@agentic-kit/pi 0.2.0

package/esm/tools/templates.js

@@ -0,0 +1,337 @@
+import { filterInternalPolicies } from '@agentic-kit/harness';
+import { z } from 'zod';
+import { resolveProjectContext } from '../context';
+import { toolSchema } from '../tool-schema';
+// A stored blueprint field's `type` is an expanded object (`{ name: 'text' }`),
+// not the bare string the agent passes to provision_blueprint. Flatten it to the
+// type name so the renderer gets a string, never an object (which React can't
+// render as a child).
+function fieldTypeName(raw) {
+    if (typeof raw === 'string')
+        return raw;
+    if (raw && typeof raw === 'object' && typeof raw.name === 'string') {
+        return raw.name;
+    }
+    return '';
+}
+// A template's definition is a stored blueprint (see BlueprintDefinitionSchema):
+// { tables: [{ table_name, fields, policies }], relations: [{ source_table, … }] }.
+// Parse it into the same table shape provision_blueprint surfaces so the renderer
+// can reuse TableCard. Defensive throughout — it's untyped JSON from the catalog.
+function parseTemplateTables(definition) {
+    if (!definition || typeof definition !== 'object')
+        return [];
+    const def = definition;
+    const tables = Array.isArray(def.tables) ? def.tables : [];
+    const relations = Array.isArray(def.relations) ? def.relations : [];
+    return tables.map((raw) => {
+        const table = raw;
+        const fields = Array.isArray(table.fields) ? table.fields : [];
+        const policies = Array.isArray(table.policies) ? table.policies : [];
+        return {
+            name: table.table_name ?? '',
+            fields: fields.map((rawField) => {
+                const field = rawField;
+                return {
+                    name: field.name ?? '',
+                    type: fieldTypeName(field.type),
+                    isRequired: field.is_required ?? false,
+                    defaultValue: typeof field.default === 'string' ? field.default : null,
+                };
+            }),
+            policies: filterInternalPolicies(policies.map((policy) => policy.$type ?? '').filter(Boolean)),
+            relationCount: relations.filter((relation) => relation.source_table === table.table_name).length,
+        };
+    });
+}
+function formatTemplatesText(templates) {
+    if (templates.length === 0)
+        return 'No blueprint templates available.';
+    const lines = [`Available blueprint templates (${templates.length}):`];
+    for (const template of templates) {
+        const cats = template.categories.length ? ` [${template.categories.join(', ')}]` : '';
+        lines.push(`  ${template.displayName} — ${template.tables.length} tables${cats}`);
+        for (const table of template.tables) {
+            lines.push(`    - ${table.name} (${table.fields.length} field${table.fields.length === 1 ? '' : 's'})`);
+        }
+    }
+    return lines.join('\n');
+}
+// The latest project blueprint (or a named one) — the definition source for
+// create_template, and for the confirm preview of the tables it will template.
+// A blueprintName is a best-effort hint: if it matches nothing (the agent often
+// guesses casing/wording), fall back to the most recent blueprint so the confirm
+// still previews real tables and execute templates the same one it previewed.
+async function fetchLatestBlueprint(context, blueprintName) {
+    const found = await context.modules.blueprint
+        .findMany({
+        select: { displayName: true, definition: true },
+        where: {
+            databaseId: { equalTo: context.databaseId },
+            ...(blueprintName ? { displayName: { equalTo: blueprintName } } : {}),
+        },
+        orderBy: ['CREATED_AT_DESC'],
+        first: 1,
+    })
+        .unwrap();
+    return found.blueprints?.nodes?.[0];
+}
+async function findProjectBlueprint(context, blueprintName) {
+    let node = await fetchLatestBlueprint(context, blueprintName);
+    if (!node && blueprintName)
+        node = await fetchLatestBlueprint(context, undefined);
+    return node?.definition ? { displayName: node.displayName ?? '', definition: node.definition } : null;
+}
+// The create_template confirm preview — the source blueprint's name and its
+// tables, parsed into the shape the renderer's TableCard reuses. Best-effort: any
+// failure yields no tables rather than blocking the confirm.
+export async function createTemplatePreviewTables(context, blueprintName) {
+    try {
+        const blueprint = await findProjectBlueprint(context, blueprintName);
+        if (!blueprint)
+            return { blueprintName: '', tables: [] };
+        return {
+            blueprintName: blueprint.displayName,
+            tables: parseTemplateTables(blueprint.definition),
+        };
+    }
+    catch (err) {
+        console.warn('[db-tools] create_template preview lookup failed:', err);
+        return { blueprintName: '', tables: [] };
+    }
+}
+async function resolveTemplateId(client, displayName) {
+    const result = await client.blueprintTemplate
+        .findMany({
+        select: { id: true, displayName: true },
+        where: { displayName: { equalTo: displayName } },
+        first: 1,
+    })
+        .unwrap();
+    const template = result.blueprintTemplates?.nodes?.[0];
+    if (!template?.id)
+        throw new Error(`Template "${displayName}" not found`);
+    return template.id;
+}
+function done(success, message) {
+    return { content: [{ type: 'text', text: message }], details: { success, message } };
+}
+// ── list_templates ────────────────────────────────────────────────────────
+const ListTemplatesZod = z.object({});
+const ListTemplatesSchema = toolSchema(ListTemplatesZod);
+export const listTemplatesTool = {
+    name: 'list_templates',
+    label: 'List templates',
+    description: 'List the blueprint templates available to provision into the project database (display name, description, categories, table count). Read-only — these are a global catalog, not the project schema.',
+    promptSnippet: 'list_templates: list the available blueprint templates to apply. Read-only — call before apply_template.',
+    parameters: ListTemplatesSchema,
+    async execute(_id, _params, _signal, _onUpdate, ctx) {
+        const resolved = await resolveProjectContext(ctx.cwd);
+        if (!resolved.context) {
+            return { content: [{ type: 'text', text: resolved.reason }], details: { templates: [] } };
+        }
+        const result = await resolved.context.modules.blueprintTemplate
+            .findMany({
+            select: {
+                displayName: true,
+                description: true,
+                categories: true,
+                definition: true,
+            },
+            orderBy: ['NAME_ASC'],
+        })
+            .execute();
+        if (!result.ok) {
+            const message = result.errors.map((e) => e.message).join('; ');
+            return {
+                content: [{ type: 'text', text: `Failed to read templates: ${message}` }],
+                details: { templates: [] },
+            };
+        }
+        const templates = (result.data.blueprintTemplates?.nodes ?? []).map((template) => ({
+            displayName: template.displayName ?? '',
+            description: template.description ?? null,
+            categories: Array.isArray(template.categories) ? template.categories : [],
+            tables: parseTemplateTables(template.definition),
+        }));
+        return {
+            content: [{ type: 'text', text: formatTemplatesText(templates) }],
+            details: { templates },
+        };
+    },
+};
+// ── create_template ───────────────────────────────────────────────────────
+const CreateTemplateZod = z.object({
+    displayName: z.string().describe('Display name for the new blueprint template'),
+    blueprintName: z
+        .string()
+        .describe('Display name of an existing project blueprint to save as the template. Defaults to the most recently provisioned blueprint.')
+        .optional(),
+    description: z.string().describe('Description shown in the template catalog').optional(),
+    categories: z
+        .array(z.string())
+        .describe('Categories for catalog grouping and discovery')
+        .optional(),
+});
+const CreateTemplateSchema = toolSchema(CreateTemplateZod);
+export const createTemplateTool = {
+    name: 'create_template',
+    label: 'Create template',
+    description: 'Save an existing project blueprint into the global template catalog as a reusable blueprint template. Defaults to the most recently provisioned blueprint; pass blueprintName to pick a specific one by display name. Gated.',
+    promptSnippet: 'create_template: save a project blueprint to the reusable template catalog. Gated.',
+    parameters: CreateTemplateSchema,
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+        const resolved = await resolveProjectContext(ctx.cwd);
+        if (!resolved.context)
+            return done(false, resolved.reason);
+        const { modules, ownerId } = resolved.context;
+        if (!ownerId)
+            return done(false, 'Not authenticated (missing OWNER_ID in .env).');
+        try {
+            const blueprint = await findProjectBlueprint(resolved.context, params.blueprintName);
+            if (!blueprint) {
+                const which = params.blueprintName ? `"${params.blueprintName}"` : 'any blueprint';
+                return done(false, `No project blueprint found (${which}). Provision a blueprint first.`);
+            }
+            const base = params.displayName.toLowerCase().replace(/\s+/g, '_');
+            await modules.blueprintTemplate
+                .create({
+                data: {
+                    ownerId,
+                    name: `${base}_${Date.now()}`,
+                    displayName: params.displayName,
+                    description: params.description,
+                    categories: params.categories,
+                    definition: blueprint.definition,
+                },
+                select: { id: true, displayName: true },
+            })
+                .unwrap();
+            const message = `Created template "${params.displayName}"`;
+            return {
+                content: [{ type: 'text', text: message }],
+                details: {
+                    success: true,
+                    message,
+                    displayName: params.displayName,
+                    blueprintName: blueprint.displayName,
+                    tables: parseTemplateTables(blueprint.definition),
+                },
+            };
+        }
+        catch (err) {
+            return done(false, err instanceof Error ? err.message : 'Failed to create template');
+        }
+    },
+};
+// ── apply_template ────────────────────────────────────────────────────────
+const ApplyTemplateZod = z.object({
+    templateName: z.string().describe('The display name of the blueprint template to apply'),
+    nameOverride: z
+        .string()
+        .describe('Optional name override for the created blueprint (snake_case). Defaults to template name.')
+        .optional(),
+});
+const ApplyTemplateSchema = toolSchema(ApplyTemplateZod);
+export const applyTemplateTool = {
+    name: 'apply_template',
+    label: 'Apply template',
+    description: 'Apply an existing blueprint template to the project database, creating its tables. Use the template display name (from list_templates).',
+    promptSnippet: 'apply_template: provision a saved blueprint template by display name. Gated.',
+    parameters: ApplyTemplateSchema,
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+        const resolved = await resolveProjectContext(ctx.cwd);
+        if (!resolved.context)
+            return done(false, resolved.reason);
+        const { modules, databaseId, schemaId, ownerId } = resolved.context;
+        if (!ownerId)
+            return done(false, 'Not authenticated (missing OWNER_ID in .env).');
+        try {
+            const templateId = await resolveTemplateId(modules, params.templateName);
+            const base = params.nameOverride ?? params.templateName.toLowerCase().replace(/\s+/g, '_');
+            const nameOverride = `${base}_${Date.now()}`;
+            const copyResult = await modules.mutation
+                .copyTemplateToBlueprint({ input: { templateId, databaseId, ownerId, nameOverride } }, { select: { result: true } })
+                .unwrap();
+            const blueprintId = copyResult.copyTemplateToBlueprint?.result;
+            if (!blueprintId)
+                throw new Error('Failed to copy template');
+            const constructResult = await modules.mutation
+                .constructBlueprint({ input: { blueprintId, schemaId } }, { select: { result: true } })
+                .unwrap();
+            const refMap = constructResult.constructBlueprint?.result;
+            if (!refMap)
+                return done(false, `Construction failed for template "${params.templateName}"`);
+            const createdCount = Object.keys(refMap).length;
+            return done(true, `Applied template "${params.templateName}" — created ${createdCount} table${createdCount === 1 ? '' : 's'}`);
+        }
+        catch (err) {
+            return done(false, err instanceof Error ? err.message : 'Failed to apply template');
+        }
+    },
+};
+// ── update_template ───────────────────────────────────────────────────────
+const UpdateTemplateZod = z.object({
+    templateName: z.string().describe('The display name of the blueprint template to update'),
+    patch: z.object({
+        displayName: z.string().describe('New display name').optional(),
+        description: z.string().describe('New description').optional(),
+        categories: z.array(z.string()).describe('New categories').optional(),
+        tags: z.array(z.string()).describe('New tags').optional(),
+        visibility: z.enum(['private', 'public']).describe('New visibility').optional(),
+    }),
+});
+const UpdateTemplateSchema = toolSchema(UpdateTemplateZod);
+export const updateTemplateTool = {
+    name: 'update_template',
+    label: 'Update template',
+    description: 'Update a blueprint template’s metadata (display name, description, categories, tags, visibility).',
+    promptSnippet: 'update_template: edit a saved template’s metadata by display name. Gated.',
+    parameters: UpdateTemplateSchema,
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+        const resolved = await resolveProjectContext(ctx.cwd);
+        if (!resolved.context)
+            return done(false, resolved.reason);
+        try {
+            const templateId = await resolveTemplateId(resolved.context.modules, params.templateName);
+            await resolved.context.modules.blueprintTemplate
+                .update({
+                where: { id: templateId },
+                data: params.patch,
+                select: { id: true, displayName: true },
+            })
+                .unwrap();
+            return done(true, `Updated template "${params.templateName}"`);
+        }
+        catch (err) {
+            return done(false, err instanceof Error ? err.message : 'Failed to update template');
+        }
+    },
+};
+// ── delete_template ───────────────────────────────────────────────────────
+const DeleteTemplateZod = z.object({
+    templateName: z.string().describe('The display name of the blueprint template to delete'),
+});
+const DeleteTemplateSchema = toolSchema(DeleteTemplateZod);
+export const deleteTemplateTool = {
+    name: 'delete_template',
+    label: 'Delete template',
+    description: 'Permanently delete a blueprint template by its display name.',
+    promptSnippet: 'delete_template: remove a saved template by display name. Destructive — gated.',
+    parameters: DeleteTemplateSchema,
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+        const resolved = await resolveProjectContext(ctx.cwd);
+        if (!resolved.context)
+            return done(false, resolved.reason);
+        try {
+            const templateId = await resolveTemplateId(resolved.context.modules, params.templateName);
+            await resolved.context.modules.blueprintTemplate
+                .delete({ where: { id: templateId }, select: { id: true } })
+                .unwrap();
+            return done(true, `Deleted template "${params.templateName}"`);
+        }
+        catch (err) {
+            return done(false, err instanceof Error ? err.message : 'Failed to delete template');
+        }
+    },
+};

package/host.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Host contract for the pi-hosted Constructive tools.
+ *
+ * The typed db tools were extracted from Constructive Desktop, where they read
+ * an Electron-side `runtime` singleton (account store, backend config, data-auth
+ * broker, preview token). Hosts now inject the same surface here once at
+ * startup (`configureHost`); the tool modules stay module-level `ToolDefinition`
+ * consts and read it lazily via `getHost()`.
+ */
+export type HostAccount = {
+    userId: string;
+    accessToken: string;
+    apiKey?: string;
+};
+export type HostBackendConfig = {
+    apiEndpoint?: string;
+    modulesEndpoint?: string;
+};
+export type ActiveDataToken = {
+    token: string;
+    userId?: string;
+    expiresAt: number;
+    origin?: string;
+};
+/**
+ * Optional data-plane token broker: remembers per-database end-user tokens
+ * across tool calls and invalidates declined/expired ones. Hosts without a
+ * broker fall back to the preview-token harvest on every call.
+ */
+export interface DataAuthBroker {
+    getActiveToken(databaseId: string): ActiveDataToken | undefined | null;
+    isInvalidToken(databaseId: string, token: string): boolean;
+    adoptToken(databaseId: string, token: ActiveDataToken): void;
+}
+/** Token harvested from the host's app preview (end-user sign-in). */
+export type PreviewToken = {
+    accessToken: string;
+    accessTokenExpiresAt?: string;
+    userId?: string;
+};
+export interface PiToolsHost {
+    /** Signed-in platform account, or null/undefined when signed out. */
+    account(): HostAccount | null | undefined;
+    /** Host-configured backend endpoints (env-aware). */
+    backendConfig(): HostBackendConfig | null | undefined;
+    /** Optional data-plane token broker (see DataAuthBroker). */
+    dataAuthBroker?: DataAuthBroker;
+    /** Harvest an end-user token from the host's app preview, if it has one. */
+    previewToken?(): Promise<PreviewToken | null>;
+    /** Treat tokens expiring within this window as already expired. Default 30s. */
+    dataTokenSkewMs?: number;
+}
+export declare const DEFAULT_DATA_TOKEN_SKEW_MS = 30000;
+export declare function configureHost(host: PiToolsHost): void;
+export declare function getHost(): PiToolsHost;

package/host.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Host contract for the pi-hosted Constructive tools.
+ *
+ * The typed db tools were extracted from Constructive Desktop, where they read
+ * an Electron-side `runtime` singleton (account store, backend config, data-auth
+ * broker, preview token). Hosts now inject the same surface here once at
+ * startup (`configureHost`); the tool modules stay module-level `ToolDefinition`
+ * consts and read it lazily via `getHost()`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_DATA_TOKEN_SKEW_MS = void 0;
+exports.configureHost = configureHost;
+exports.getHost = getHost;
+exports.DEFAULT_DATA_TOKEN_SKEW_MS = 30_000;
+let currentHost = null;
+function configureHost(host) {
+    currentHost = host;
+}
+function getHost() {
+    if (!currentHost) {
+        throw new Error('@agentic-kit/pi host not configured. Call configureHost() (or createDbTools(host)) before using the db tools.');
+    }
+    return currentHost;
+}

package/index.d.ts

@@ -0,0 +1,11 @@
+import type { ExtensionFactory } from '@earendil-works/pi-coding-agent';
+import { type PiToolsHost } from './host';
+export declare const dbTools: ExtensionFactory;
+/** Configure the host and get the extension in one call. */
+export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
+export { type ConfirmGate, type ConfirmGateDeps, createConfirmGate } from './confirm-gate';
+export { type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
+export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type PiToolsHost, type PreviewToken, } from './host';
+export { toolSchema } from './tool-schema';
+export { createTemplatePreviewTables } from './tools/templates';
+export default dbTools;

package/index.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTemplatePreviewTables = exports.toolSchema = exports.getHost = exports.configureHost = exports.resolveProjectContext = exports.resolveDataToken = exports.createConfirmGate = exports.dbTools = void 0;
+exports.createDbTools = createDbTools;
+const confirm_gate_1 = require("./confirm-gate");
+const context_1 = require("./context");
+const host_1 = require("./host");
+const add_policies_1 = require("./tools/add-policies");
+const add_records_1 = require("./tools/add-records");
+const add_relation_1 = require("./tools/add-relation");
+const describe_schema_1 = require("./tools/describe-schema");
+const mutations_1 = require("./tools/mutations");
+const provision_blueprint_1 = require("./tools/provision-blueprint");
+const provision_database_1 = require("./tools/provision-database");
+const run_codegen_1 = require("./tools/run-codegen");
+const templates_1 = require("./tools/templates");
+const dbTools = (pi) => {
+    pi.registerTool(provision_database_1.provisionDatabaseTool);
+    pi.registerTool(describe_schema_1.describeSchemaTool);
+    pi.registerTool(templates_1.listTemplatesTool);
+    pi.registerTool(provision_blueprint_1.provisionBlueprintTool);
+    pi.registerTool(add_relation_1.addRelationTool);
+    pi.registerTool(mutations_1.deleteTableTool);
+    pi.registerTool(mutations_1.createFieldTool);
+    pi.registerTool(mutations_1.updateFieldTool);
+    pi.registerTool(mutations_1.deleteFieldTool);
+    pi.registerTool(add_policies_1.addPoliciesTool);
+    pi.registerTool(templates_1.applyTemplateTool);
+    pi.registerTool(templates_1.createTemplateTool);
+    pi.registerTool(templates_1.updateTemplateTool);
+    pi.registerTool(templates_1.deleteTemplateTool);
+    pi.registerTool(add_records_1.addRecordsTool);
+    pi.registerTool(run_codegen_1.runCodegenTool);
+    const gate = (0, confirm_gate_1.createConfirmGate)({
+        resolveProjectContext: context_1.resolveProjectContext,
+        resolveDataToken: context_1.resolveDataToken,
+        createTemplatePreviewTables: templates_1.createTemplatePreviewTables,
+    });
+    pi.on('agent_start', gate.onAgentStart);
+    pi.on('tool_call', gate.onToolCall);
+};
+exports.dbTools = dbTools;
+/** Configure the host and get the extension in one call. */
+function createDbTools(host) {
+    (0, host_1.configureHost)(host);
+    return exports.dbTools;
+}
+var confirm_gate_2 = require("./confirm-gate");
+Object.defineProperty(exports, "createConfirmGate", { enumerable: true, get: function () { return confirm_gate_2.createConfirmGate; } });
+var context_2 = require("./context");
+Object.defineProperty(exports, "resolveDataToken", { enumerable: true, get: function () { return context_2.resolveDataToken; } });
+Object.defineProperty(exports, "resolveProjectContext", { enumerable: true, get: function () { return context_2.resolveProjectContext; } });
+var host_2 = require("./host");
+Object.defineProperty(exports, "configureHost", { enumerable: true, get: function () { return host_2.configureHost; } });
+Object.defineProperty(exports, "getHost", { enumerable: true, get: function () { return host_2.getHost; } });
+var tool_schema_1 = require("./tool-schema");
+Object.defineProperty(exports, "toolSchema", { enumerable: true, get: function () { return tool_schema_1.toolSchema; } });
+var templates_2 = require("./tools/templates");
+Object.defineProperty(exports, "createTemplatePreviewTables", { enumerable: true, get: function () { return templates_2.createTemplatePreviewTables; } });
+exports.default = exports.dbTools;

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@agentic-kit/pi",
+  "version": "0.2.0",
+  "author": "Dan Lynch <pyramation@gmail.com>",
+  "description": "Pi adapter for agentic-kit — the Constructive typed db tools (provision, blueprint, codegen, records, policies, templates) and confirm gate as a pi coding-agent extension",
+  "main": "index.js",
+  "module": "esm/index.js",
+  "types": "index.d.ts",
+  "homepage": "https://github.com/constructive-io/constructive",
+  "license": "SEE LICENSE IN LICENSE",
+  "publishConfig": {
+    "access": "public",
+    "directory": "dist"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/constructive-io/constructive"
+  },
+  "bugs": {
+    "url": "https://github.com/constructive-io/constructive/issues"
+  },
+  "scripts": {
+    "clean": "makage clean",
+    "prepack": "npm run build",
+    "build": "makage build",
+    "build:dev": "makage build --dev",
+    "lint": "eslint . --fix",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  },
+  "dependencies": {
+    "@agentic-kit/harness": "^0.3.0",
+    "@constructive-io/graphql-query": "^4.5.4",
+    "@constructive-io/sdk": "^1.5.4",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": ">=0.79.0"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": "0.79.6",
+    "typebox": "^1.0.0"
+  },
+  "keywords": [
+    "agentic-kit",
+    "pi",
+    "coding-agent",
+    "constructive"
+  ],
+  "gitHead": "31f7cd3d3cc28cf069056eae5b2a0d4198d154a1"
+}

package/policy/add-policies-to-table.d.ts

@@ -0,0 +1,26 @@
+import { type PolicyProvisioningCategory } from '@agentic-kit/harness';
+import type { ModulesClient } from '../context';
+import { type CrudOperation, type CrudPolicyConfigs } from './provision-helpers';
+export interface AddPoliciesToTablePolicyEntry {
+    policyType: string;
+    dataNodeType?: string;
+    nodeData?: Record<string, unknown>;
+    sharedPolicyData: Record<string, unknown>;
+    operations: CrudPolicyConfigs;
+    enabledOperations?: CrudOperation[];
+}
+export interface AddPoliciesToTableInput {
+    client: ModulesClient;
+    databaseId: string;
+    schemaId: string;
+    tableId: string;
+    policies: AddPoliciesToTablePolicyEntry[];
+}
+export declare class UnsupportedPolicyCategoryError extends Error {
+    readonly policyType: string;
+    readonly category: PolicyProvisioningCategory;
+    constructor(policyType: string, category: PolicyProvisioningCategory);
+}
+export declare function addPoliciesToExistingTable(input: AddPoliciesToTableInput): Promise<{
+    success: true;
+}>;

package/policy/add-policies-to-table.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedPolicyCategoryError = void 0;
+exports.addPoliciesToExistingTable = addPoliciesToExistingTable;
+const harness_1 = require("@agentic-kit/harness");
+const provision_helpers_1 = require("./provision-helpers");
+const SUPPORTED_CATEGORIES = new Set([
+    'has-module',
+    'no-fields',
+    'needs-table',
+]);
+class UnsupportedPolicyCategoryError extends Error {
+    policyType;
+    category;
+    constructor(policyType, category) {
+        super(`Policy type "${policyType}" has category "${category}" which requires column creation or composite handling — use the policies UI instead.`);
+        this.policyType = policyType;
+        this.category = category;
+        this.name = 'UnsupportedPolicyCategoryError';
+    }
+}
+exports.UnsupportedPolicyCategoryError = UnsupportedPolicyCategoryError;
+async function addPoliciesToExistingTable(input) {
+    const { client } = input;
+    for (const entry of input.policies) {
+        const category = (0, harness_1.getPolicyCategory)(entry.policyType);
+        if (!SUPPORTED_CATEGORIES.has(category)) {
+            throw new UnsupportedPolicyCategoryError(entry.policyType, category);
+        }
+    }
+    const policiesArray = [];
+    const nodesByType = new Map();
+    for (const entry of input.policies) {
+        const groups = (0, provision_helpers_1.groupOperationsByConfig)(entry.enabledOperations ?? provision_helpers_1.CRUD_OPERATIONS, entry.operations);
+        for (const group of groups) {
+            const ops = group.privileges.join('_');
+            const rand = Math.random().toString(36).slice(2, 8);
+            policiesArray.push((0, provision_helpers_1.buildPolicyEntry)(entry.policyType, {
+                privileges: group.privileges,
+                policy_role: group.roleName,
+                permissive: group.isPermissive,
+                data: entry.sharedPolicyData,
+                policy_name: `${ops}_${rand}`,
+            }));
+        }
+        if (entry.dataNodeType && !nodesByType.has(entry.dataNodeType)) {
+            const nodeData = entry.nodeData ?? {};
+            nodesByType.set(entry.dataNodeType, {
+                $type: entry.dataNodeType,
+                ...(Object.keys(nodeData).length > 0 ? { data: nodeData } : {}),
+            });
+        }
+    }
+    const provisionInput = {
+        databaseId: input.databaseId,
+        schemaId: input.schemaId,
+        tableId: input.tableId,
+        grants: (0, provision_helpers_1.buildGrants)(),
+        policies: policiesArray,
+    };
+    if (nodesByType.size > 0) {
+        provisionInput.nodes = [...nodesByType.values()];
+    }
+    await client.secureTableProvision
+        .create({
+        data: provisionInput,
+        select: { id: true, tableId: true, tableName: true },
+    })
+        .unwrap();
+    return { success: true };
+}