@axonity-ai/mcp 0.1.0 → 0.2.2

package/dist/index.d.ts

@@ -18,3 +18,14 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { AxonityClient } from "./client.js";
 export declare function buildServer(client: AxonityClient): McpServer;
+/**
+ * True when this module is the process entry point.
+ *
+ * `import.meta.url` is realpath-resolved and percent-encoded, so it can't be
+ * compared against a hand-built `file://${argv[1]}` string: npm installs the bin
+ * as a symlink (`node_modules/.bin/axonity-mcp`), which is how `npx` runs it, and
+ * paths with spaces encode differently. Both mismatches used to leave the server
+ * silently unstarted. Resolve argv[1] the same way before comparing.
+ */
+export declare function isEntryPoint(moduleUrl: string, argv1: string | undefined): boolean;
+export declare function assertNoExtraArguments(argv: string[]): void;

package/dist/index.js

@@ -15,13 +15,20 @@
  * tenant + scope on every call. Publishing is human-approved and lands in a
  * later slice (C3) — this connector never publishes directly.
  */
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { AxonityClient } from "./client.js";
 import { loadConfig } from "./config.js";
 import { registerConventions } from "./tools/conventions.js";
-import { registerAttachTools, registerConnectorTools, registerPersonaTools, } from "./tools/extras.js";
+import { assertPlaceholderCredentials } from "./tools/credentials.js";
+import { registerAttachTools, registerCatalogTools, registerConnectorTools, registerPersonaTools, } from "./tools/extras.js";
 import { registerEntityTools } from "./tools/register.js";
+import { registerRunTools } from "./tools/runs.js";
+import { registerTriggerTools } from "./tools/triggers.js";
+import { registerApprovalTools, registerExecutionTools, registerValidationTools, } from "./tools/validation.js";
+import { registerVersionTools } from "./tools/versions.js";
 import { registerWorkflowMutations } from "./tools/workflowMutations.js";
 /**
  * The entities the connector covers. Core entities (C4) plus memory
@@ -34,51 +41,132 @@ const ENTITIES = [
         basePath: "/api/v1/workflows",
         updateMethod: "PATCH",
         label: "workflows (business processes)",
+        deleteVersionParam: "expectedVersion",
     },
     {
         singular: "agent",
         basePath: "/api/v1/agents",
         updateMethod: "PUT",
         label: "agents",
+        deleteVersionParam: "expectedVersion",
     },
     {
         singular: "tool",
         basePath: "/api/v1/tools",
         updateMethod: "PUT",
         label: "tools (functions, connectors, validators, evaluators)",
+        // A connector is just a tool, so create_tool/update_tool can carry an
+        // authConfig too — they get the same credential guard as create_connector.
+        guardFields: assertPlaceholderCredentials,
+        deleteVersionParam: "expectedVersion",
     },
     {
         singular: "skill",
         basePath: "/api/v1/skills",
         updateMethod: "PUT",
         label: "skills (reusable know-how for agents)",
+        deleteVersionParam: "expected_version",
     },
     {
         singular: "policy",
         basePath: "/api/v1/policies",
         updateMethod: "PUT",
         label: "policies (rules and guardrails for agents)",
+        plural: "policies",
+        deleteVersionParam: "expected_version",
     },
     {
         singular: "reference_doc",
         basePath: "/api/v1/reference-docs",
         updateMethod: "PUT",
         label: "reference docs (background knowledge for agents)",
+        deleteVersionParam: "expected_version",
+    },
+    {
+        singular: "output_schema",
+        basePath: "/api/v1/output-schemas",
+        updateMethod: "PUT",
+        label: "output schemas (reusable step/agent output contracts)",
+        // Now fully version-controlled and in the publish-approval gateway
+        // alongside the memory entities — no longer live-on-write.
+        deleteVersionParam: "expected_version",
+    },
+    {
+        singular: "persona",
+        basePath: "/api/v1/personas",
+        updateMethod: "PUT",
+        label: "personas (an agent's character, 1:1 with the agent)",
+        // Created only through its agent (create_agent_persona) — there is no
+        // standalone POST /api/v1/personas.
+        creatable: false,
+        deleteVersionParam: "expected_version",
+    },
+    {
+        singular: "prompt_snippet",
+        basePath: "/api/v1/prompt-snippets",
+        updateMethod: "PATCH",
+        label: "prompt snippets (reusable prompt fragments)",
+        deleteVersionParam: "expectedVersion",
+    },
+    {
+        singular: "flow",
+        basePath: "/api/v1/flows",
+        updateMethod: "PATCH",
+        label: "flows (reusable workflow fragments)",
+        deleteVersionParam: "expectedVersion",
     },
 ];
+/**
+ * Entities with version history. Not the same list as ENTITIES: `flow` has no
+ * `/versions*` routes at all, so it is excluded here.
+ */
+const VERSIONED = [
+    { singular: "workflow", basePath: "/api/v1/workflows", publishedPath: "entity" },
+    { singular: "agent", basePath: "/api/v1/agents", publishedPath: "entity" },
+    { singular: "tool", basePath: "/api/v1/tools", publishedPath: "entity" },
+    { singular: "skill", basePath: "/api/v1/skills", publishedPath: "versions" },
+    { singular: "policy", basePath: "/api/v1/policies", publishedPath: "versions" },
+    {
+        singular: "reference_doc",
+        basePath: "/api/v1/reference-docs",
+        publishedPath: "versions",
+    },
+    { singular: "persona", basePath: "/api/v1/personas", publishedPath: "versions" },
+    {
+        singular: "output_schema",
+        basePath: "/api/v1/output-schemas",
+        publishedPath: "versions",
+    },
+    {
+        singular: "prompt_snippet",
+        basePath: "/api/v1/prompt-snippets",
+        publishedPath: "versions",
+    },
+    { singular: "flow", basePath: "/api/v1/flows", publishedPath: "entity" },
+];
 export function buildServer(client) {
     const server = new McpServer({ name: "axonity", version: "0.1.0" });
     registerConventions(server);
     for (const def of ENTITIES) {
         registerEntityTools(server, client, def);
     }
+    for (const def of VERSIONED) {
+        registerVersionTools(server, client, def);
+    }
     registerWorkflowMutations(server, client);
+    registerValidationTools(server, client);
+    registerExecutionTools(server, client);
+    registerApprovalTools(server, client);
+    registerTriggerTools(server, client);
+    registerRunTools(server, client);
     registerPersonaTools(server, client);
     registerConnectorTools(server, client);
     registerAttachTools(server, client);
+    registerCatalogTools(server, client);
     return server;
 }
 async function main() {
+    assertNoExtraArguments(process.argv.slice(2));
     const config = loadConfig();
     const client = new AxonityClient(config);
     const server = buildServer(client);
@@ -87,8 +175,43 @@ async function main() {
     // Log to stderr — stdout is the MCP channel and must stay clean.
     console.error(`Axonity MCP connector ready (${config.apiUrl}).`);
 }
+/**
+ * True when this module is the process entry point.
+ *
+ * `import.meta.url` is realpath-resolved and percent-encoded, so it can't be
+ * compared against a hand-built `file://${argv[1]}` string: npm installs the bin
+ * as a symlink (`node_modules/.bin/axonity-mcp`), which is how `npx` runs it, and
+ * paths with spaces encode differently. Both mismatches used to leave the server
+ * silently unstarted. Resolve argv[1] the same way before comparing.
+ */
+export function isEntryPoint(moduleUrl, argv1) {
+    if (!argv1)
+        return false;
+    try {
+        return moduleUrl === pathToFileURL(realpathSync(argv1)).href;
+    }
+    catch {
+        // argv[1] isn't a readable path (e.g. `node --eval`); not our entry point.
+        return false;
+    }
+}
+export function assertNoExtraArguments(argv) {
+    if (argv.length === 0)
+        return;
+    throw new Error([
+        "This MCP server does not accept command-line arguments.",
+        "Usage:",
+        "  axonity-mcp",
+        "",
+        "Pass configuration through environment variables instead:",
+        "  AXONITY_TOKEN (required): the service token.",
+        "  AXONITY_API_URL (optional): API base URL.",
+        "",
+        `Received arguments: ${argv.join(" ")}`,
+    ].join("\n"));
+}
 // Only run when executed directly (not when imported by tests).
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isEntryPoint(import.meta.url, process.argv[1])) {
     main().catch((err) => {
         console.error("Axonity MCP connector failed to start:", err);
         process.exit(1);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,QAAQ,GAAgB;IAC5B;QACE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,OAAO;QACrB,KAAK,EAAE,gCAAgC;KACxC;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,uDAAuD;KAC/D;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,uCAAuC;KAC/C;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,4CAA4C;KACpD;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,wBAAwB;QAClC,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,kDAAkD;KAC1D;CACF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,gEAAgE;AAChE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAkB,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwB,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,QAAQ,GAAgB;IAC5B;QACE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,OAAO;QACrB,KAAK,EAAE,gCAAgC;QACvC,kBAAkB,EAAE,iBAAiB;KACtC;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,QAAQ;QACf,kBAAkB,EAAE,iBAAiB;KACtC;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,uDAAuD;QAC9D,sEAAsE;QACtE,2EAA2E;QAC3E,WAAW,EAAE,4BAA4B;QACzC,kBAAkB,EAAE,iBAAiB;KACtC;IACD;QACE,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,uCAAuC;QAC9C,kBAAkB,EAAE,kBAAkB;KACvC;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,4CAA4C;QACnD,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE,kBAAkB;KACvC;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,wBAAwB;QAClC,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,kDAAkD;QACzD,kBAAkB,EAAE,kBAAkB;KACvC;IACD;QACE,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,wBAAwB;QAClC,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,uDAAuD;QAC9D,mEAAmE;QACnE,2DAA2D;QAC3D,kBAAkB,EAAE,kBAAkB;KACvC;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,KAAK;QACnB,KAAK,EAAE,qDAAqD;QAC5D,sEAAsE;QACtE,oCAAoC;QACpC,SAAS,EAAE,KAAK;QAChB,kBAAkB,EAAE,kBAAkB;KACvC;IACD;QACE,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,yBAAyB;QACnC,YAAY,EAAE,OAAO;QACrB,KAAK,EAAE,6CAA6C;QACpD,kBAAkB,EAAE,iBAAiB;KACtC;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,YAAY,EAAE,OAAO;QACrB,KAAK,EAAE,qCAAqC;QAC5C,kBAAkB,EAAE,iBAAiB;KACtC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,SAAS,GAAsB;IACnC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE;IAChF,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE;IAC1E,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE;IACxE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAE,UAAU,EAAE;IAC5E,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE;IAC/E;QACE,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,wBAAwB;QAClC,aAAa,EAAE,UAAU;KAC1B;IACD,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE;IAChF;QACE,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,wBAAwB;QAClC,aAAa,EAAE,UAAU;KAC1B;IACD;QACE,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,yBAAyB;QACnC,aAAa,EAAE,UAAU;KAC1B;IACD,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE;CACzE,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,KAAyB;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAc;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,KAAK,CACb;QACE,yDAAyD;QACzD,QAAQ;QACR,eAAe;QACf,EAAE;QACF,2DAA2D;QAC3D,gDAAgD;QAChD,6CAA6C;QAC7C,EAAE;QACF,uBAAuB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/conventions.js

@@ -11,35 +11,174 @@ const CONVENTIONS = `# Authoring conventions for Axonity entities
 
 Read this before creating or updating anything.
 
+## What this connector is for
+- AUTHORING: composing an entity from intent — drafting a workflow, an agent, a
+  tool, and wiring them together. That is what these tools are good at.
+- NOT bulk migration. Do not use this to move many entities verbatim from
+  somewhere else; Axonity's config import/export moves bytes without a model in
+  the path. Content can be subtly altered in transit through an agent, which is
+  exactly what you cannot afford in a fidelity migration.
+
+## The authoring loop
+1. \`read_*\` the entity (and \`read_*_published\` if you need to see what is live).
+2. Edit the DRAFT: \`update_*\`, or workflow-edit tools for workflow structure.
+3. Validate before publish: \`validate_workflow\` / \`analyze_workflow_reachable_outputs\` / 
+   \`validate_tool_code\` / \`format_tool_code\`. These four are stateless and work with
+   read-only tokens.
+4. Re-read and verify with a saved tool command: \`execute_tool\` / \`execute_stored_connector\`.
+5. Fix any issues and re-read again.
+6. \`request_publish_*\` — this only QUEUES a human approval.
+7. \`list_publish_approvals\` / \`get_publish_approval\` to see whether it was
+   approved or rejected.
+8. If something went wrong:
+   - Bad edit, entity still exists → \`list_*_versions\` then \`restore_*_version\`
+     to roll the draft back to an earlier version.
+   - Never published, want a clean slate → \`discard_*_draft\` resets the draft to
+     the last published state (fails if it was never published — there's nothing
+     to fall back to).
+   - Deleted by mistake → \`restore_*\` (see "Delete is recoverable" below).
+
 ## Drafts, not live
 - \`create_*\` and \`update_*\` produce a DRAFT. The live runtime is unaffected
-  until a human publishes it in Axonity. You cannot publish directly.
+  until a human publishes it in Axonity. \`flow\` has the same rule: runtime uses
+  the published snapshot from \`read_flow_published\` until \`request_publish_flow\`
+  is approved.
+- You cannot publish directly — the backend refuses a direct publish from a service
+  token with a 403, so there is no tool for it and no way around it.
+- A read-only token can only read: any write returns 403. If you see that, ask
+  your human for a write-scoped token rather than retrying.
 - \`request_publish_*\` does NOT publish — it creates a pending approval a human
   approves in Axonity. Use it when a draft is ready; then tell the user to
   approve it in their Axonity approvals inbox.
 
 ## Optimistic locking (always read-then-write)
 - Before \`update_*\`, call \`read_*\` and use the \`version\` you get as
-  \`expectedVersion\`. If the update returns a 409 conflict, someone else changed
-  it — read again and re-apply your change onto the new version.
+  \`expectedVersion\` — in the request BODY. If the update returns a 409
+  conflict, someone else changed it — read again and re-apply your change onto
+  the new version.
+- \`delete_*\` also takes \`expectedVersion\`, but as an argument on the tool call
+  only — the connector maps it to whatever query-parameter spelling that
+  entity's route actually expects (it differs per entity on the wire; you never
+  need to know which).
+- \`restore_*\` and \`restore_deleted_*_version\` take NO version at all — a
+  restore must never lose to a stale-version guard.
+
+## Errors: branch on the failure, not the words
+- Every error names what went wrong as plainly as the backend allows. For a 409
+  specifically, two different problems share that status code and need
+  different responses:
+  - **Version conflict** — you had a stale read. Re-read, re-apply, retry.
+  - **Reference conflict** — the entity is referenced by something published or
+    live. Retrying will never help. Detach the reference or unpublish the
+    referencing entity first.
+  The error message tells you which one you hit — read it, don't assume 409
+  always means "retry."
+- A 403 on any write means the token is read-only, or (for a direct publish
+  attempt, which no tool makes) that publishing must go through
+  \`request_publish_*\`. Either way: stop, don't retry, tell your human.
+- A 401 means the service token is dead — missing, wrong, expired, or revoked.
+  **The backend deliberately returns the identical message for all four
+  causes** so it doesn't leak which applies; you have no way to tell them
+  apart and no way to check a token's remaining lifetime in advance (every
+  token now expires — 7, 15, 30, 60 or 90 days, chosen when it was minted;
+  there is no "never"). On any 401: stop, do not retry, and tell your human
+  plainly that the configured token is no longer valid and a new one must be
+  minted from Axonity → Settings → API tokens. Do not guess or imply the cause.
 
 ## Field shape
 - All fields are camelCase JSON (e.g. \`capabilityTier\`, not \`capability_tier\`).
 - \`update_*\` is a partial change for agents/tools and a partial patch for
   workflows: send only the fields you are changing.
-- The backend validates fields; a 422 error tells you exactly which field is wrong.
+- The backend validates fields; a 422 error names the offending field and why
+  (e.g. \`body.capabilityTier: Input should be 'standard' or 'advanced'\`). Fix
+  that field and retry — do not guess at the whole shape.
+- \`agent.tags\` is not cosmetic: it drives which policies apply to the agent at
+  runtime. An untagged agent looks correct everywhere in the UI and silently
+  skips policies scoped to those tags. If you create or update an agent that
+  should be governed by a policy, check its tags match what the policy expects.
+
+## After you write, verify
+- A 200 means the request was accepted, NOT that it did what you meant. Re-read
+  the entity after a mutation and diff it against your intent — unknown fields
+  can be dropped silently, and a partial update only changes what you sent.
+
+## Delete is recoverable — but not everything is
+- \`delete_*\` soft-deletes: the entity disappears from \`list_*\` but is not gone.
+  \`restore_*\` brings it back; \`list_deleted_*\` shows what's waiting. This
+  applies uniformly to workflow, agent, tool, skill, policy, reference_doc,
+  persona, output_schema, prompt_snippet, and flow.
+- The same applies one level down, to version HISTORY:
+  \`delete_*_version\` removes one entry from history (the current draft and
+  published version are protected and can't be targeted this way);
+  \`list_deleted_*_versions\` / \`restore_deleted_*_version\` undo it. Deleted
+  version numbers stay reserved rather than reused, so gaps in the numbering
+  are normal, not a sign of corruption.
+- \`restore_*\` can itself 409 if a live entity now holds the same name/slot —
+  the error names the conflicting one.
+- There is no "archive" state for these ten entities — delete + restore IS the
+  lifecycle. Runs are the one exception with a true archive/unarchive (see below).
 
 ## Per entity
-- **workflow**: \`create_workflow\` makes a stub (name, description). Build its
-  steps/edges with \`apply_workflow_mutations\` (a list of mutation commands) —
-  the workflow document is edited through commands, never by replacing it wholesale.
+- **workflow**: \`create_workflow\` makes a stub (name, description). Edit its
+  document with either
+  - \`apply_workflow_mutations\` (LIST of command mutations, preserved order), or
+  - \`replace_workflow_document\` (full-document atomic PUT).
 - **agent**: fields include name, avatar, capabilityTier, creativityTier,
-  learningMode, permissions, delegationTargetIds, toolIds, systemToolIds, status.
+  learningMode, permissions, delegationTargetIds, toolIds, systemToolIds, tags,
+  status. \`list_system_tools\` shows what can go in \`systemToolIds\` — there is
+  no separate grant/revoke tool, you set it via \`update_agent\`.
 - **tool**: fields include name, description, type
   ("function" | "connector" | "validator" | "evaluator"), inputSchema,
   outputSchema, implementation, authConfig, status. For a connector, set
   \`type: "connector"\`; NEVER put real credentials in authConfig — use
-  placeholders and let a human fill secrets in the Axonity tool editor.
+  placeholders and let a human fill secrets in the Axonity tool editor. Test it
+  with \`execute_tool\` (runs code you supply) or \`execute_stored_connector\`
+  (runs an already-saved connector using its real, server-side-decrypted
+  secret — you never see the secret, only the result).
+- **persona**: an agent's character — 1:1 with an agent. Created only through
+  its agent (\`create_agent_persona\`); once created it's a normal entity
+  (\`list_personas\`, \`read_persona\`, \`update_persona\`, delete/restore/versions).
+- **prompt_snippet**: reusable prompt fragments. A normal entity in every
+  respect now (\`read_prompt_snippet\`, \`discard_prompt_snippet_draft\`,
+  everything else). Only wire-level oddity: \`list_deleted_prompt_snippets\`
+  uses a dedicated deleted collection and returns the backend \`items\` envelope.
+- **output_schema**: a reusable output contract, fully version-controlled and
+  publishable like the other memory entities. A tool's \`outputValidators\` (or
+  an agent's \`permissions.expected_output_schema_id\`) references one by id —
+  create it before you need to point something at it.
+- **flow**: a reusable workflow fragment in the authored-entity lifecycle.
+  \`create_flow\` and \`update_flow\` write draft state; execution uses
+  \`read_flow_published\` until approval completes. Use
+  \`request_publish_flow\` to request publish approval, and \`discard_flow_draft\`
+  when you need to reset the draft to last published state.
+
+## Structural workflow edits
+- \`apply_workflow_mutations\` takes a LIST of commands and applies them in order,
+  threading the version for you — pass the version you read, not one per command.
+- It is NOT transactional. If command N fails, the ones before it stay applied;
+  the error tells you how many landed and which index failed. Re-read and resume
+  from that index rather than replaying the whole list.
+
+## Triggers
+- A published workflow still does nothing until it has a trigger. Add one with
+  \`create_cron_schedule\`, \`create_webhook_trigger\`, or
+  \`create_conditional_trigger\`.
+- Trigger deletes are HARD deletes — no restore. Webhook tokens are shown once
+  at create/rotate and are never retrievable; hand them straight to your human
+  and never store one in an entity field.
+
+## Evaluating what you built
+- There is no findings endpoint and no evaluator entity. To judge a run, read it:
+  \`read_run\` (its \`validatorVerdicts\` and \`agentInvocations\`) and
+  \`read_run_trace\` (the step-by-step tool calls).
+- Runs are the only thing with a real archive state — \`archive_run\` is
+  reversible, \`bulk_delete_runs\` is not.
+
+## Secrets
+- Never handle a real credential. A connector's \`authConfig\` takes placeholders
+  only ("{{ MY_SECRET }}" or ""); a human fills the real value in Axonity. This
+  is enforced — a write carrying something that looks like a real secret is
+  rejected before it leaves this connector.
 
 ## Tenant
 - Your token fixes the tenant. You cannot act across tenants; never send a

package/dist/tools/conventions.js.map

@@ -1 +1 @@
-{"version":3,"file":"conventions.js","sourceRoot":"","sources":["../../src/tools/conventions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCnB,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,4EAA4E;QAC1E,qEAAqE,EACvE,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"conventions.js","sourceRoot":"","sources":["../../src/tools/conventions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgLnB,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,4EAA4E;QAC1E,qEAAqE,EACvE,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAC1E,CAAC;AACJ,CAAC"}

package/dist/tools/credentials.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The connector credential guard.
+ *
+ * A connector's `authConfig` must carry PLACEHOLDERS only — a human fills the
+ * real secret in Axonity, and the value never passes through an agent. This
+ * module enforces that on every path that can write a connector.
+ *
+ * Two independent defences, mirroring the backend's `secret_scrub` module:
+ *
+ * 1. **Structural** — credential-ish leaves (`clientSecret`, `apiKey`, …) must
+ *    be a placeholder. Applied only to keys that actually name a credential, so
+ *    legitimate neighbours (`authType: "bearer"`, `tokenUrl: "https://…"`)
+ *    are left alone. The earlier guard required EVERY value to be a placeholder,
+ *    which rejected correct connectors while missing nested ones entirely.
+ * 2. **Shape scan** — every string leaf, at any depth, is swept for known secret
+ *    formats, catching a credential parked in a field nobody thought to name.
+ *
+ * Findings name WHERE and WHAT KIND, never the matched value — an error message
+ * is not a safe place to echo a secret.
+ */
+/** Empty, or a `{{ … }}` template the human replaces in Axonity. */
+export declare function isPlaceholder(value: unknown): boolean;
+/**
+ * Walk `value` depth-first and collect every violation as `path: reason`.
+ * Exported for testing; `assertPlaceholderCredentials` is the enforcement point.
+ */
+export declare function findCredentialViolations(value: unknown, path?: string): string[];
+/**
+ * Throw if a connector's fields carry anything that looks like a real
+ * credential. Safe to call with any tool's fields — it is a no-op when there is
+ * no `authConfig`, which is what makes it cheap to apply to `create_tool` and
+ * `update_tool` as well as the connector-specific verbs.
+ */
+export declare function assertPlaceholderCredentials(fields: Record<string, unknown>): void;

package/dist/tools/credentials.js

@@ -0,0 +1,106 @@
+/**
+ * The connector credential guard.
+ *
+ * A connector's `authConfig` must carry PLACEHOLDERS only — a human fills the
+ * real secret in Axonity, and the value never passes through an agent. This
+ * module enforces that on every path that can write a connector.
+ *
+ * Two independent defences, mirroring the backend's `secret_scrub` module:
+ *
+ * 1. **Structural** — credential-ish leaves (`clientSecret`, `apiKey`, …) must
+ *    be a placeholder. Applied only to keys that actually name a credential, so
+ *    legitimate neighbours (`authType: "bearer"`, `tokenUrl: "https://…"`)
+ *    are left alone. The earlier guard required EVERY value to be a placeholder,
+ *    which rejected correct connectors while missing nested ones entirely.
+ * 2. **Shape scan** — every string leaf, at any depth, is swept for known secret
+ *    formats, catching a credential parked in a field nobody thought to name.
+ *
+ * Findings name WHERE and WHAT KIND, never the matched value — an error message
+ * is not a safe place to echo a secret.
+ */
+/** Keys whose value is a credential. Matched case- and separator-insensitively. */
+const CREDENTIAL_KEY = /(secret|password|passphrase|token|credential|apikey|privatekey|signingkey|authorization|clientkey)/;
+/**
+ * Suffixes that make a credential-ish key a LOCATOR rather than the secret
+ * itself — `tokenUrl` is an OAuth endpoint, `apiKeyName` is a header name.
+ * Without this, correct configs are rejected, which is what pushes an agent to
+ * work around the guard. The shape scan still covers these fields, so a real
+ * credential parked in one is caught anyway.
+ */
+const LOCATOR_SUFFIX = /(url|uri|endpoint|name|type|id|path|method|location|scope|expiresin|ttl)$/;
+/** Known secret shapes, mirroring the backend's `_SECRET_PATTERNS`. */
+const SECRET_PATTERNS = [
+    ["private key block", /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+    ["aws access key id", /\bAKIA[0-9A-Z]{16}\b/],
+    ["github token", /\bgh[pousr]_[A-Za-z0-9]{36,}\b/],
+    ["slack token", /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/],
+    ["google api key", /\bAIza[0-9A-Za-z_-]{35}\b/],
+    ["stripe secret key", /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/],
+    ["jwt", /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/],
+    ["credentials in url", /:\/\/[^/\s:@]+:[^/\s:@]+@/],
+];
+/** Empty, or a `{{ … }}` template the human replaces in Axonity. */
+export function isPlaceholder(value) {
+    if (value === "" || value === null || value === undefined)
+        return true;
+    return typeof value === "string" && /^\s*\{\{.*\}\}\s*$/.test(value);
+}
+function isCredentialKey(key) {
+    const normalized = key.replace(/[_\-\s]/g, "").toLowerCase();
+    if (LOCATOR_SUFFIX.test(normalized))
+        return false;
+    return CREDENTIAL_KEY.test(normalized);
+}
+/**
+ * Walk `value` depth-first and collect every violation as `path: reason`.
+ * Exported for testing; `assertPlaceholderCredentials` is the enforcement point.
+ */
+export function findCredentialViolations(value, path = "authConfig") {
+    const findings = [];
+    const walk = (node, at, keyIsCredential) => {
+        if (Array.isArray(node)) {
+            node.forEach((item, i) => walk(item, `${at}[${i}]`, keyIsCredential));
+            return;
+        }
+        if (node !== null && typeof node === "object") {
+            for (const [key, child] of Object.entries(node)) {
+                walk(child, `${at}.${key}`, isCredentialKey(key));
+            }
+            return;
+        }
+        if (typeof node === "string") {
+            for (const [label, pattern] of SECRET_PATTERNS) {
+                if (pattern.test(node)) {
+                    findings.push(`${at}: looks like a real ${label}`);
+                    return;
+                }
+            }
+        }
+        // A credential-named leaf must be a placeholder whatever its type.
+        if (keyIsCredential && !isPlaceholder(node)) {
+            findings.push(`${at}: must be a placeholder, not a real value`);
+        }
+    };
+    walk(value, path, false);
+    return findings;
+}
+/**
+ * Throw if a connector's fields carry anything that looks like a real
+ * credential. Safe to call with any tool's fields — it is a no-op when there is
+ * no `authConfig`, which is what makes it cheap to apply to `create_tool` and
+ * `update_tool` as well as the connector-specific verbs.
+ */
+export function assertPlaceholderCredentials(fields) {
+    const authConfig = fields.authConfig;
+    if (authConfig === undefined || authConfig === null)
+        return;
+    const findings = findCredentialViolations(authConfig);
+    if (findings.length === 0)
+        return;
+    throw new Error("authConfig must contain placeholders only — a human fills real secrets in " +
+        "the Axonity tool editor, and a credential must never pass through an " +
+        `agent. Use "{{ MY_SECRET }}" or "" instead.\n\n${findings
+            .map((f) => `  - ${f}`)
+            .join("\n")}`);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/tools/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/tools/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,mFAAmF;AACnF,MAAM,cAAc,GAClB,oGAAoG,CAAC;AAEvG;;;;;;GAMG;AACH,MAAM,cAAc,GAClB,2EAA2E,CAAC;AAE9E,uEAAuE;AACvE,MAAM,eAAe,GAAuB;IAC1C,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;IAC3D,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;IAC7C,CAAC,cAAc,EAAE,gCAAgC,CAAC;IAClD,CAAC,aAAa,EAAE,kCAAkC,CAAC;IACnD,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;IAC/C,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;IAC9D,CAAC,KAAK,EAAE,gEAAgE,CAAC;IACzE,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;CACpD,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,IAAI,GAAG,YAAY;IAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAU,EAAE,eAAwB,EAAQ,EAAE;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBAC3E,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,eAAe,EAAE,CAAC;gBAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;oBACnD,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,IAAI,eAAe,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAA+B;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO;IAE5D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,IAAI,KAAK,CACb,4EAA4E;QAC1E,uEAAuE;QACvE,kDAAkD,QAAQ;aACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;aACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAClB,CAAC;AACJ,CAAC"}

package/dist/tools/extras.d.ts

@@ -1,14 +1,23 @@
 /**
- * Secondary MCP tools (epic #652 C5): personas (agent-scoped), connectors
- * (a tool subtype), and attaching memory to a target.
+ * Secondary MCP tools: the agent-scoped persona create/read (personas
+ * themselves are a full generic entity — see index.ts — but creation and the
+ * by-agent read have no equivalent generic route), connectors (a tool
+ * subtype), attaching memory to a target, and a few standalone one-offs.
  *
  * These use routes with shapes that don't fit the generic entity registrar:
- * personas are 1:1 with an agent (no standalone list), connectors are a tool
- * with `type: "connector"` and MUST NOT carry real credentials, and attach is a
- * path-only link.
+ * a persona is created only through its agent, connectors are a tool with
+ * `type: "connector"` and MUST NOT carry real credentials, and attach/detach
+ * is a path-only link.
  */
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { AxonityClient } from "../client.js";
 export declare function registerPersonaTools(server: McpServer, client: AxonityClient): void;
 export declare function registerConnectorTools(server: McpServer, client: AxonityClient): void;
 export declare function registerAttachTools(server: McpServer, client: AxonityClient): void;
+/**
+ * Small standalone tools that don't fit any of the other groupings: the
+ * system-tools catalog (read-only — there is no grant/revoke route; enabling
+ * one for an agent means writing `systemToolIds` via `update_agent`), and
+ * cloning a flow/prompt-snippet into a tenant-owned copy.
+ */
+export declare function registerCatalogTools(server: McpServer, client: AxonityClient): void;