@agentic-kit/pi 0.9.2 → 0.10.0

package/context.js

@@ -75,7 +75,7 @@ async function resolveProjectContext(cwd, options = {}) {
     if (!accountBearer) {
         return {
             context: null,
-            reason: 'No usable account credential to reach the Constructive control plane. Sign in to the app, then retry.',
+            reason: `No usable account credential to reach the Constructive control plane. ${host.signInHint ?? 'Sign in to the app, then retry.'}`,
             code: 'missing-credentials',
         };
     }
@@ -88,6 +88,7 @@ async function resolveProjectContext(cwd, options = {}) {
         endpoint: controlApiEndpoint,
         bearer: accountBearer,
         databaseId,
+        signInHint: host.signInHint,
     });
     if (probe.outcome === 'unreachable') {
         return {
@@ -149,7 +150,8 @@ async function resolveProjectContext(cwd, options = {}) {
         reason: '',
     };
 }
-const NEEDS_AUTH_REASON = 'Not signed in to the app database yet. Sign in from the Sheets tab, or open the Preview and sign in to your app, then try again.';
+const needsAuthReason = () => `Not signed in to the app database yet. ${(0, host_1.getHost)().signInHint ??
+    'Sign in from the Sheets tab, or open the Preview and sign in to your app, then try again.'}`;
 // Resolve a data-plane token for record operations: serve the broker's active
 // account while valid, otherwise harvest the token the user created by signing
 // into their app in the Preview and adopt it into the broker. Also returns the
@@ -164,15 +166,15 @@ async function resolveDataToken(context) {
         return { token: active.token, userId: active.userId };
     const preview = host.previewToken ? await host.previewToken() : null;
     if (!preview)
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     if (broker?.isInvalidToken(context.databaseId, preview.accessToken)) {
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     }
     const parsed = preview.accessTokenExpiresAt ? Date.parse(preview.accessTokenExpiresAt) : NaN;
     const expiresAt = Number.isNaN(parsed) ? Date.now() + 60 * 60 * 1000 : parsed;
     const skewMs = host.dataTokenSkewMs ?? host_1.DEFAULT_DATA_TOKEN_SKEW_MS;
     if (expiresAt <= Date.now() + skewMs)
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     broker?.adoptToken(context.databaseId, {
         userId: preview.userId,
         token: preview.accessToken,

package/db-probe.d.ts

@@ -26,4 +26,5 @@ export declare function probeDatabase(args: {
     bearer: string;
     databaseId: string;
     executor?: ProbeExecutor;
+    signInHint?: string;
 }): Promise<DatabaseProbe>;

package/db-probe.js

@@ -39,7 +39,7 @@ async function probeDatabase(args) {
         if (AUTH_ERROR_RE.test(detail)) {
             return {
                 outcome: 'unreachable',
-                detail: `${detail} — the account credential was rejected; sign in again, then retry`,
+                detail: `${detail} — the account credential was rejected. ${args.signInHint ?? 'Sign in again, then retry.'}`,
             };
         }
         return { outcome: 'missing' };

package/esm/context.js

@@ -66,7 +66,7 @@ export async function resolveProjectContext(cwd, options = {}) {
     if (!accountBearer) {
         return {
             context: null,
-            reason: 'No usable account credential to reach the Constructive control plane. Sign in to the app, then retry.',
+            reason: `No usable account credential to reach the Constructive control plane. ${host.signInHint ?? 'Sign in to the app, then retry.'}`,
             code: 'missing-credentials',
         };
     }
@@ -79,6 +79,7 @@ export async function resolveProjectContext(cwd, options = {}) {
         endpoint: controlApiEndpoint,
         bearer: accountBearer,
         databaseId,
+        signInHint: host.signInHint,
     });
     if (probe.outcome === 'unreachable') {
         return {
@@ -140,7 +141,8 @@ export async function resolveProjectContext(cwd, options = {}) {
         reason: '',
     };
 }
-const NEEDS_AUTH_REASON = 'Not signed in to the app database yet. Sign in from the Sheets tab, or open the Preview and sign in to your app, then try again.';
+const needsAuthReason = () => `Not signed in to the app database yet. ${getHost().signInHint ??
+    'Sign in from the Sheets tab, or open the Preview and sign in to your app, then try again.'}`;
 // Resolve a data-plane token for record operations: serve the broker's active
 // account while valid, otherwise harvest the token the user created by signing
 // into their app in the Preview and adopt it into the broker. Also returns the
@@ -155,15 +157,15 @@ export async function resolveDataToken(context) {
         return { token: active.token, userId: active.userId };
     const preview = host.previewToken ? await host.previewToken() : null;
     if (!preview)
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     if (broker?.isInvalidToken(context.databaseId, preview.accessToken)) {
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     }
     const parsed = preview.accessTokenExpiresAt ? Date.parse(preview.accessTokenExpiresAt) : NaN;
     const expiresAt = Number.isNaN(parsed) ? Date.now() + 60 * 60 * 1000 : parsed;
     const skewMs = host.dataTokenSkewMs ?? DEFAULT_DATA_TOKEN_SKEW_MS;
     if (expiresAt <= Date.now() + skewMs)
-        return { reason: NEEDS_AUTH_REASON };
+        return { reason: needsAuthReason() };
     broker?.adoptToken(context.databaseId, {
         userId: preview.userId,
         token: preview.accessToken,

package/esm/db-probe.d.ts

@@ -26,4 +26,5 @@ export declare function probeDatabase(args: {
     bearer: string;
     databaseId: string;
     executor?: ProbeExecutor;
+    signInHint?: string;
 }): Promise<DatabaseProbe>;

package/esm/db-probe.js

@@ -36,7 +36,7 @@ export async function probeDatabase(args) {
         if (AUTH_ERROR_RE.test(detail)) {
             return {
                 outcome: 'unreachable',
-                detail: `${detail} — the account credential was rejected; sign in again, then retry`,
+                detail: `${detail} — the account credential was rejected. ${args.signInHint ?? 'Sign in again, then retry.'}`,
             };
         }
         return { outcome: 'missing' };

package/esm/host.d.ts

@@ -48,6 +48,29 @@ export interface HostProvisionOverlay {
     add?: (string | [string, Record<string, unknown>])[];
     remove?: string[];
 }
+/**
+ * A minted secret handed to the host for out-of-band delivery (.env write +
+ * one-time reveal). The plaintext never enters tool results or the transcript;
+ * pi forgets it after this call.
+ */
+export type SecretDelivery = {
+    databaseId: string;
+    /** Project directory whose `.env` receives the key. */
+    cwd: string;
+    envVar: string;
+    plaintext: string;
+    keyId: string;
+    expiresAt?: string;
+};
+/**
+ * Context for a host-side step-up: enough to derive the per-database auth
+ * endpoint and look up the app session without re-resolving the project.
+ */
+export type StepUpRequest = {
+    databaseId: string;
+    databaseName: string;
+    apiEndpoint: string;
+};
 export interface PiToolsHost {
     /** Signed-in platform account, or null/undefined when signed out. */
     account(): HostAccount | null | undefined;
@@ -55,6 +78,12 @@ export interface PiToolsHost {
     backendConfig(): HostBackendConfig | null | undefined;
     /** Optional data-plane token broker (see DataAuthBroker). */
     dataAuthBroker?: DataAuthBroker;
+    /**
+     * Host-specific sign-in instruction, substituted into signed-out failure
+     * reasons (e.g. the CLI's "Run `agent login` to sign in."). Absent hosts get
+     * the desktop wording.
+     */
+    signInHint?: string;
     /** Harvest an end-user token from the host's app preview, if it has one. */
     previewToken?(): Promise<PreviewToken | null>;
     /** Treat tokens expiring within this window as already expired. Default 30s. */
@@ -66,6 +95,17 @@ export interface PiToolsHost {
      * (e.g. materialized from appstash / a pinned git ref), never as code.
      */
     provisionOverlay?(): HostProvisionOverlay | null | undefined | Promise<HostProvisionOverlay | null | undefined>;
+    /**
+     * Complete MFA step-up for the database's app session in the host's own
+     * process (password dialog + verifyPassword). The password never passes
+     * through pi or the model. Resolve true when step-up succeeded.
+     */
+    requestStepUp?(request: StepUpRequest): Promise<boolean>;
+    /**
+     * Deliver a minted secret to the user (.env write + one-time reveal).
+     * Required for create_api_key — without it the tool refuses to mint.
+     */
+    deliverSecret?(delivery: SecretDelivery): Promise<void>;
 }
 export declare const DEFAULT_DATA_TOKEN_SKEW_MS = 30000;
 export declare function configureHost(host: PiToolsHost): void;

package/esm/index.d.ts

@@ -4,7 +4,7 @@ export declare const dbTools: ExtensionFactory;
 /** Configure the host and get the extension in one call. */
 export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
 export { type ConfirmGate, type ConfirmGateDeps, createConfirmGate } from './confirm-gate';
-export { type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
+export { deriveSubdomainEndpoint, type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
 export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type HostProvisionOverlay, type PiToolsHost, type PreviewToken, } from './host';
 export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, type ProvisionManifest, } from './provision-database/manifest';
 export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, type ModulePreset, type ProvisionModule, } from './provision-database/presets';

package/esm/index.js

@@ -4,7 +4,9 @@ import { configureHost } from './host';
 import { addPoliciesTool } from './tools/add-policies';
 import { addRecordsTool } from './tools/add-records';
 import { addRelationTool } from './tools/add-relation';
+import { createApiKeyTool } from './tools/create-api-key';
 import { describeSchemaTool } from './tools/describe-schema';
+import { manageEntityTypesTool } from './tools/manage-entity-types';
 import { createFieldTool, deleteFieldTool, deleteTableTool, updateFieldTool } from './tools/mutations';
 import { provisionBlueprintTool } from './tools/provision-blueprint';
 import { provisionDatabaseTool } from './tools/provision-database';
@@ -26,6 +28,8 @@ export const dbTools = (pi) => {
     pi.registerTool(updateTemplateTool);
     pi.registerTool(deleteTemplateTool);
     pi.registerTool(addRecordsTool);
+    pi.registerTool(manageEntityTypesTool);
+    pi.registerTool(createApiKeyTool);
     pi.registerTool(runCodegenTool);
     const gate = createConfirmGate({
         resolveProjectContext,
@@ -41,7 +45,7 @@ export function createDbTools(host) {
     return dbTools;
 }
 export { createConfirmGate } from './confirm-gate';
-export { resolveDataToken, resolveProjectContext, } from './context';
+export { deriveSubdomainEndpoint, resolveDataToken, resolveProjectContext, } from './context';
 export { configureHost, getHost, } from './host';
 export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, } from './provision-database/manifest';
 export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, } from './provision-database/presets';

package/esm/provision-database/credential.d.ts

@@ -11,4 +11,4 @@ export type ProvisionCredential = {
     mode: 'error';
     reason: string;
 };
-export declare function selectProvisionCredential(account: AccountCredential | null | undefined): ProvisionCredential;
+export declare function selectProvisionCredential(account: AccountCredential | null | undefined, signInHint?: string): ProvisionCredential;

package/esm/provision-database/credential.js

@@ -7,13 +7,13 @@
 // skip path). A signed-in session with no usable bearer (keychain locked) is an
 // explicit error, never a silent throwaway owner.
 // Side-effect-free so the branch is unit-testable without runtime/network.
-export function selectProvisionCredential(account) {
+export function selectProvisionCredential(account, signInHint) {
     const bearer = account?.apiKey ?? account?.accessToken;
     if (account?.userId && bearer) {
         return { mode: 'account', ownerId: account.userId, bearer };
     }
     return {
         mode: 'error',
-        reason: 'No usable account credential. Sign in (or unlock your session) before provisioning a database.',
+        reason: `No usable account credential. ${signInHint ?? 'Sign in (or unlock your session) before provisioning a database.'}`,
     };
 }

package/esm/tools/create-api-key.d.ts

@@ -0,0 +1,18 @@
+import type { ToolDefinition } from '@earendil-works/pi-coding-agent';
+declare const CreateApiKeySchema: import("typebox/type").TSchema;
+export type CreateApiKeyDetails = {
+    success: boolean;
+    message: string;
+    keyId?: string;
+    envVar?: string;
+    expiresAt?: string;
+    principalId?: string;
+    principalName?: string;
+    scope?: string;
+    needsAuth?: boolean;
+};
+export declare function toEnvVar(keyName: string): string;
+export declare function isStepUpError(messages: string[]): boolean;
+export declare function describeScope(entityIds: string[] | undefined, readOnly: boolean): string;
+export declare const createApiKeyTool: ToolDefinition<typeof CreateApiKeySchema, CreateApiKeyDetails>;
+export {};

package/esm/tools/create-api-key.js

@@ -0,0 +1,216 @@
+import { auth } from '@constructive-io/sdk';
+import { z } from 'zod';
+import { deriveSubdomainEndpoint, resolveDataToken, resolveProjectContext } from '../context';
+import { getHost } from '../host';
+import { toolSchema } from '../tool-schema';
+const CreateApiKeyZod = z.object({
+    key_name: z
+        .string()
+        .describe('Name for the API key (e.g. "deploy bot"). The .env variable name derives from it (UPPER_SNAKE + _API_KEY).'),
+    principal_name: z
+        .string()
+        .describe('Machine identity (principal) that owns the key. Defaults to key_name. An existing principal with this name is reused for unscoped keys.')
+        .optional(),
+    entity_ids: z
+        .array(z.string())
+        .describe('Entity row UUIDs to scope the principal to. Omit for a personal (unscoped) key that acts as the signed-in app user.')
+        .optional(),
+    read_only: z
+        .boolean()
+        .describe('Restrict the principal and key to read-only operations.')
+        .optional(),
+    expires_in_days: z
+        .number()
+        .int()
+        .positive()
+        .describe('Key lifetime in days. Default 90.')
+        .optional(),
+});
+const CreateApiKeySchema = toolSchema(CreateApiKeyZod);
+function fail(message, extra) {
+    return {
+        content: [{ type: 'text', text: message }],
+        details: { success: false, message, ...extra },
+    };
+}
+export function toEnvVar(keyName) {
+    const base = keyName
+        .trim()
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '');
+    return base.endsWith('_API_KEY') ? base : `${base}_API_KEY`;
+}
+export function isStepUpError(messages) {
+    return messages.some((m) => /step[\s_-]?up/i.test(m));
+}
+export function describeScope(entityIds, readOnly) {
+    const parts = [];
+    parts.push(entityIds?.length
+        ? `scoped to ${entityIds.length} entit${entityIds.length === 1 ? 'y' : 'ies'}`
+        : 'unscoped (acts as the signed-in app user)');
+    if (readOnly)
+        parts.push('read-only');
+    return parts.join(', ');
+}
+async function rawGraphql(endpoint, token, query, variables) {
+    const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        },
+        body: JSON.stringify({ query, variables }),
+    });
+    return (await res.json());
+}
+async function createPrincipalInputFields(endpoint) {
+    const probe = await rawGraphql(endpoint, undefined, '{ __type(name: "CreatePrincipalInput") { inputFields { name } } }');
+    const type = probe.data?.__type;
+    return new Set((type?.inputFields ?? []).map((f) => f.name));
+}
+export const createApiKeyTool = {
+    name: 'create_api_key',
+    label: 'Create API key',
+    description: 'Mint an API key for the project database, owned by a machine principal. Optionally scope it to specific entity rows and/or read-only. The human confirms the mint, completes MFA step-up in the app when required, and receives the key via .env + a one-time reveal — the plaintext key never appears in this conversation. Requires the user to be signed in to their app in the Preview.',
+    promptSnippet: 'create_api_key: mint an entity-scoped API key for the project database. Gated; the plaintext goes to .env + a one-time reveal, never into the chat — reference it as its env var.',
+    parameters: CreateApiKeySchema,
+    async execute(_id, params, _signal, _onUpdate, ctx) {
+        const keyName = params.key_name?.trim();
+        if (!keyName)
+            return fail('create_api_key requires "key_name".');
+        const resolved = await resolveProjectContext(ctx.cwd, { plane: 'data' });
+        if (!resolved.context)
+            return fail(resolved.reason);
+        const { databaseId, databaseName, apiEndpoint } = resolved.context;
+        if (!databaseName) {
+            return fail('Cannot resolve the app auth endpoint (DATABASE_NAME missing from .env). Re-provision the database, then retry.');
+        }
+        const host = getHost();
+        if (!host.deliverSecret) {
+            return fail('This host cannot deliver secrets (no .env write + reveal flow), so no key was minted. Create the key from a host that supports secret delivery.');
+        }
+        const token = await resolveDataToken(resolved.context);
+        if (!token.token) {
+            return fail(token.reason ?? 'Sign in to the app database to create an API key.', {
+                needsAuth: true,
+            });
+        }
+        const authEndpoint = deriveSubdomainEndpoint(apiEndpoint, `auth-${databaseName}`);
+        if (!authEndpoint)
+            return fail('Cannot derive the app auth endpoint.');
+        const scoped = Boolean(params.entity_ids?.length) || params.read_only === true;
+        try {
+            if (scoped) {
+                const fields = await createPrincipalInputFields(authEndpoint);
+                const missing = [
+                    ...(params.entity_ids?.length && !fields.has('entityIds') ? ['entityIds'] : []),
+                    ...(params.read_only === true && !fields.has('isReadOnly') ? ['isReadOnly'] : []),
+                ];
+                if (missing.length) {
+                    return fail(`This deployment does not support scoping a principal at create time (no ${missing.join(', ')} on createPrincipal). No key was minted. If an unscoped key that acts as the signed-in user is acceptable, ask for one explicitly.`);
+                }
+            }
+            const dbAuth = auth.createClient({
+                endpoint: authEndpoint,
+                headers: { Authorization: `Bearer ${token.token}` },
+            });
+            const principalName = params.principal_name?.trim() || keyName;
+            const existing = await dbAuth.principal
+                .findFirst({
+                where: { name: { equalTo: principalName } },
+                select: { id: true, name: true, userId: true, isReadOnly: true },
+            })
+                .unwrap();
+            // createApiKey (like createPrincipal.result) takes the principal's
+            // identity userId; principal_entity.principalId references the row id.
+            let principalId = existing.principal?.userId;
+            if (existing.principal && scoped) {
+                return fail(`Principal "${principalName}" already exists, and its scope cannot be verified against the requested one. No key was minted. Use a new principal_name for a scoped key, or mint an unscoped key on the existing principal explicitly.`);
+            }
+            if (existing.principal) {
+                const scopeRow = await dbAuth.principalEntity
+                    .findFirst({
+                    where: { principalId: { equalTo: existing.principal.id } },
+                    select: { id: true },
+                })
+                    .unwrap();
+                if (scopeRow.principalEntity || existing.principal?.isReadOnly) {
+                    return fail(`Principal "${principalName}" already exists with a narrower scope (entity-scoped or read-only), so a key minted under it would not act as the signed-in user. No key was minted. Use a new principal_name for an unscoped key.`);
+                }
+            }
+            if (!principalId) {
+                // The SDK's PrincipalModel.create sends a nested {principal} input, but
+                // the live CreatePrincipalInput is flat and its payload only exposes
+                // `result: UUID` — raw GraphQL is the only working surface.
+                const created = await rawGraphql(authEndpoint, token.token, 'mutation ($input: CreatePrincipalInput!) { createPrincipal(input: $input) { result } }', {
+                    input: {
+                        name: principalName,
+                        ...(params.entity_ids?.length && { entityIds: params.entity_ids }),
+                        ...(params.read_only !== undefined && { isReadOnly: params.read_only }),
+                    },
+                });
+                if (created.errors?.length) {
+                    return fail(`createPrincipal failed: ${created.errors.map((e) => e.message).join('; ')}`);
+                }
+                const payload = created.data?.createPrincipal;
+                principalId = payload?.result;
+                if (!principalId)
+                    return fail('createPrincipal returned no principal id.');
+            }
+            const mint = () => dbAuth.mutation
+                .createApiKey({
+                input: {
+                    principalId: principalId,
+                    keyName,
+                    ...(params.read_only && { accessLevel: 'read_only' }),
+                    expiresIn: { days: params.expires_in_days ?? 90 },
+                },
+            }, { select: { result: { select: { apiKey: true, keyId: true, expiresAt: true } } } })
+                .execute();
+            let minted = await mint();
+            if (!minted.ok && isStepUpError(minted.errors.map((e) => e.message))) {
+                if (!host.requestStepUp) {
+                    return fail('Creating this key requires MFA step-up, and this host has no step-up flow. Complete step-up in the app (verify your password), then retry.');
+                }
+                const verified = await host.requestStepUp({ databaseId, databaseName, apiEndpoint });
+                if (!verified)
+                    return fail('Step-up verification was not completed. No key was minted.');
+                minted = await mint();
+            }
+            if (!minted.ok) {
+                return fail(`createApiKey failed: ${minted.errors.map((e) => e.message).join('; ')}`);
+            }
+            const record = minted.data?.createApiKey?.result;
+            if (!record?.apiKey || !record.keyId)
+                return fail('createApiKey returned no key.');
+            const envVar = toEnvVar(keyName);
+            await host.deliverSecret({
+                databaseId,
+                cwd: ctx.cwd,
+                envVar,
+                plaintext: record.apiKey,
+                keyId: record.keyId,
+                expiresAt: record.expiresAt ?? undefined,
+            });
+            const scope = describeScope(params.entity_ids, params.read_only === true);
+            const message = `Created API key "${keyName}" (keyId: ${record.keyId}) for principal "${principalName}" — ${scope}. The key was written to .env as ${envVar} and revealed once to the user; it is not in this conversation. Reference it as ${envVar}.${record.expiresAt ? ` Expires ${record.expiresAt}.` : ''}`;
+            return {
+                content: [{ type: 'text', text: message }],
+                details: {
+                    success: true,
+                    message,
+                    keyId: record.keyId,
+                    envVar,
+                    expiresAt: record.expiresAt ?? undefined,
+                    principalId,
+                    principalName,
+                    scope,
+                },
+            };
+        }
+        catch (err) {
+            return fail(err instanceof Error ? err.message : 'Failed to create the API key.');
+        }
+    },
+};

package/esm/tools/manage-entity-types.d.ts

@@ -0,0 +1,41 @@
+import type { ToolDefinition } from '@earendil-works/pi-coding-agent';
+import { z } from 'zod';
+declare const ManageEntityTypesZod: z.ZodObject<{
+    action: z.ZodEnum<{
+        create: "create";
+        delete: "delete";
+        list: "list";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    entity_type_id: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    prefix: z.ZodOptional<z.ZodString>;
+    parent_entity: z.ZodOptional<z.ZodString>;
+    is_visible: z.ZodOptional<z.ZodBoolean>;
+    has_invites: z.ZodOptional<z.ZodBoolean>;
+    has_profiles: z.ZodOptional<z.ZodBoolean>;
+    has_limits: z.ZodOptional<z.ZodBoolean>;
+    has_levels: z.ZodOptional<z.ZodBoolean>;
+    has_storage: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const ManageEntityTypesSchema: import("typebox/type").TSchema;
+export type EntityTypeSummary = {
+    id: string;
+    name: string | null;
+    description: string | null;
+    prefix: string | null;
+    parentEntity: string | null;
+    isVisible: boolean | null;
+    entityTableName: string | null;
+    installedModules: string[] | null;
+};
+export type ManageEntityTypesDetails = {
+    success: boolean;
+    message: string;
+    entityTypes?: EntityTypeSummary[];
+};
+export declare function defaultPrefix(name: string): string;
+type Params = z.infer<typeof ManageEntityTypesZod>;
+export declare function validateManageEntityTypes(params: Params): string | null;
+export declare const manageEntityTypesTool: ToolDefinition<typeof ManageEntityTypesSchema, ManageEntityTypesDetails>;
+export {};