@whittlelabs/sifter 0.17.0 → 0.19.0

package/bin.js

@@ -3180,6 +3180,14 @@ var require_device_code = __commonJS({
         });
         log(opts.brand.strings?.pairingDoneMessage ?? `Paired ${displayName}.`);
       }
+      const jobPools = await discoverMemberPools({
+        keepApiUrl: reg.keepApiUrl,
+        jobsApiUrl: reg.jobsApiUrl,
+        clientId: token.clientId,
+        clientSecret: token.clientSecret,
+        fetcher,
+        brand: opts.brand
+      });
       return {
         schemaVersion: 1,
         keepApiUrl: reg.keepApiUrl,
@@ -3195,9 +3203,38 @@ var require_device_code = __commonJS({
           hostname: (0, os_1.hostname)(),
           user: (0, os_1.userInfo)().username
         },
-        jobPools: token.jobPools
+        jobPools
       };
     }
+    async function discoverMemberPools(opts) {
+      const tokenUrl = `${opts.keepApiUrl.replace(/\/$/, "")}/api/agent-tokens`;
+      const tokenRes = await opts.fetcher(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          clientId: opts.clientId,
+          clientSecret: opts.clientSecret
+        })
+      });
+      (0, version_check_1.checkResponseMinVersion)({
+        response: tokenRes,
+        currentVersion: opts.brand.product.version,
+        packageName: opts.brand.product.packageName
+      });
+      const tokenJson = await readJson(tokenRes);
+      const poolsUrl = `${opts.jobsApiUrl.replace(/\/$/, "")}/api/my/pools`;
+      const poolsRes = await opts.fetcher(poolsUrl, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${tokenJson.data.token}` }
+      });
+      (0, version_check_1.checkResponseMinVersion)({
+        response: poolsRes,
+        currentVersion: opts.brand.product.version,
+        packageName: opts.brand.product.packageName
+      });
+      const poolsJson = await readJson(poolsRes);
+      return poolsJson.data.pools;
+    }
     async function startDeviceCode(opts) {
       const url = `${opts.keepApiUrl.replace(/\/$/, "")}/api/oauth/device`;
       const response = await opts.fetcher(url, {
@@ -18064,7 +18101,8 @@ var require_canonicalise = __commonJS({
       return {
         name: workflow.name,
         description: workflow.description ?? null,
-        ownerOrgId: opts.ownerOrgId,
+        ownerClass: opts.ownerClass,
+        ownerId: opts.ownerId,
         retainPublishedVersions: workflow.retain?.publishedVersions ?? null,
         ...opts.publish !== void 0 ? { publish: opts.publish } : {},
         nodes,
@@ -18226,18 +18264,28 @@ var require_seed_workflows = __commonJS({
       }
       const results = [];
       for (const workflow of opts.workflows) {
-        const ownerOrgId = opts.ownerSlugToOrgId[workflow.owner.slug];
-        if (ownerOrgId === void 0) {
-          throw new errors_1.SeedWorkflowsError(workflow.name, `seedWorkflows: owner.slug "${workflow.owner.slug}" not present in ownerSlugToOrgId map`);
+        let ownerClass;
+        let ownerId;
+        if ("service" in workflow.owner) {
+          ownerClass = "service";
+          ownerId = workflow.owner.service;
+        } else {
+          const orgId = opts.ownerSlugToOrgId[workflow.owner.orgSlug];
+          if (orgId === void 0) {
+            throw new errors_1.SeedWorkflowsError(workflow.name, `seedWorkflows: owner.orgSlug "${workflow.owner.orgSlug}" not present in ownerSlugToOrgId map`);
+          }
+          ownerClass = "org";
+          ownerId = orgId;
         }
-        const opts2 = { ownerOrgId };
+        const opts2 = { ownerClass, ownerId };
         if (opts.env !== void 0)
           opts2.env = opts.env;
         if (opts.publish !== void 0)
           opts2.publish = opts.publish;
         const body = await (0, canonicalise_1.canonicaliseWorkflow)(workflow, opts2);
         logger.info(`seeding workflow ${workflow.name}`, {
-          ownerOrgId,
+          ownerClass,
+          ownerId,
           nodes: body.nodes.length,
           transitions: body.transitions.length
         });
@@ -18511,50 +18559,20 @@ var require_client2 = __commonJS({
       constructor(config) {
         this.baseUrl = config.baseUrl.replace(/\/$/, "");
         this.headers = { "Content-Type": "application/json" };
-        if (config.serviceSecret) {
-          this.headers["X-Service-Secret"] = config.serviceSecret;
-        }
         if (config.serviceToken) {
           this.headers["Authorization"] = `Bearer ${config.serviceToken}`;
         } else if (config.accessToken) {
           this.headers["Authorization"] = `Bearer ${config.accessToken}`;
         }
       }
-      // ── Claims ──────────────────────────────────────────────────────
-      async checkClaim(subject, scope, resource) {
-        return this.request("POST", "/api/claims", {
-          subject,
-          scope,
-          resource
-        });
-      }
-      async checkClaimsBatch(subject, claims) {
-        return this.request("POST", "/api/claims/batch", {
-          subject,
-          claims
-        });
-      }
-      async getEffectivePermissions(subject, context) {
-        return this.request("POST", "/api/claims/effective", {
-          subject,
-          context
-        });
-      }
-      // ── API Key Verification ────────────────────────────────────────
-      async verifyApiKey(key) {
-        return this.request("POST", "/api/keys/claims", { key });
-      }
-      // ── Service Tokens ──────────────────────────────────────────────
-      async exchangeServiceToken(clientId, clientSecret) {
-        return this.request("POST", "/api/service-tokens", {
-          clientId,
-          clientSecret
-        });
-      }
-      async verifyServiceToken(token) {
-        return this.request("POST", "/api/service-tokens/claims", {
-          token
-        });
+      // ── Actor Tokens ────────────────────────────────────────────────
+      /**
+       * Mint a short-lived `act_` token for an end user, with this client's
+       * service identity recorded as the conduit. Requires this client to be
+       * constructed with a service token holding `keep:actor-tokens:mint`.
+       */
+      async mintActorToken(actor) {
+        return this.request("POST", "/api/actor-tokens", { actor });
       }
       // ── Identity ────────────────────────────────────────────────────
       async createAccount(email, password, name) {
@@ -18646,10 +18664,9 @@ var require_client2 = __commonJS({
         return this.request("POST", `/api/users/${request.ownerPrincipalId}/service-identities`, request);
       }
       /**
-       * Bind a role (by name) to a service identity. Pool-scoped bindings
-       * pass `scopeRefs: [{kind: 'jobPool', poolId: ...}]`. User-owned
-       * pools pass `userId` as the structural principal; team/org-owned
-       * pools pass `teamId`/`orgId`.
+       * Bind a role (by name) to a service identity, anchored to a
+       * structural principal: user-owned Sifters pass `userId`;
+       * team/org-anchored bindings pass `teamId`/`orgId`.
        *
        * Requires `keep:role-bindings:write`.
        */
@@ -21981,7 +21998,7 @@ var import_path = require("path");
 var import_promises = require("fs/promises");
 var import_yaml = __toESM(require_dist());
 var import_shuttle = __toESM(require_dist5());
-var buildVersion = true ? "0.17.0" : pkg.version;
+var buildVersion = true ? "0.19.0" : pkg.version;
 var sifterBrand = {
   product: {
     id: "sifter",