orkestrator 2.33.0-beta → 2.34.1-beta

package/dist/client.js

@@ -6789,6 +6789,22 @@ var PUBLIC_ACTIONS = {
     milestone: "D",
     summary: "Delete a scheduled job and its history."
   },
+  "permission.rule.list": {
+    version: 1,
+    mutation: false,
+    effects: [],
+    observation: "immediate",
+    milestone: "D",
+    summary: "List this node's Orkestrator permission rules with their scope, last use and use count."
+  },
+  "permission.rule.remove": {
+    version: 1,
+    mutation: true,
+    effects: ["metadata"],
+    observation: "receipt",
+    milestone: "D",
+    summary: "Remove an Orkestrator permission rule; matching requests ask again from the next one."
+  },
   "run.get": {
     version: 1,
     mutation: false,
@@ -7714,7 +7730,7 @@ import path4 from "path";
 // ../../apps/backend/package.json
 var package_default = {
   name: "@orkestrator/backend",
-  version: "2.33.0-beta",
+  version: "2.34.1-beta",
   private: true,
   type: "module",
   exports: {
@@ -7728,7 +7744,7 @@ var package_default = {
     "start:web": "bun dist/main.js --fallback-host 127.0.0.1",
     "start:web-public": "bun dist/main.js --tailscale-serve --allowed-origins https://orkestrator.dev,https://www.orkestrator.dev",
     test: "bun test --preload ../../tests/setup-node.ts src tests --parallel",
-    "test:workspace": "bun test --preload ../../tests/setup-node.ts src tests --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} $ORKESTRATOR_BACKEND_TEST_IGNORE --parallel=${ORKESTRATOR_BACKEND_TEST_WORKERS:-${ORKESTRATOR_TEST_WORKERS:-2}}",
+    "test:workspace": "bun --no-env-file ../../scripts/bun-test-tier.ts apps/backend src tests -- --preload ../../tests/setup-node.ts --only-failures ${ORKESTRATOR_TEST_TIMINGS_DIR:+--timings=$ORKESTRATOR_TEST_TIMINGS_DIR/backend.json --update-timings} --parallel=${ORKESTRATOR_BACKEND_TEST_WORKERS:-${ORKESTRATOR_TEST_WORKERS:-2}}",
     typecheck: "bun check -p tsconfig.json && bun check -p tsconfig.test.json"
   },
   dependencies: {
@@ -15208,6 +15224,72 @@ function terminalQuestions(input, output, onInterrupt) {
   };
 }
 
+// src/client/commands/permissions.ts
+function when(epochMs) {
+  return epochMs === undefined ? "-" : new Date(epochMs).toISOString();
+}
+var permissionCommands = [
+  {
+    path: ["permissions", "rules", "list"],
+    action: "permission.rule.list",
+    summary: "List this node's Orkestrator permission rules, their scope, last use and use count.",
+    positionals: [],
+    options: [
+      {
+        name: "project",
+        kind: "string",
+        valueName: "PROJECT_ID",
+        description: "Only rules of this project."
+      }
+    ],
+    idOutput: "rule IDs",
+    async run(context, parsed) {
+      const session = await context.session();
+      const project = parsed.options.project;
+      const list = await session.read("permission.rule.list", project !== undefined ? { projectId: project } : {});
+      return {
+        action: "permission.rule.list",
+        result: list,
+        connection: session.identity,
+        ids: list.rules.map((rule) => rule.id),
+        human: table(["ID", "KIND", "PATTERN", "AGENT", "SCOPE", "USES", "LAST USED", "EXPIRES"], list.rules.map((rule) => [
+          rule.id,
+          rule.kind,
+          rule.pattern,
+          rule.provider,
+          rule.scope === "environment" ? `environment ${rule.environmentId}` : "project",
+          String(rule.useCount),
+          when(rule.lastUsedAt),
+          when(rule.expiresAt)
+        ]))
+      };
+    }
+  },
+  {
+    path: ["permissions", "rules", "remove"],
+    action: "permission.rule.remove",
+    summary: "Remove a permission rule; matching requests ask again from the next one.",
+    positionals: [
+      { name: "rule", required: true, description: "Rule ID, from `permissions rules list`." }
+    ],
+    options: [REQUEST_ID_OPTION],
+    inputFields: { rule: "ruleId" },
+    idOutput: "rule ID",
+    async run(context, parsed) {
+      const { session, result, receipt, warnings } = await submit(context, "permission.rule.remove", { ruleId: parsed.positionals.rule }, parsed.options);
+      return {
+        action: "permission.rule.remove",
+        result,
+        receipt,
+        warnings,
+        connection: session.identity,
+        ids: [String(parsed.positionals.rule)],
+        human: keyValues(Object.entries(result))
+      };
+    }
+  }
+];
+
 // src/client/main.ts
 var CLIENT_COMMANDS = [
   ...connectionCommands,
@@ -15220,6 +15302,7 @@ var CLIENT_COMMANDS = [
   ...ticketCommands,
   ...mailCommands,
   ...scheduleCommands,
+  ...permissionCommands,
   ...runCommands,
   ...toolchainCommands,
   ...hostCommands,