@superatomai/sdk-node 0.0.81-dsp → 0.0.82-dsp

package/dist/index.d.mts

@@ -5140,6 +5140,25 @@ interface RequestContext {
      * — see the backend's policy-gate.
      */
     policies?: SourcePolicy[];
+    /**
+     * The data sources this user may reach AT ALL, by source id.
+     *
+     * Three states, and the third is the point:
+     *   - `undefined` / `null` — no source restriction. Every configured source.
+     *   - `["mssql-1a2b"]`     — only those sources.
+     *   - `[]`                 — NOTHING. Not "everything".
+     *
+     * The empty array is what a computed-but-unprivileged lookup produces
+     * (`user.sources.map(s => s.id)` for a user with nothing assigned), so
+     * reading it as "unrestricted" would hand the least privileged user the most
+     * access. Never collapse `[]` into absent anywhere along this path.
+     *
+     * This is the ONLY control that reaches a source the SQL rewriter cannot
+     * touch: dynamodb, redis, rest_api and graphql have no dialect, so they take
+     * neither row filters nor a table allowlist. Enforced in the backend's
+     * policy-gate, independently of SA_SQL_REWRITE_MODE — it is not a rewrite.
+     */
+    allowedSources?: string[] | null;
     /** Correlates the audit log with a chat turn. */
     requestId?: string;
     /**
@@ -5173,6 +5192,7 @@ declare function runAsUser<T>(user: {
     projectId?: string;
     requestId?: string;
     policies?: SourcePolicy[];
+    allowedSources?: string[] | null;
     graphVersion?: GraphVersion;
 }, fn: () => T): T;
 /**
@@ -5231,6 +5251,22 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
  * backend/docs/SQL-AUTHORIZATION-DESIGN.md.
  */
 
+/** Everything one request's config says about what the caller may see. */
+interface ResolvedAccess {
+    policies: SourcePolicy[];
+    /** `null` means every source; `[]` means none — see `RequestContext.allowedSources`. */
+    allowedSources: string[] | null;
+}
+/**
+ * Read the whole access config — both shapes.
+ *
+ * The array form is every existing deployment and is passed straight through to
+ * `policiesFromConfig`. The object form is what sa-api mints when a customer
+ * scopes sources (`lib/sdk-access.ts`); its policies live one level down, and
+ * reading it as a single array entry would find no `rowFilters` on it and so
+ * drop EVERY row filter the customer wrote.
+ */
+declare function accessFromConfig(config: unknown): ResolvedAccess;
 /**
  * Read access policies out of the admin-authored per-user config.
  *
@@ -5241,7 +5277,7 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
  * schema (and refusing, rather than dropping) is the fix, and is not built yet.
  *
  * Accepts either a single object or an array, so one user can be scoped across
- * several sources.
+ * several sources — and the object form, whose policies sit under `policies`.
  */
 declare function policiesFromConfig(config: unknown): SourcePolicy[];
 /**
@@ -6700,4 +6736,4 @@ declare class SuperatomSDK {
     getConversationSimilarityThreshold(): number;
 }
 
-export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };
+export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };

package/dist/index.d.ts

@@ -5140,6 +5140,25 @@ interface RequestContext {
      * — see the backend's policy-gate.
      */
     policies?: SourcePolicy[];
+    /**
+     * The data sources this user may reach AT ALL, by source id.
+     *
+     * Three states, and the third is the point:
+     *   - `undefined` / `null` — no source restriction. Every configured source.
+     *   - `["mssql-1a2b"]`     — only those sources.
+     *   - `[]`                 — NOTHING. Not "everything".
+     *
+     * The empty array is what a computed-but-unprivileged lookup produces
+     * (`user.sources.map(s => s.id)` for a user with nothing assigned), so
+     * reading it as "unrestricted" would hand the least privileged user the most
+     * access. Never collapse `[]` into absent anywhere along this path.
+     *
+     * This is the ONLY control that reaches a source the SQL rewriter cannot
+     * touch: dynamodb, redis, rest_api and graphql have no dialect, so they take
+     * neither row filters nor a table allowlist. Enforced in the backend's
+     * policy-gate, independently of SA_SQL_REWRITE_MODE — it is not a rewrite.
+     */
+    allowedSources?: string[] | null;
     /** Correlates the audit log with a chat turn. */
     requestId?: string;
     /**
@@ -5173,6 +5192,7 @@ declare function runAsUser<T>(user: {
     projectId?: string;
     requestId?: string;
     policies?: SourcePolicy[];
+    allowedSources?: string[] | null;
     graphVersion?: GraphVersion;
 }, fn: () => T): T;
 /**
@@ -5231,6 +5251,22 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
  * backend/docs/SQL-AUTHORIZATION-DESIGN.md.
  */
 
+/** Everything one request's config says about what the caller may see. */
+interface ResolvedAccess {
+    policies: SourcePolicy[];
+    /** `null` means every source; `[]` means none — see `RequestContext.allowedSources`. */
+    allowedSources: string[] | null;
+}
+/**
+ * Read the whole access config — both shapes.
+ *
+ * The array form is every existing deployment and is passed straight through to
+ * `policiesFromConfig`. The object form is what sa-api mints when a customer
+ * scopes sources (`lib/sdk-access.ts`); its policies live one level down, and
+ * reading it as a single array entry would find no `rowFilters` on it and so
+ * drop EVERY row filter the customer wrote.
+ */
+declare function accessFromConfig(config: unknown): ResolvedAccess;
 /**
  * Read access policies out of the admin-authored per-user config.
  *
@@ -5241,7 +5277,7 @@ declare function isUserContext(ctx?: RequestContext | undefined): boolean;
  * schema (and refusing, rather than dropping) is the fix, and is not built yet.
  *
  * Accepts either a single object or an array, so one user can be scoped across
- * several sources.
+ * several sources — and the object form, whose policies sit under `policies`.
  */
 declare function policiesFromConfig(config: unknown): SourcePolicy[];
 /**
@@ -6700,4 +6736,4 @@ declare class SuperatomSDK {
     getConversationSimilarityThreshold(): number;
 }
 
-export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };
+export { ALL_COLUMN_KEYS, ANSWER_COMPONENT_NAMES, type AgentConfig, type AgentEvent, type AgentResponse, type AgentRunContext, type AgentRunHandlers, type AgentRunRecord, type AgentRunResult, type AgentTrigger, type AgentUsage, type AnalyticsEventType, type AnalyticsStatus, type AnswerProvider, type AnswerProviderContext, type ApplySummary, BM25L, type BM25LOptions, type BaseLLMConfig, type BuildTriggerInput, CATEGORY_KEYS, CONTEXT_CONFIG, type CapturedLog, CleanupService, type CodexSessionOptions, type CodingAgentCollectionConfig, type CodingAgentDefinition, type CodingAgentSession, type CodingAgentSessionOptions, type CodingAgentsConfig, type ColInfo, type ColType, type CollectionHandler, type CollectionOperation, type Component, type DBUIBlock, DEFAULT_AGENT_CONFIG, DEFAULT_FMT_CONFIG, type DashboardAgentCollectionConfig, type DatabaseType, type FindingCode, type Fmt, type FmtConfig, type GeneratedFile, type GraphVersion, type Harness, type HybridSearchOptions, INSTRUCTIONS_FILE, type IncomingMessage, type KbNodesQueryFilters, type KbNodesRequestPayload, LLM, type LLMUsageEntry, type LogLevel, MainAgent, type McpServerSpec, type Message, MissingRequestContextError, type ModelStrategy, NUMERIC_KEYS, type NarrationUpdate, type OutputContract, type OutputField, type OutputValidator, type PiSessionListener, type PiSessionState, type PiTranscriptEntry, type Principal, type PromptAttachment, type PromptContext, type RequestContext, type RerankedResult, type ResolvedAccess, type RowFilter, type RunAgentOptions, STORAGE_CONFIG, type ScriptComponentSpec, ScriptMatcher, type ScriptParameter, type ScriptRecipe, type ScriptRecipeMetaRow, type ScriptRecipeStore, type ScriptResult, ScriptStore, type ScriptStoreOptions, type SelectedWorkflow, type ShimDef, type ShimSummary, type ShimTarget, type SourcePolicy, type SpecToValidate, SuperatomSDK, type SuperatomSDKConfig, type T_RESPONSE, type TaskType, Thread, ThreadManager, type Tool$1 as Tool, type ToolOutputSchema, type TriggerEvent, type TriggerFireInfo, UIBlock, UILogCollector, type User, UserManager, type UsersData, type ValidationContext, type ValidationFinding, type WorkflowDescriptor, type Workspace, accessFromConfig, analyticsClient, answerCatalogForBinding, answerComponents, anthropicLLM, assertReadOnlySql, bindContext, bridgePreamble, captureContext, clearContextTokens, contextTokenCount, createCodexSession, createCodingAgentSession, dashboardConversationHistory, dataFingerprint, describeContext, describeTriggers, emitAgentEvent, extractNamedExport, formatFindingsForAgent, geminiLLM, getCodingAgent, getCodingAgentsConfig, getPiSessionState, getRequestContext, groqLLM, hybridRerank, inferColumns, isUserContext, listCodingAgents, llmUsageLogger, logger, makeFmt, mintContextToken, normalizeScriptBody, onAgentRun, onPiSessionUpdate, openaiLLM, policiesFromConfig, projectForDatasetBinding, promptLoader, queryCache, registerCodingAgentCollection, registerCodingAgents, registerDashboardAgentCollection, requireRequestContext, rerankChromaResults, rerankConversationResults, resolveContextToken, resolveScriptRecipeStore, revokeContextToken, runAsSystem, runAsUser, runCodingAgent, runScript, runWithContext, runWithMessageIdentity, startAgentTriggers, stopAgentTriggers, userPromptErrorLogger, validateComponentSpec, withCapturedContext, writeBridgeShims, writeShims };

package/dist/index.js

@@ -52,6 +52,7 @@ __export(index_exports, {
   UIBlock: () => UIBlock,
   UILogCollector: () => UILogCollector,
   UserManager: () => UserManager,
+  accessFromConfig: () => accessFromConfig,
   analyticsClient: () => analyticsClient,
   answerCatalogForBinding: () => answerCatalogForBinding,
   answerComponents: () => answerComponents,
@@ -1948,9 +1949,19 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, graphVersion } = user;
+  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
   return runWithContext(
-    { principal: { kind: "user", userId, orgId, role }, projectId, requestId, policies, ...graphVersion !== void 0 ? { graphVersion } : {} },
+    // `allowedSources` is spread in only when given, so an absent restriction
+    // stays absent rather than becoming an explicit `undefined` that a later
+    // `'allowedSources' in ctx` check would read as present.
+    {
+      principal: { kind: "user", userId, orgId, role },
+      projectId,
+      requestId,
+      policies,
+      ...allowedSources !== void 0 ? { allowedSources } : {},
+      ...graphVersion !== void 0 ? { graphVersion } : {}
+    },
     fn
   );
 }
@@ -2632,8 +2643,40 @@ function graphVersionOf(v) {
   if (v === "draft") return "draft";
   return Number.isInteger(v) && v > 0 ? v : void 0;
 }
+function scopedForm(config2) {
+  if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
+  const c = config2;
+  return "allowedSources" in c || "policies" in c ? c : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  return {
+    policies: policiesFromConfig(config2),
+    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
+  };
+}
 function policiesFromConfig(config2) {
-  const entries = Array.isArray(config2) ? config2 : [config2];
+  const raw = scopedForm(config2)?.policies ?? config2;
+  const entries = Array.isArray(raw) ? raw : [raw];
   const out = [];
   for (const entry of entries) {
     if (!entry || typeof entry !== "object") continue;
@@ -2676,12 +2719,13 @@ function policiesFromConfig(config2) {
 var warnedUntrusted = false;
 var warnedAnonymous = false;
 var warnedUnlabelled = false;
+var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const policies = verified ? policiesFromConfig(verified.config) : policiesFromConfig(message?.payload?.config);
+  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2706,6 +2750,9 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        // `?? undefined` so "no restriction" leaves the key off the context
+        // entirely; `[]` is passed through as the deny-everything it means.
+        allowedSources: allowedSources ?? void 0,
         // Only from the verified context: an unverified message has no say in which graph answers.
         graphVersion: graphVersionOf(verified.graphVersion)
       },
@@ -2720,7 +2767,7 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies }, fn);
+    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -18186,7 +18233,8 @@ function storeScriptDatasetQuery(q, ctx) {
   return queryCache.storeQuery(q.sql, { data, count });
 }
 function buildUserAccessContext(userConfig) {
-  const entries = Array.isArray(userConfig) ? userConfig : [userConfig];
+  const config2 = userConfig && !Array.isArray(userConfig) && typeof userConfig === "object" && ("policies" in userConfig || "allowedSources" in userConfig) ? userConfig.policies : userConfig;
+  const entries = Array.isArray(config2) ? config2 : [config2];
   const restrictions = [];
   const prompts = [];
   let anyRestriction = false;
@@ -25748,6 +25796,11 @@ fetch(BRIDGE + '/run-tool', {
 // have been shown to you in full, and guessing column names wastes a turn on
 // a failed query. Generated per run \u2014 do not edit.
 const BRIDGE = ${JSON.stringify(opts.bridgeUrl)};
+// Sent for the same reason ./query sends it. A schema describes the data, so
+// WHICH tables may be described is the caller's access, not a free question \u2014
+// without this the bridge cannot tell whose run this is, and a source the run
+// may not read would be described to it in full.
+const CONTEXT_TOKEN = ${JSON.stringify(opts.contextToken ?? null)};
 
 const [toolId, ...keywords] = process.argv.slice(2);
 if (!toolId || !keywords.length) {
@@ -25757,7 +25810,10 @@ if (!toolId || !keywords.length) {
 
 fetch(BRIDGE + '/schema-search', {
   method: 'POST',
-  headers: { 'content-type': 'application/json' },
+  headers: {
+    'content-type': 'application/json',
+    ...(CONTEXT_TOKEN ? { 'x-sa-context': CONTEXT_TOKEN } : {}),
+  },
   body: JSON.stringify({ toolId, keywords }),
 })
   .then(async (r) => {
@@ -30094,6 +30150,7 @@ var SuperatomSDK = class {
   UIBlock,
   UILogCollector,
   UserManager,
+  accessFromConfig,
   analyticsClient,
   answerCatalogForBinding,
   answerComponents,

package/dist/index.mjs

@@ -1837,9 +1837,19 @@ function runWithContext(ctx, fn) {
   return getStorage().run(ctx, fn);
 }
 function runAsUser(user, fn) {
-  const { userId, orgId, role, projectId, requestId, policies, graphVersion } = user;
+  const { userId, orgId, role, projectId, requestId, policies, allowedSources, graphVersion } = user;
   return runWithContext(
-    { principal: { kind: "user", userId, orgId, role }, projectId, requestId, policies, ...graphVersion !== void 0 ? { graphVersion } : {} },
+    // `allowedSources` is spread in only when given, so an absent restriction
+    // stays absent rather than becoming an explicit `undefined` that a later
+    // `'allowedSources' in ctx` check would read as present.
+    {
+      principal: { kind: "user", userId, orgId, role },
+      projectId,
+      requestId,
+      policies,
+      ...allowedSources !== void 0 ? { allowedSources } : {},
+      ...graphVersion !== void 0 ? { graphVersion } : {}
+    },
     fn
   );
 }
@@ -2521,8 +2531,40 @@ function graphVersionOf(v) {
   if (v === "draft") return "draft";
   return Number.isInteger(v) && v > 0 ? v : void 0;
 }
+function scopedForm(config2) {
+  if (!config2 || typeof config2 !== "object" || Array.isArray(config2)) return void 0;
+  const c = config2;
+  return "allowedSources" in c || "policies" in c ? c : void 0;
+}
+function allowedSourcesFrom(value) {
+  if (value === void 0 || value === null) return null;
+  if (!Array.isArray(value)) {
+    if (!warnedBadSources) {
+      warnedBadSources = true;
+      logger.warn(
+        `[RequestIdentity] "allowedSources" is ${typeof value}, not a list of source ids \u2014 treating it as NO sources rather than all of them. Fix the config: "allowedSources": ["mssql-1a2b"].`
+      );
+    }
+    return [];
+  }
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !item.trim()) continue;
+    const id = item.trim();
+    if (!out.includes(id)) out.push(id);
+  }
+  return out;
+}
+function accessFromConfig(config2) {
+  const scoped = scopedForm(config2);
+  return {
+    policies: policiesFromConfig(config2),
+    allowedSources: scoped ? allowedSourcesFrom(scoped.allowedSources) : null
+  };
+}
 function policiesFromConfig(config2) {
-  const entries = Array.isArray(config2) ? config2 : [config2];
+  const raw = scopedForm(config2)?.policies ?? config2;
+  const entries = Array.isArray(raw) ? raw : [raw];
   const out = [];
   for (const entry of entries) {
     if (!entry || typeof entry !== "object") continue;
@@ -2565,12 +2607,13 @@ function policiesFromConfig(config2) {
 var warnedUntrusted = false;
 var warnedAnonymous = false;
 var warnedUnlabelled = false;
+var warnedBadSources = false;
 var announcedVerified = false;
 var reportedIdMismatches = /* @__PURE__ */ new Set();
 function runWithMessageIdentity(message, fn) {
   const verified = message?.authContext;
   const requestId = message?.id;
-  const policies = verified ? policiesFromConfig(verified.config) : policiesFromConfig(message?.payload?.config);
+  const { policies, allowedSources } = verified ? accessFromConfig(verified.config) : accessFromConfig(message?.payload?.config);
   if (verified?.userId) {
     const claimedId = message?.payload?.userId;
     if (!announcedVerified) {
@@ -2595,6 +2638,9 @@ function runWithMessageIdentity(message, fn) {
         role: verified.role,
         requestId,
         policies,
+        // `?? undefined` so "no restriction" leaves the key off the context
+        // entirely; `[]` is passed through as the deny-everything it means.
+        allowedSources: allowedSources ?? void 0,
         // Only from the verified context: an unverified message has no say in which graph answers.
         graphVersion: graphVersionOf(verified.graphVersion)
       },
@@ -2609,7 +2655,7 @@ function runWithMessageIdentity(message, fn) {
         "[RequestIdentity] Using the client-supplied payload.userId as the principal \u2014 the relay is not stamping a verified authContext yet, so this identity is NOT trustworthy. Fine for plumbing; do not enable policy enforcement until the relay change lands."
       );
     }
-    return runAsUser({ userId: claimed, requestId, policies }, fn);
+    return runAsUser({ userId: claimed, requestId, policies, allowedSources: allowedSources ?? void 0 }, fn);
   }
   if (!warnedAnonymous) {
     warnedAnonymous = true;
@@ -18075,7 +18121,8 @@ function storeScriptDatasetQuery(q, ctx) {
   return queryCache.storeQuery(q.sql, { data, count });
 }
 function buildUserAccessContext(userConfig) {
-  const entries = Array.isArray(userConfig) ? userConfig : [userConfig];
+  const config2 = userConfig && !Array.isArray(userConfig) && typeof userConfig === "object" && ("policies" in userConfig || "allowedSources" in userConfig) ? userConfig.policies : userConfig;
+  const entries = Array.isArray(config2) ? config2 : [config2];
   const restrictions = [];
   const prompts = [];
   let anyRestriction = false;
@@ -25637,6 +25684,11 @@ fetch(BRIDGE + '/run-tool', {
 // have been shown to you in full, and guessing column names wastes a turn on
 // a failed query. Generated per run \u2014 do not edit.
 const BRIDGE = ${JSON.stringify(opts.bridgeUrl)};
+// Sent for the same reason ./query sends it. A schema describes the data, so
+// WHICH tables may be described is the caller's access, not a free question \u2014
+// without this the bridge cannot tell whose run this is, and a source the run
+// may not read would be described to it in full.
+const CONTEXT_TOKEN = ${JSON.stringify(opts.contextToken ?? null)};
 
 const [toolId, ...keywords] = process.argv.slice(2);
 if (!toolId || !keywords.length) {
@@ -25646,7 +25698,10 @@ if (!toolId || !keywords.length) {
 
 fetch(BRIDGE + '/schema-search', {
   method: 'POST',
-  headers: { 'content-type': 'application/json' },
+  headers: {
+    'content-type': 'application/json',
+    ...(CONTEXT_TOKEN ? { 'x-sa-context': CONTEXT_TOKEN } : {}),
+  },
   body: JSON.stringify({ toolId, keywords }),
 })
   .then(async (r) => {
@@ -29982,6 +30037,7 @@ export {
   UIBlock,
   UILogCollector,
   UserManager,
+  accessFromConfig,
   analyticsClient,
   answerCatalogForBinding,
   answerComponents,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superatomai/sdk-node",
-  "version": "0.0.81-dsp",
+  "version": "0.0.82-dsp",
   "description": "Node.js TypeScript SDK for Superatom",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",