@agent-native/core 0.203.2-nightly-20261007213109 → 0.204.0

package/dist/org/service-principal-policy.js

@@ -0,0 +1,272 @@
+/**
+ * Governance record for an org service principal (`svc-<name>@service.<orgId>`).
+ *
+ * A service token proves WHO is calling; this record says who is ACCOUNTABLE
+ * for the principal, whether it may run at all, and which actions it may call.
+ * Every entry point that admits a service identity (MCP admission, MCP tool
+ * dispatch, agent run start) reads it through `evaluateServicePrincipal` so
+ * suspend and the action grant are enforced in one place.
+ *
+ * Constraints that must survive future edits:
+ *
+ * 1. No row means a legacy principal minted before governance existed: it
+ *    stays active and unrestricted ("ungoverned"). Tightening it is an explicit
+ *    admin act, never a side effect of upgrading.
+ * 2. An unreadable row is NOT an absent row. A read failure resolves to
+ *    "unavailable" and callers refuse the request (503), because answering
+ *    "ungoverned" would let a suspended principal back in during an outage.
+ * 3. A grant is deny-by-default once `allowedActions` is a list: an empty list
+ *    grants nothing, and `null` is the only unrestricted value.
+ */
+import { getDbExec, withDbExec } from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
+import { parseServiceIdentityEmail } from "./service-identity.js";
+export const SERVICE_PRINCIPAL_LIFECYCLES = [
+    "active",
+    "suspended",
+    "retired",
+];
+export const SERVICE_PRINCIPAL_RISK_TIERS = ["low", "medium", "high"];
+export const MAX_SERVICE_PRINCIPAL_ACTIONS = 200;
+const SERVICE_PRINCIPAL_ACTION_PATTERN = /^[A-Za-z0-9_.:-]+\*?$/;
+export function isServicePrincipalActionPattern(value) {
+    return value.length <= 128 && SERVICE_PRINCIPAL_ACTION_PATTERN.test(value);
+}
+let _initPromise;
+export async function ensureTable() {
+    if (!_initPromise) {
+        _initPromise = ensureTableExists("service_principal_policies", `CREATE TABLE IF NOT EXISTS service_principal_policies (
+        org_id TEXT NOT NULL,
+        service_name TEXT NOT NULL,
+        owner_email TEXT,
+        team TEXT,
+        risk_tier TEXT NOT NULL DEFAULT 'medium',
+        purpose TEXT,
+        lifecycle TEXT NOT NULL DEFAULT 'active',
+        allowed_actions TEXT,
+        lifecycle_reason TEXT,
+        lifecycle_changed_by TEXT,
+        lifecycle_changed_at BIGINT,
+        created_at BIGINT,
+        updated_at BIGINT,
+        PRIMARY KEY (org_id, service_name)
+      )`)
+            .then(() => undefined)
+            .catch((error) => {
+            _initPromise = undefined;
+            throw error;
+        });
+    }
+    return _initPromise;
+}
+function numOrNull(value) {
+    if (value == null)
+        return null;
+    const n = Number(value);
+    return Number.isFinite(n) ? n : null;
+}
+function parseAllowedActions(raw) {
+    if (raw == null)
+        return null;
+    let parsed;
+    try {
+        parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+        // coercion-ok: an unparseable grant fails closed to an empty (deny-all) list, never to unrestricted.
+    }
+    catch {
+        // A stored grant we cannot parse must not widen to "unrestricted".
+        return [];
+    }
+    if (!Array.isArray(parsed) ||
+        parsed.length > MAX_SERVICE_PRINCIPAL_ACTIONS ||
+        !parsed.every((item) => typeof item === "string" && isServicePrincipalActionPattern(item))) {
+        return [];
+    }
+    return parsed;
+}
+function mapRow(r) {
+    const lifecycle = String(r.lifecycle ?? "active");
+    const riskTier = String(r.risk_tier ?? r.riskTier ?? "medium");
+    return {
+        orgId: String(r.org_id ?? r.orgId),
+        serviceName: String(r.service_name ?? r.serviceName),
+        ownerEmail: (r.owner_email ?? r.ownerEmail ?? null),
+        team: (r.team ?? null),
+        riskTier: SERVICE_PRINCIPAL_RISK_TIERS.includes(riskTier)
+            ? riskTier
+            : "high",
+        purpose: (r.purpose ?? null),
+        // An unrecognized lifecycle fails closed rather than reading as active.
+        lifecycle: SERVICE_PRINCIPAL_LIFECYCLES.includes(lifecycle)
+            ? lifecycle
+            : "suspended",
+        allowedActions: parseAllowedActions(r.allowed_actions ?? r.allowedActions ?? null),
+        lifecycleReason: (r.lifecycle_reason ?? r.lifecycleReason ?? null),
+        lifecycleChangedBy: (r.lifecycle_changed_by ??
+            r.lifecycleChangedBy ??
+            null),
+        lifecycleChangedAt: numOrNull(r.lifecycle_changed_at ?? r.lifecycleChangedAt),
+        createdAt: numOrNull(r.created_at ?? r.createdAt),
+        updatedAt: numOrNull(r.updated_at ?? r.updatedAt),
+    };
+}
+const COLUMNS = `org_id, service_name, owner_email, team, risk_tier, purpose, lifecycle, allowed_actions, lifecycle_reason, lifecycle_changed_by, lifecycle_changed_at, created_at, updated_at`;
+export function servicePrincipalLifecycleLockKey(orgId, serviceName) {
+    return `agent-native:service-principal-lifecycle:${orgId}:${serviceName}`;
+}
+export async function lockServicePrincipalLifecycle(db, orgId, serviceName) {
+    await db.execute({
+        sql: "SELECT pg_advisory_xact_lock(hashtextextended(?, 0::bigint))",
+        args: [servicePrincipalLifecycleLockKey(orgId, serviceName)],
+    });
+}
+export async function withServicePrincipalLifecycleLock(orgId, serviceName, work) {
+    await ensureTable();
+    const db = getDbExec();
+    if (!db.transaction) {
+        throw new Error("Service principal lifecycle requires transaction support");
+    }
+    return db.transaction(async (tx) => {
+        return withDbExec(tx, async () => {
+            await lockServicePrincipalLifecycle(tx, orgId, serviceName);
+            return work(tx);
+        });
+    });
+}
+/** Throws when the store cannot be read; `null` means there is no record. */
+export async function getServicePrincipalPolicy(orgId, serviceName, db = getDbExec()) {
+    await ensureTable();
+    const { rows } = await db.execute({
+        sql: `SELECT ${COLUMNS} FROM service_principal_policies WHERE org_id = ? AND service_name = ? LIMIT 1`,
+        args: [orgId, serviceName],
+    });
+    return rows[0] ? mapRow(rows[0]) : null;
+}
+export async function listServicePrincipalPolicies(orgId) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT ${COLUMNS} FROM service_principal_policies WHERE org_id = ? ORDER BY service_name`,
+        args: [orgId],
+    });
+    return rows.map(mapRow);
+}
+/**
+ * Create or update the governance fields. Fields left `undefined` keep their
+ * stored value; `null` clears one. Lifecycle changes go through
+ * `setServicePrincipalLifecycle` so they always carry an actor and a reason.
+ */
+export async function upsertServicePrincipalPolicy(orgId, serviceName, input) {
+    const now = Date.now();
+    const updatedColumns = [
+        input.ownerEmail !== undefined
+            ? "owner_email = EXCLUDED.owner_email"
+            : null,
+        input.team !== undefined ? "team = EXCLUDED.team" : null,
+        input.riskTier !== undefined ? "risk_tier = EXCLUDED.risk_tier" : null,
+        input.purpose !== undefined ? "purpose = EXCLUDED.purpose" : null,
+        input.allowedActions !== undefined
+            ? "allowed_actions = EXCLUDED.allowed_actions"
+            : null,
+        "updated_at = EXCLUDED.updated_at",
+    ].filter((column) => column !== null);
+    const allowedJson = input.allowedActions == null ? null : JSON.stringify(input.allowedActions);
+    await getDbExec().execute({
+        sql: `INSERT INTO service_principal_policies (org_id, service_name, owner_email, team, risk_tier, purpose, lifecycle, allowed_actions, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)
+          ON CONFLICT (org_id, service_name) DO UPDATE SET ${updatedColumns.join(", ")}`,
+        args: [
+            orgId,
+            serviceName,
+            input.ownerEmail ?? null,
+            input.team ?? null,
+            input.riskTier ?? "medium",
+            input.purpose ?? null,
+            allowedJson,
+            now,
+            now,
+        ],
+    });
+    const saved = await getServicePrincipalPolicy(orgId, serviceName);
+    if (!saved) {
+        throw new Error("Service principal policy was not readable after write.");
+    }
+    return saved;
+}
+export class ServicePrincipalRetiredError extends Error {
+    statusCode = 409;
+    constructor() {
+        super("A retired service principal cannot be resumed.");
+        this.name = "ServicePrincipalRetiredError";
+    }
+}
+export async function setServicePrincipalLifecycle(orgId, serviceName, lifecycle, change, db = getDbExec()) {
+    await ensureTable();
+    const now = Date.now();
+    // Upsert so a legacy principal with no record can be suspended in one step.
+    await db.execute({
+        sql: `INSERT INTO service_principal_policies (org_id, service_name, risk_tier, lifecycle, lifecycle_reason, lifecycle_changed_by, lifecycle_changed_at, created_at, updated_at) VALUES (?, ?, 'medium', ?, ?, ?, ?, ?, ?)
+          ON CONFLICT (org_id, service_name) DO UPDATE SET lifecycle = EXCLUDED.lifecycle, lifecycle_reason = EXCLUDED.lifecycle_reason, lifecycle_changed_by = EXCLUDED.lifecycle_changed_by, lifecycle_changed_at = EXCLUDED.lifecycle_changed_at, updated_at = EXCLUDED.updated_at
+          WHERE service_principal_policies.lifecycle != 'retired' OR EXCLUDED.lifecycle = 'retired'`,
+        args: [
+            orgId,
+            serviceName,
+            lifecycle,
+            change.reason ?? null,
+            change.actorEmail,
+            now,
+            now,
+            now,
+        ],
+    });
+    const saved = await getServicePrincipalPolicy(orgId, serviceName, db);
+    if (!saved) {
+        throw new Error("Service principal policy was not readable after write.");
+    }
+    if (saved.lifecycle === "retired" && lifecycle !== "retired") {
+        throw new ServicePrincipalRetiredError();
+    }
+    return saved;
+}
+/**
+ * Resolve whether a caller may run from its identity email and verified org.
+ * Non-service identities return `not-service` without touching the database,
+ * so the hot path for human callers is unchanged.
+ */
+export async function evaluateServicePrincipal(email, orgId, db = getDbExec()) {
+    const parsed = parseServiceIdentityEmail(email);
+    if (!parsed)
+        return { status: "not-service" };
+    // The email alone is not proof of the org (see service-identity.ts); require
+    // a verified org claim before reading this principal's policy.
+    if (!orgId || orgId !== parsed.orgId)
+        return { status: "org-mismatch" };
+    try {
+        const policy = await getServicePrincipalPolicy(parsed.orgId, parsed.serviceName, db);
+        if (!policy) {
+            return {
+                status: "ungoverned",
+                orgId: parsed.orgId,
+                serviceName: parsed.serviceName,
+            };
+        }
+        return policy.lifecycle === "active"
+            ? { status: "active", policy }
+            : { status: policy.lifecycle, policy };
+    }
+    catch (error) {
+        console.error("[service-principal] Policy lookup failed:", error);
+        return { status: "unavailable" };
+    }
+}
+/** Whether the principal may call `actionName`. `null` grants everything. */
+export function isActionGranted(allowedActions, actionName) {
+    if (allowedActions === null)
+        return true;
+    if (!allowedActions.every(isServicePrincipalActionPattern))
+        return false;
+    return allowedActions.some((pattern) => pattern.endsWith("*")
+        ? actionName.startsWith(pattern.slice(0, -1))
+        : pattern === actionName);
+}
+/** Message returned to a refused caller; never echoes the stored reason. */
+export const SERVICE_PRINCIPAL_SUSPENDED_MESSAGE = "This service principal is suspended or retired. Ask an organization admin to resume it.";

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    id?: undefined;
-    message?: undefined;
     deleted?: undefined;
+    message?: undefined;
     found?: undefined;
     providers: {
         id: string;
@@ -91,20 +90,21 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     count: number;
     provider?: undefined;
     registered?: undefined;
+    id?: undefined;
     label?: undefined;
 } | {
-    id?: undefined;
-    message?: undefined;
     deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
+    id?: undefined;
     label?: undefined;
 } | {
-    message?: undefined;
     deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,8 +311,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        provider?: undefined;
         id?: undefined;
+        deleted?: undefined;
+        provider?: undefined;
+        message?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -324,46 +326,44 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
         id?: undefined;
-        count?: undefined;
+        deleted?: undefined;
+        message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        deleted?: undefined;
         provider?: undefined;
-        count?: undefined;
+        message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
         provider?: undefined;
-        count?: undefined;
+        message?: undefined;
         found?: undefined;
         providers?: undefined;
+        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        deleted?: undefined;
         provider?: undefined;
-        count?: undefined;
         found?: undefined;
         providers?: undefined;
-        deleted?: undefined;
+        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/scripts/dev/index.js

@@ -2,6 +2,7 @@ import { createCodingToolRegistry } from "../../coding-tools/index.js";
 import { getRequestRunContext } from "../../server/request-context.js";
 import { normalizeDatabaseToolsMode, } from "../db/tool-mode.js";
 import { dbExecToolParameters } from "../db/tool-schemas.js";
+import { serializeCliArgs } from "../parse-args.js";
 import { tool as listFilesTool, run as listFilesRun } from "./list-files.js";
 import { tool as readFileTool, run as readFileRun } from "./read-file.js";
 import { tool as searchFilesTool, run as searchFilesRun, } from "./search-files.js";
@@ -12,14 +13,7 @@ function wrapCliScript(tool, cliDefault, opts) {
         tool,
         ...(opts?.readOnly ? { readOnly: true } : {}),
         run: async (args) => {
-            const cliArgs = [];
-            for (const [k, v] of Object.entries(args)) {
-                const raw = v;
-                const value = raw != null && typeof raw === "object"
-                    ? JSON.stringify(raw)
-                    : String(raw);
-                cliArgs.push(`--${k}`, value);
-            }
+            const cliArgs = serializeCliArgs(args);
             const logs = [];
             const origLog = console.log;
             console.log = (...a) => {

package/dist/scripts/parse-args.d.ts

@@ -1,2 +1,9 @@
 export declare function parseArgs(args: string[]): Record<string, string>;
+export declare function serializeCliArgs(args: Record<string, unknown>): string[];
+type NormalizeShellArgsOptions = {
+    backslashEscapes?: boolean;
+    splitAllWhitespace?: boolean;
+};
+export declare function normalizeShellArgs(input: string, options?: NormalizeShellArgsOptions): string[];
 export declare function camelCaseArgs(args: Record<string, string>): Record<string, string>;
+export {};

package/dist/scripts/parse-args.js

@@ -23,6 +23,82 @@ export function parseArgs(args) {
     }
     return result;
 }
+export function serializeCliArgs(args) {
+    return Object.entries(args).flatMap(([key, raw]) => {
+        const value = raw != null && typeof raw === "object"
+            ? JSON.stringify(raw)
+            : String(raw);
+        return value.startsWith("--") ? [`--${key}=${value}`] : [`--${key}`, value];
+    });
+}
+export function normalizeShellArgs(input, options = {}) {
+    const tokens = [];
+    let current = "";
+    let inDouble = false;
+    let inSingle = false;
+    let wasQuoted = false;
+    let escape = false;
+    const pushToken = () => {
+        tokens.push({ value: current, quoted: wasQuoted });
+        current = "";
+        wasQuoted = false;
+    };
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (escape) {
+            current += ch;
+            escape = false;
+            continue;
+        }
+        if (options.backslashEscapes && ch === "\\") {
+            if (inSingle) {
+                current += ch;
+            }
+            else {
+                escape = true;
+            }
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            wasQuoted = true;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            wasQuoted = true;
+            continue;
+        }
+        if ((options.splitAllWhitespace
+            ? /\s/.test(ch)
+            : ch === " " || ch === "\t") &&
+            !inSingle &&
+            !inDouble) {
+            if (current.length > 0 || wasQuoted)
+                pushToken();
+            continue;
+        }
+        current += ch;
+    }
+    if (current.length > 0 || wasQuoted)
+        pushToken();
+    const normalized = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        const next = tokens[i + 1];
+        if (token.value.startsWith("--") &&
+            !token.value.includes("=") &&
+            next?.quoted &&
+            next.value.startsWith("--")) {
+            normalized.push(`${token.value}=${next.value}`);
+            i++;
+        }
+        else {
+            normalized.push(token.value);
+        }
+    }
+    return normalized;
+}
 export function camelCaseArgs(args) {
     const result = {};
     for (const [key, value] of Object.entries(args)) {

package/dist/scripts/utils.d.ts

@@ -1,6 +1,6 @@
 export { findWorkspaceRoot } from "./workspace-root.js";
 export { fail, type FailOptions } from "../action.js";
-export { parseArgs, camelCaseArgs } from "./parse-args.js";
+export { parseArgs, serializeCliArgs, camelCaseArgs } from "./parse-args.js";
 export declare function loadEnv(envPath?: string): void;
 export declare function isValidPath(p: string): boolean;
 export declare function isValidProjectPath(project: string): boolean;

package/dist/scripts/utils.js

@@ -4,7 +4,7 @@ import dotenv from "dotenv";
 import { findWorkspaceRoot } from "./workspace-root.js";
 export { findWorkspaceRoot } from "./workspace-root.js";
 export { fail } from "../action.js";
-export { parseArgs, camelCaseArgs } from "./parse-args.js";
+export { parseArgs, serializeCliArgs, camelCaseArgs } from "./parse-args.js";
 export function loadEnv(envPath) {
     const appEnv = envPath ?? path.join(process.cwd(), ".env");
     const shellKeys = new Set(Object.keys(process.env));

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -1,6 +1,7 @@
 import nodePath from "node:path";
 import "../authorization/check-action.js";
 import { CORE_ACTION_GROUPS } from "../framework-tools.js";
+import { normalizeShellArgs, serializeCliArgs } from "../scripts/parse-args.js";
 import { captureCliOutput } from "./cli-capture.js";
 let _fs;
 async function getFs() {
@@ -54,39 +55,6 @@ export function mergePackageActions(registry) {
         registry[name] = entry;
     }
 }
-function splitShellArgs(input) {
-    const tokens = [];
-    let current = "";
-    let inDouble = false;
-    let inSingle = false;
-    let wasQuoted = false;
-    for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === '"' && !inSingle) {
-            inDouble = !inDouble;
-            wasQuoted = true;
-            continue;
-        }
-        if (ch === "'" && !inDouble) {
-            inSingle = !inSingle;
-            wasQuoted = true;
-            continue;
-        }
-        if ((ch === " " || ch === "\t") && !inDouble && !inSingle) {
-            if (current.length > 0 || wasQuoted) {
-                tokens.push(current);
-            }
-            current = "";
-            wasQuoted = false;
-            continue;
-        }
-        current += ch;
-    }
-    if (current.length > 0 || wasQuoted) {
-        tokens.push(current);
-    }
-    return tokens;
-}
 function wrapDefaultExport(name, defaultFn) {
     const tool = {
         description: `Run the "${name}" action. Pass arguments as key-value pairs.`,
@@ -103,15 +71,9 @@ function wrapDefaultExport(name, defaultFn) {
     return {
         tool,
         run: async (args) => {
-            const cliArgs = [];
-            if (args.args && Object.keys(args).length === 1) {
-                cliArgs.push(...splitShellArgs(args.args));
-            }
-            else {
-                for (const [k, v] of Object.entries(args)) {
-                    cliArgs.push(`--${k}`, v);
-                }
-            }
+            const cliArgs = args.args && Object.keys(args).length === 1
+                ? normalizeShellArgs(args.args)
+                : serializeCliArgs(args);
             return captureCliOutput(() => defaultFn(cliArgs));
         },
     };
@@ -772,6 +734,10 @@ export async function mergeCoreSharingActions(registry) {
             "export-audit-events",
             () => import("../audit/actions/export-audit-events.js"),
         ],
+        [
+            "export-audit-ocsf",
+            () => import("../audit/actions/export-audit-ocsf.js"),
+        ],
         [
             "export-resource-pack",
             () => import("../resources/actions/export-resource-pack.js"),
@@ -908,6 +874,14 @@ export async function mergeCoreSharingActions(registry) {
             "revoke-org-service-token",
             () => import("../mcp/actions/revoke-org-service-token.js"),
         ],
+        [
+            "set-service-principal-policy",
+            () => import("../mcp/actions/set-service-principal-policy.js"),
+        ],
+        [
+            "set-service-principal-lifecycle",
+            () => import("../mcp/actions/set-service-principal-lifecycle.js"),
+        ],
         ["list-mcp-tools", () => import("../mcp/actions/list-mcp-tools.js")],
         ["call-mcp-tool", () => import("../mcp/actions/call-mcp-tool.js")],
     ];