find(
+      (profile) => profile.name === normalizedReference || profile.permissionProfileId === normalizedReference
+    );
+    if (existing) {
+      return existing.permissionProfileId;
+    }
+    if (normalizedReference !== "allow-all") {
+      throw new Error(
+        `Permission profile "${normalizedReference}" was not found in sandbox ${sandboxId}. Provision it with granular build or granular deploy before calling openEnvironment(). Only the reserved "allow-all" profile can be created automatically.`
+      );
     }
     const created = await this.permissionProfiles.create(sandboxId, {
-      name: profileName,
+      name: normalizedReference,
       rules: {
         schemaVersion: 1,
-        name: profileName,
-        description: profileName === "allow-all" ? "Every declared action is visible unless a manifest policy denies it." : `Generated permission profile ${profileName}`,
+        name: normalizedReference,
+        description: "Every declared action is visible unless a manifest policy denies it.",
         defaults: { actionPolicy: "allow" },
         actions: []
       }
@@ -19075,10 +19120,20 @@ var Granular = class _Granular {
   get environments() {
     return {
       list: async (sandboxId) => {
-        const result = await this.request(
-          `/control/sandboxes/${sandboxId}/environments`
-        );
-        return result.items.map(normalizeEnvironmentData);
+        const environments = [];
+        let cursor = null;
+        do {
+          const query = cursor ? `?limit=100&cursor=${encodeURIComponent(cursor)}` : "";
+          const result = await this.request(
+            `/control/sandboxes/${sandboxId}/environments${query}`
+          );
+          environments.push(...result.items.map(normalizeEnvironmentData));
+          if (result.nextCursor && result.nextCursor === cursor) {
+            throw new Error("Environment pagination cursor did not advance");
+          }
+          cursor = result.nextCursor;
+        } while (cursor);
+        return environments;
       },
       get: async (environmentId) => {
         return normalizeEnvironmentData(
@@ -19288,7 +19343,6 @@ var Granular = class _Granular {
         headers: {
           Authorization: `Bearer ${this.apiKey}`,
           "Content-Type": "application/json",
-          Connection: "close",
           ...options.headers
         }
       });