@axonity-ai/mcp 0.6.0 → 0.8.0

package/dist/tools/runs.js

@@ -8,6 +8,30 @@
  *
  * Runs are also the only thing in the product with a real archive state —
  * entities have soft-delete, runs have archive/unarchive.
+ *
+ * READING A RUN NEED NOT COST THE WHOLE RUN (axonity-mcp#57). `read_run`
+ * returns the document; `read_run_outline` returns its table of contents, whose
+ * size follows the run's SHAPE rather than its content because it carries no
+ * bodies. The two reads that serve those bodies on open — `read_run_value` and
+ * `read_run_invocation_messages` — are the only reason the outline can stay
+ * small, so they belong with it rather than as conveniences.
+ *
+ * A RUN THAT ASKS A QUESTION CAN BE ANSWERED (#45 M9). `axonity_conventions`
+ * tells an agent to `start_workflow_run` to test a workflow end to end. A run
+ * that reaches an `ask_user` step parks there and waits — so, without a way to
+ * answer, the guide prescribed a loop the connector could not finish. The two
+ * tools that unpark a run supply the INPUT it is waiting for, which is not the
+ * same act as deciding a review:
+ *   - `answer_run_question` / `send_run_message` are here, and since #59 so is
+ *     `complete_run_step` — one route over two acts. Choosing a DECISION step's
+ *     branch is routing; completing a MANUAL step asserts that human work
+ *     happened, which the platform then treats as fact. The tool says so and
+ *     takes a `confirm`, because leaving it out left the guide prescribing an
+ *     end-to-end test that hits a wall at the first manual step — the same
+ *     defect `answer_run_question` was added to fix.
+ *   - `POST /runs/{id}/steps/{id}/plan-approval` is NOT, and
+ *     `POST /runs/{id}/restart` cannot be. Both are recorded, with the reason,
+ *     in `test/exclusions.test.ts` — as a decision rather than an omission.
  */
 import { z } from "zod";
 import { guard, jsonResult } from "./result.js";
@@ -19,18 +43,37 @@ export function registerRunTools(server, client) {
         "authored. This EXECUTES: it runs the PUBLISHED workflow against live " +
         "infrastructure (models, connectors), so it can incur cost and cause real " +
         "side effects. It does not run your unpublished draft. After starting, " +
-        "follow it with read_run / read_run_trace / read_run_cost. Optionally pass " +
-        "triggerInput to feed the workflow's trigger.", {
+        "follow it with read_run / read_run_trace / read_run_cost. " +
+        "\n\nA workflow can have MORE THAN ONE start (a button and a schedule, " +
+        "say). Read read_workflow_trigger_parameters first, then name the one you " +
+        "mean with triggerId and build triggerInput from the process's `inputs` " +
+        "PLUS whatever that start declares on top in its own `parameters` — a " +
+        "triggerId that does not exist is a 422 listing the ones that do, never a " +
+        "quiet fallback to a different start. " +
+        "\n\nA run may PARK on a step that asks a question instead of finishing. " +
+        "read_run_waiting_on says what it is parked on; answer_run_question and " +
+        "send_run_message are how it moves again.", {
         workflowId: z.string().describe("The workflow's id."),
+        triggerId: z
+            .string()
+            .optional()
+            .describe("Which start to fire, from read_workflow_trigger_parameters' " +
+            "`triggers[].id`. Omit and the workflow's FIRST trigger is used — " +
+            "the historical behaviour, and an arbitrary choice on a workflow " +
+            "with several starts, so name one whenever more than one exists."),
         triggerInput: z
             .record(z.unknown())
             .optional()
-            .describe("Input payload for the workflow's trigger. Omit for none."),
+            .describe("Input payload for the start you are firing, keyed by each " +
+            "parameter's `name`. Omit for none. Do NOT send a parameter marked " +
+            "`pinned` — the author owns that value and it is overwritten on " +
+            "every run regardless of what you send."),
         manualPhases: z
             .boolean()
             .optional()
             .describe("Run with manual phase gating. Defaults to false."),
-    }, async ({ workflowId, triggerInput, manualPhases }) => guard(async () => jsonResult(await client.post(`/api/v1/workflows/${workflowId}/runs`, {
+    }, async ({ workflowId, triggerId, triggerInput, manualPhases }) => guard(async () => jsonResult(await client.post(`/api/v1/workflows/${workflowId}/runs`, {
+        ...(triggerId ? { triggerId } : {}),
         ...(triggerInput ? { triggerInput } : {}),
         ...(manualPhases === undefined ? {} : { manualPhases }),
     }))));
@@ -48,13 +91,19 @@ export function registerRunTools(server, client) {
     server.tool("list_runs", "List workflow runs across the tenant, newest first. Archived runs are " +
         "excluded unless includeArchived is true. To list runs of ONE workflow, " +
         "use list_workflow_runs instead — this route has no workflow filter." +
-        "\n\nTHIS ONE IS NOT PAGED THE SAME WAY: it answers with a BARE ARRAY, " +
-        "no envelope, no total and no cursor. You get at most limit rows (default " +
-        "50, and a larger value is silently clamped to 200), so a result whose " +
-        "length equals the limit you asked for is the signal that MORE MAY EXIST " +
-        "— nothing in the response says so. Walk it with offset until you get a " +
-        "short page. Unlike list_workflow_runs, this route does list per-item " +
-        "FOR EACH runs alongside their launches.", {
+        "\n\nTHE RESPONSE IS ONE PAGE, NOT THE FULL LIST: " +
+        "{ items, nextCursor, pageSize, hasMore }. Default page size is 20, max " +
+        "200. While hasMore is true you have NOT seen every run — pass the " +
+        "response's nextCursor back as cursor to get the next page, and repeat " +
+        "until nextCursor is null. Counting or concluding anything (\"how many " +
+        "failed?\") from a single page with hasMore: true gives a confidently " +
+        "wrong answer. " +
+        "\n\nRuns arrive at ~78/min during a fan-out, which is why the position " +
+        "is a cursor and not an offset: an offset window under that rate skips " +
+        "and repeats rows between pages. Never build a cursor — echo back the " +
+        "one you were given. " +
+        "\n\nUnlike list_workflow_runs, this route does list per-item FOR EACH " +
+        "runs alongside their launches.", {
         status: z
             .string()
             .optional()
@@ -66,21 +115,20 @@ export function registerRunTools(server, client) {
             .number()
             .int()
             .optional()
-            .describe("Rows to return. Defaults to 50, silently clamped to 200 — asking " +
-            "for more does not fail, it just returns 200."),
-        offset: z
-            .number()
-            .int()
+            .describe("Page size. Defaults to 20, silently clamped to 200 — asking for " +
+            "more does not fail, it just returns 200."),
+        cursor: z
+            .string()
             .optional()
-            .describe("Rows to skip. Defaults to 0. Advance it by the page size to walk " +
-            "the whole list; stop when a page comes back short."),
-    }, async ({ status, createdAfter, createdBefore, includeArchived, limit, offset }) => guard(async () => jsonResult(await client.get("/api/v1/runs", {
+            .describe("Opaque continuation cursor from the previous response's nextCursor. " +
+            "Omit for the first page. Do not parse or construct one."),
+    }, async ({ status, createdAfter, createdBefore, includeArchived, limit, cursor }) => guard(async () => jsonResult(await client.get("/api/v1/runs", {
         status,
         created_after: createdAfter,
         created_before: createdBefore,
         include_archived: includeArchived,
         limit,
-        offset,
+        cursor,
     }))));
     server.tool("list_workflow_runs", "List one workflow's LAUNCHES, newest first. Note this route takes " +
         "archivedOnly (show ONLY archived launches), which is not the same as " +
@@ -98,8 +146,18 @@ export function registerRunTools(server, client) {
         "entry — not 4,415. That entry carries forEachProgress " +
         "({ total, pending, inProgress, succeeded, failed, … }), which is where " +
         "per-item counts come from. Do not read the number of items on a page as " +
-        "a number of runs.", {
+        "a number of runs." +
+        "\n\nFilter with status BEFORE paging, not after: the filter is applied " +
+        "in the query, so \"which launches failed?\" is one page rather than a " +
+        "walk through every page keeping the failures. A status this backend " +
+        "does not know is a 422 naming the ones it does — this connector " +
+        "deliberately keeps no copy of that list.", {
         workflowId: z.string().describe("The workflow's id."),
+        status: z
+            .array(z.string())
+            .optional()
+            .describe('Restrict to these launch statuses, e.g. ["failed", "cancelled"]. ' +
+            "Several are a union. Omit for every status."),
         archivedOnly: z
             .boolean()
             .optional()
@@ -117,23 +175,243 @@ export function registerRunTools(server, client) {
             "nextCursor verbatim. Omit for the first page. It marks a POSITION, " +
             "not an offset, so it stays correct while new runs are being " +
             "inserted. A token you built or edited yourself is a 400."),
-    }, async ({ workflowId, archivedOnly, limit, cursor }) => guard(async () => 
+    }, async ({ workflowId, status, archivedOnly, limit, cursor }) => guard(async () => 
     // The page envelope is forwarded WHOLE. Unwrapping to items would drop
     // hasMore/nextCursor and recreate, one layer up, exactly the silent
     // truncation this tool exists to make visible (#37).
     jsonResult(await client.get(`/api/v1/workflows/${workflowId}/runs`, {
+        // This route reads a REPEATED key (?status=a&status=b); the
+        // tenant-wide `list_runs` reads one comma-separated string. A real
+        // backend difference, so each tool sends what its route declares.
+        status,
         archived_only: archivedOnly,
         limit,
         cursor,
     }))));
-    server.tool("read_run", "Read one run in full: status, per-step state, the workflow snapshot it " +
-        "ran against, trigger input, agent invocations, and validator verdicts. " +
-        "The verdicts are the closest thing to evaluator findings — there is no " +
-        "separate findings endpoint.", { runId: z.string().describe("The run's id.") }, async ({ runId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}`))));
+    server.tool("read_run", "Read one run: status, per-step state, trigger input, agent invocations, " +
+        "and validator verdicts. The verdicts are the closest thing to evaluator " +
+        "findings — there is no separate findings endpoint. " +
+        "\n\nThe WORKFLOW SNAPSHOT is omitted by default. It is the immutable " +
+        "copy of the document the run executed, and it measured 23,809 of 29,414 " +
+        "bytes — 81% — of one real response, none of which says anything about " +
+        "how the run went. An oversized response turns a call that SUCCEEDED into " +
+        "an error, which is the same trap apply_workflow_mutations avoids by not " +
+        "forwarding a document either. Pass includeSnapshot: true when you " +
+        "actually need to see what the run executed (e.g. it behaved unlike the " +
+        "current draft and you want to know which document it ran).", {
+        runId: z.string().describe("The run's id."),
+        includeSnapshot: z
+            .boolean()
+            .optional()
+            .describe("Include `workflowSnapshot`, the document this run executed. " +
+            "Defaults to FALSE here — the backend's own default is true, and " +
+            "this tool overrides it because the snapshot is typically most of " +
+            "the response and never the answer to a question about the run."),
+    }, async ({ runId, includeSnapshot }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}`, {
+        includeSnapshot: includeSnapshot === true,
+    }))));
+    server.tool("list_todo_steps", "The steps across the TENANT that are waiting on a human — every parked " +
+        "run, whatever it is parked on. This is the list you read to answer 'is " +
+        "anything stuck on me?' without knowing which run to look at. " +
+        "\n\nTHE RESPONSE IS ONE PAGE, NOT THE FULL LIST: " +
+        "{ items, nextCursor, pageSize, hasMore }. While hasMore is true you have " +
+        "NOT seen every waiting step — pass the response's nextCursor back as " +
+        "cursor and repeat until nextCursor is null. " +
+        "\n\nNote what the page bounds: the cursor walks the waiting RUNS, and " +
+        "one run can carry several waiting steps, so `items` may be LONGER than " +
+        "pageSize. That is not a bug and not an overflow — pageSize bounds what " +
+        "was read, not what came back. A fan-out can park thousands of items on " +
+        "one manual step at once, which is why this list is paged at all. " +
+        "\n\nread_run_waiting_on answers the same question for a run you already " +
+        "have in your hand.", {
+        limit: z
+            .number()
+            .int()
+            .optional()
+            .describe("Page size, over the waiting runs. Omit for the route's default."),
+        cursor: z
+            .string()
+            .optional()
+            .describe("Opaque continuation cursor from the previous response's nextCursor. " +
+            "Omit for the first page. Do not parse or construct one."),
+    }, async ({ limit, cursor }) => guard(async () => jsonResult(await client.get("/api/v1/runs/todo", { limit, cursor }))));
+    server.tool("list_run_session_memory", "List the files an agent wrote to SESSION MEMORY during a run — title, " +
+        "kind, tags, size and timestamp for each. Bodies are not included; fetch " +
+        "one with read_run_session_memory_file. " +
+        "\n\nThis is what an agent left itself between steps, and it is often the " +
+        "answer to 'why did it decide that?' when the trace shows the decision " +
+        "but not what it was reading. " +
+        "\n\nAn empty list is an answer: this run wrote nothing to session memory.", { runId: z.string().describe("The run's id.") }, async ({ runId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/session-memory`))));
+    server.tool("read_run_session_memory_file", "Read ONE session-memory file's text, by the id from " +
+        "list_run_session_memory. The listing carries metadata and this carries " +
+        "the body — up to 200 files per run, so fetching all of them to read one " +
+        "is the mistake the split exists to prevent. " +
+        "\n\nThe file id is scoped to THIS run's session folder: one borrowed " +
+        "from another run is a 404, not someone else's file.", {
+        runId: z.string().describe("The run's id."),
+        fileId: z.string().describe("The file's id, from list_run_session_memory."),
+    }, async ({ runId, fileId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/session-memory/${fileId}`))));
+    server.tool("read_run_outline", "A run's TABLE OF CONTENTS — everything that happened, at the depth it " +
+        "happened: the run, its steps, and the items a fan-out step handed out. " +
+        "Flat rows with parent pointers; nest them yourself. " +
+        "\n\nREAD THIS FIRST when you want to know the shape of a run. It carries " +
+        "no bodies, so its size follows the run's SHAPE rather than its content — " +
+        "a launch over four thousand items costs about what one over four costs, " +
+        "where read_run pays for the whole document. Then fetch only what you " +
+        "actually want to look at: read_run_value for a step value, " +
+        "read_run_invocation_messages for one agent's transcript. " +
+        "\n\n`itemCap` bounds how many items are LISTED per fan-out step. The rest " +
+        "are counted in that step's `counts.truncated` and live on the paged " +
+        "item-results surface — nothing is dropped in silence.", {
+        runId: z.string().describe("The run's id."),
+        itemCap: z
+            .number()
+            .int()
+            .optional()
+            .describe("Max items listed per fan-out step. Anything beyond it is counted in " +
+            "`counts.truncated`, not hidden."),
+    }, async ({ runId, itemCap }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/outline`, { item_cap: itemCap }))));
+    server.tool("read_run_value", "Fetch ONE large step value by its digest — the body behind a marker in " +
+        "read_run's `stepStates`. A run detail carries handles rather than " +
+        "megabytes; this is how you open one of them, when you have decided you " +
+        "need it. " +
+        "\n\nThe digest is scoped to THIS run: one you saw in another run is not " +
+        "readable here, and asking gives a 404 rather than someone else's value.", {
+        runId: z.string().describe("The run's id."),
+        digest: z
+            .string()
+            .describe("The value's digest, from the marker in read_run's `stepStates`."),
+    }, async ({ runId, digest }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/values/${digest}`))));
+    server.tool("read_run_invocation_messages", "Read ONE agent invocation's transcript — the conversation behind a row in " +
+        "read_run's `agentInvocations`, which lists each invocation with its " +
+        "metadata and a `messageCount` but not its messages. " +
+        "\n\nThis is the read for 'what did this agent actually say?'. Fetch the " +
+        "one invocation you are asking about: a run's transcripts together are " +
+        "routinely larger than everything else in it combined.", {
+        runId: z.string().describe("The run's id."),
+        invocationId: z
+            .string()
+            .describe("The invocation's id, from read_run's `agentInvocations`."),
+    }, async ({ runId, invocationId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/invocations/${invocationId}/messages`))));
     server.tool("read_run_trace", "Read a run's chronological tool-call trace — each entry has the step, the " +
         "tool, its arguments, its output, and any error. This is what you read to " +
         "work out WHY a run behaved as it did.", { runId: z.string().describe("The run's id.") }, async ({ runId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/trace`))));
     server.tool("read_run_cost", "Read a run's token and cost breakdown, per agent and model.", { runId: z.string().describe("The run's id.") }, async ({ runId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/cost`))));
+    // ---- Why a run is parked, and what it did ------------------------------
+    server.tool("read_run_waiting_on", "Why a run is PARKED. A run in `waiting` or `input_required` is not stuck " +
+        "and not slow — it is holding for something, and this lists every pending " +
+        "wake-task targeting it: a question asked of a person, a timer, a callback " +
+        "that has not arrived. Read this before concluding a test run failed. " +
+        "\n\nAn EMPTY list is a real answer, not an error: the run may have every " +
+        "wake already resolved and be about to resume. " +
+        "\n\nWhen the answer is a question, answer_run_question is what unparks it.", {
+        runId: z.string().describe("The run's id."),
+        limit: z.number().int().optional().describe("How many to return. Default 50."),
+    }, async ({ runId, limit }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/waiting-on`, { limit }))));
+    server.tool("list_run_items", "One page of the ITEM RESULTS inside a launch — the rows a FOR EACH " +
+        "produced. This is what list_workflow_runs does NOT show: a launch over " +
+        "4,415 people is one entry there and 4,415 rows here. Each row's `id` is " +
+        "a real run you can read_run for that one item's detail. " +
+        "\n\nTHE RESPONSE IS ONE PAGE: { items, nextCursor, pageSize, hasMore }, " +
+        "20 by default and max 200. Follow nextCursor until it is null. " +
+        "\n\nFILTER WITH `outcome`, DO NOT FILTER THE PAGE. It is applied in the " +
+        "database: on a 4,415-item launch the twelve failures are scattered " +
+        "through the middle, so keeping the failed rows out of page one shows you " +
+        "none and reads as \"no failures\". For the totals alone use " +
+        "read_run_items_summary — it is one call instead of a walk.", {
+        runId: z.string().describe("The launch's run id."),
+        outcome: z
+            .enum(["all", "failed", "skipped"])
+            .optional()
+            .describe('Which items to return. "failed" covers items that never produced a ' +
+            'result; "skipped" covers items a gate deliberately declined. ' +
+            'Defaults to "all".'),
+        limit: z.number().int().optional().describe("Page size. Default 20, max 200."),
+        cursor: z
+            .string()
+            .optional()
+            .describe("Opaque continuation cursor from the previous response's nextCursor. " +
+            "Omit for the first page. Do not parse or construct one."),
+    }, async ({ runId, outcome, limit, cursor }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/items`, { outcome, limit, cursor }))));
+    server.tool("read_run_items_summary", "The roll-up over a launch's items — \"4,415 processed · 12 failed\" — in " +
+        "ONE call, with no paging. Ask this before list_run_items: it answers " +
+        "\"did anything fail?\" outright, where counting a page answers it wrongly. " +
+        "A launch that never fanned out reports zeroes.", { runId: z.string().describe("The launch's run id.") }, async ({ runId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/items/summary`))));
+    server.tool("list_run_tasks", "Every task and child run descending from this run: for-each iterations " +
+        "still queued, delegated agent tasks, callback wake-tasks, and the " +
+        "iterations already promoted to runs of their own. Use it to see what a " +
+        "run set in motion beyond its own steps — a run can look idle while its " +
+        "children are doing all the work.", {
+        runId: z.string().describe("The run's id."),
+        limit: z.number().int().optional().describe("How many to return. Default 200."),
+    }, async ({ runId, limit }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/tasks`, { limit }))));
+    server.tool("read_run_for_each_progress", "Per-state counts for ONE fan-out batch on a run: total, pending, " +
+        "inProgress, succeeded, failed, deadLetter. This is how you watch a FOR " +
+        "EACH step advance while it is still running, instead of re-reading the " +
+        "whole run. Get the batchId from list_run_tasks or the step's state in " +
+        "read_run.", {
+        runId: z.string().describe("The run's id."),
+        batchId: z.string().describe("The FOR EACH batch's id."),
+    }, async ({ runId, batchId }) => guard(async () => jsonResult(await client.get(`/api/v1/runs/${runId}/for-each/${batchId}/progress`))));
+    // ---- Unparking a run ---------------------------------------------------
+    server.tool("answer_run_question", "Answer an `ask_user` step a run is parked on, so the run resumes. This is " +
+        "what makes \"start a run and see what it does\" finishable: without it a " +
+        "workflow that asks anything waits forever and a test never returns a " +
+        "verdict. Find the parked step with read_run_waiting_on or read_run. " +
+        "\n\nThe answer is recorded as the ANSWER A PERSON WOULD HAVE GIVEN and " +
+        "the run proceeds on it. On a run a human is depending on, that is their " +
+        "decision to make, not yours — answer your own test runs, and ask before " +
+        "answering someone else's. Returns the run's updated detail.", {
+        runId: z.string().describe("The run's id."),
+        stepId: z.string().describe("The suspended step's id, from read_run_waiting_on."),
+        answer: z.string().describe("The answer text the step is waiting for."),
+    }, async ({ runId, stepId, answer }) => guard(async () => jsonResult(await client.post(`/api/v1/runs/${runId}/steps/${stepId}/answer`, { answer }))));
+    server.tool("complete_run_step", "Complete a MANUAL or DECISION step a run is parked on, so the run " +
+        "resumes. Along with answer_run_question, this is what makes \"start a " +
+        "run and see what it does\" finishable — a workflow with a manual step " +
+        "otherwise waits forever and a test never returns a verdict. " +
+        "\n\nONE ROUTE, TWO VERY DIFFERENT ACTS. Know which you are doing: " +
+        "\n- On a DECISION step you are CHOOSING A BRANCH. Pass `selectedBranch`. " +
+        "That is a routing choice, the same kind of act as answering a question. " +
+        "\n- On a MANUAL step you are ASSERTING THAT HUMAN WORK HAPPENED. The " +
+        "platform then treats that as fact and everything downstream proceeds on " +
+        "it. Only do this when a person has told you the work is done, or on a " +
+        "test run of your own where nothing real depended on the step. Never to " +
+        "get a stuck run moving. " +
+        "\n\nFind the parked step with read_run_waiting_on. Returns the run's " +
+        "updated detail. Deciding a PLAN APPROVAL is a different thing again and " +
+        "is deliberately not available here — that step exists to get a human's " +
+        "review, and an agent approving it would often be approving its own plan.", {
+        runId: z.string().describe("The run's id."),
+        stepId: z.string().describe("The parked step's id, from read_run_waiting_on."),
+        selectedBranch: z
+            .string()
+            .optional()
+            .describe("For a DECISION step: which branch to take."),
+        output: z
+            .record(z.unknown())
+            .optional()
+            .describe("For a MANUAL step: the result the step should carry forward."),
+        structuredOutputs: z
+            .record(z.unknown())
+            .optional()
+            .describe("Values for the step's declared output schema, when it has one."),
+        confirm: z
+            .literal(true)
+            .describe("Must be true. Acknowledges that on a manual step you are asserting " +
+            "human work was done."),
+    }, async ({ runId, stepId, selectedBranch, output, structuredOutputs }) => guard(async () => jsonResult(await client.post(`/api/v1/runs/${runId}/steps/${stepId}/complete`, {
+        ...(selectedBranch !== undefined ? { selectedBranch } : {}),
+        ...(output !== undefined ? { output } : {}),
+        ...(structuredOutputs !== undefined ? { structuredOutputs } : {}),
+    }))));
+    server.tool("send_run_message", "Send a user turn to a CONVERSATION run that is waiting on one. The server " +
+        "resolves which step is parked, so unlike answer_run_question this takes " +
+        "no stepId. Same caution: the turn is recorded as a person's, so use it " +
+        "on runs you started. Returns the run's updated detail.", {
+        runId: z.string().describe("The conversation run's id."),
+        message: z.string().min(1).describe("The user turn to submit."),
+    }, async ({ runId, message }) => guard(async () => jsonResult(await client.post(`/api/v1/runs/${runId}/message`, { message }))));
     server.tool("read_runs_summary", "Counts of runs by state across the tenant (running, waiting, completed, " +
         "failed, expired, total).", {}, async () => guard(async () => jsonResult(await client.get("/api/v1/runs/summary"))));
     server.tool("archive_run", "Archive a run — hides it from the default run list without deleting it. " +

package/dist/tools/runs.js.map

@@ -1 +1 @@
-{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/tools/runs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,OAAO,GAAG,CAAC;KACd,OAAO,CAAC,IAAI,CAAC;KACb,QAAQ,CAAC,oEAAoE,CAAC,CAAC;AAElF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAqB;IACvE,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,uEAAuE;QACrE,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,8CAA8C,EAChD;QACE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CAAC,0DAA0D,CAAC;QACvE,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,kDAAkD,CAAC;KAChE,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,CACnD,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,IAAI,CAAC,qBAAqB,UAAU,OAAO,EAAE;QACxD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,4EAA4E;QAC1E,oCAAoC,EACtC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CACnF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,2EAA2E;QACzE,yEAAyE;QACzE,oCAAoC,EACtC;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,OAAO;KACjB,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,wEAAwE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,yCAAyC,EAC3C;QACE,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gEAAgE,CACjE;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACtE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,mEAAmE;YACjE,8CAA8C,CACjD;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,mEAAmE;YACjE,oDAAoD,CACvD;KACJ,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAChF,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE;QAC/B,MAAM;QACN,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,aAAa;QAC7B,gBAAgB,EAAE,eAAe;QACjC,KAAK;QACL,MAAM;KACP,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,oEAAoE;QAClE,uEAAuE;QACvE,6BAA6B;QAC7B,mDAAmD;QACnD,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,eAAe;QACf,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,wDAAwD;QACxD,yEAAyE;QACzE,0EAA0E;QAC1E,mBAAmB,EACrB;QACE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,yDAAyD,CAAC;QACtE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,wBAAwB,CAC3B;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,qEAAqE;YACrE,8DAA8D;YAC9D,0DAA0D,CAC7D;KACJ,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACpD,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,uEAAuE;IACvE,oEAAoE;IACpE,qDAAqD;IACrD,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,UAAU,OAAO,EAAE;QACvD,aAAa,EAAE,YAAY;QAC3B,KAAK;QACL,MAAM;KACP,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,EACV,yEAAyE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,6BAA6B,EAC/B,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC,CAC3E,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,4EAA4E;QAC1E,2EAA2E;QAC3E,uCAAuC,EACzC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,CACjF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,6DAA6D,EAC7D,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,CAChF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,0EAA0E;QACxE,0BAA0B,EAC5B,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,0EAA0E;QACxE,gCAAgC,EAClC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,kDAAkD,EAClD,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,CACtF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,oEAAoE;QAClE,kEAAkE,EACpE;QACE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KAChF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CACvE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,0EAA0E;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,wEAAwE,EAC1E;QACE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC9E,OAAO,EAAE,OAAO;KACjB,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CACtE,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/tools/runs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,OAAO,GAAG,CAAC;KACd,OAAO,CAAC,IAAI,CAAC;KACb,QAAQ,CAAC,oEAAoE,CAAC,CAAC;AAElF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAqB;IACvE,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,uEAAuE;QACrE,uEAAuE;QACvE,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,uCAAuC;QACvC,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C,EAC5C;QACE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,8DAA8D;YAC5D,mEAAmE;YACnE,kEAAkE;YAClE,iEAAiE,CACpE;QACH,YAAY,EAAE,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CACP,4DAA4D;YAC1D,oEAAoE;YACpE,iEAAiE;YACjE,wCAAwC,CAC3C;QACH,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,kDAAkD,CAAC;KAChE,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,CAC9D,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,IAAI,CAAC,qBAAqB,UAAU,OAAO,EAAE;QACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,4EAA4E;QAC1E,oCAAoC,EACtC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CACnF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,2EAA2E;QACzE,yEAAyE;QACzE,oCAAoC,EACtC;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,OAAO;KACjB,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,WAAW,EACX,wEAAwE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,mDAAmD;QACnD,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,gBAAgB;QAChB,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,sBAAsB;QACtB,wEAAwE;QACxE,gCAAgC,EAClC;QACE,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gEAAgE,CACjE;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACrE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACtE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,kEAAkE;YAChE,0CAA0C,CAC7C;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE;YACpE,yDAAyD,CAC5D;KACJ,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAChF,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE;QAC/B,MAAM;QACN,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,aAAa;QAC7B,gBAAgB,EAAE,eAAe;QACjC,KAAK;QACL,MAAM;KACP,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,oEAAoE;QAClE,uEAAuE;QACvE,6BAA6B;QAC7B,mDAAmD;QACnD,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,eAAe;QACf,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,wDAAwD;QACxD,yEAAyE;QACzE,0EAA0E;QAC1E,mBAAmB;QACnB,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,0CAA0C,EAC5C;QACE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,mEAAmE;YACjE,6CAA6C,CAChD;QACH,YAAY,EAAE,CAAC;aACZ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,yDAAyD,CAAC;QACtE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,wBAAwB,CAC3B;QACH,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,+DAA+D;YAC7D,qEAAqE;YACrE,8DAA8D;YAC9D,0DAA0D,CAC7D;KACJ,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5D,KAAK,CAAC,KAAK,IAAI,EAAE;IACf,uEAAuE;IACvE,oEAAoE;IACpE,qDAAqD;IACrD,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,qBAAqB,UAAU,OAAO,EAAE;QACvD,4DAA4D;QAC5D,mEAAmE;QACnE,kEAAkE;QAClE,MAAM;QACN,aAAa,EAAE,YAAY;QAC3B,KAAK;QACL,MAAM;KACP,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,UAAU,EACV,0EAA0E;QACxE,0EAA0E;QAC1E,qDAAqD;QACrD,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,yEAAyE;QACzE,4DAA4D,EAC9D;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,8DAA8D;YAC5D,kEAAkE;YAClE,mEAAmE;YACnE,gEAAgE,CACnE;KACJ,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CACnC,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,EAAE;QACxC,eAAe,EAAE,eAAe,KAAK,IAAI;KAC1C,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,yEAAyE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,mDAAmD;QACnD,2EAA2E;QAC3E,uEAAuE;QACvE,8CAA8C;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,oBAAoB,EACtB;QACE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,iEAAiE,CAAC;QAC9E,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE;YACpE,yDAAyD,CAC5D;KACJ,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAC1F,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,wEAAwE;QACtE,0EAA0E;QAC1E,yCAAyC;QACzC,2EAA2E;QAC3E,wEAAwE;QACxE,+BAA+B;QAC/B,2EAA2E,EAC7E,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,iBAAiB,CAAC,CAAC,CACrE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,sDAAsD;QACpD,yEAAyE;QACzE,0EAA0E;QAC1E,8CAA8C;QAC9C,uEAAuE;QACvE,qDAAqD,EACvD;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KAC5E,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,mBAAmB,MAAM,EAAE,CAAC,CAAC,CAC/E,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,wEAAwE;QACtE,yEAAyE;QACzE,sDAAsD;QACtD,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,6DAA6D;QAC7D,2DAA2D;QAC3D,4EAA4E;QAC5E,sEAAsE;QACtE,uDAAuD,EACzD;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE;YACpE,iCAAiC,CACpC;KACJ,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CACzE,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,yEAAyE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,WAAW;QACX,0EAA0E;QAC1E,yEAAyE,EAC3E;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,CAAC,iEAAiE,CAAC;KAC/E,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,WAAW,MAAM,EAAE,CAAC,CAAC,CACvE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,4EAA4E;QAC1E,sEAAsE;QACtE,sDAAsD;QACtD,0EAA0E;QAC1E,wEAAwE;QACxE,uDAAuD,EACzD;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,0DAA0D,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAChC,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,YAAY,WAAW,CAAC,CAC/E,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,4EAA4E;QAC1E,2EAA2E;QAC3E,uCAAuC,EACzC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,CACjF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,6DAA6D,EAC7D,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,CAChF,CAAC;IAEF,2EAA2E;IAE3E,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,2EAA2E;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,gDAAgD;QAChD,4EAA4E,EAC9E;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;KAC/E,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CACzB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAC5E,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,qEAAqE;QACnE,yEAAyE;QACzE,0EAA0E;QAC1E,0DAA0D;QAC1D,0EAA0E;QAC1E,iEAAiE;QACjE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,8DAA8D;QAC9D,4DAA4D,EAC9D;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAClD,OAAO,EAAE,CAAC;aACP,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;aAClC,QAAQ,EAAE;aACV,QAAQ,CACP,qEAAqE;YACnE,+DAA+D;YAC/D,oBAAoB,CACvB;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QAC9E,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE;YACpE,yDAAyD,CAC5D;KACJ,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1C,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAC5E,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,2EAA2E;QACzE,uEAAuE;QACvE,6EAA6E;QAC7E,gDAAgD,EAClD,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EACtD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,gBAAgB,CAAC,CAAC,CACpE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,gBAAgB,EAChB,yEAAyE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,kCAAkC,EACpC;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAChF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CACzB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,4BAA4B,EAC5B,mEAAmE;QACjE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,WAAW,EACb;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;KACzD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,KAAK,aAAa,OAAO,WAAW,CAAC,CACvE,CACF,CACJ,CAAC;IAEF,2EAA2E;IAE3E,MAAM,CAAC,IAAI,CACT,qBAAqB,EACrB,4EAA4E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,6DAA6D,EAC/D;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;QACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAC9E,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,oEAAoE;QAClE,wEAAwE;QACxE,wEAAwE;QACxE,8DAA8D;QAC9D,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,0BAA0B;QAC1B,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E,EAC5E;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QAC9E,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,4CAA4C,CAAC;QACzD,MAAM,EAAE,CAAC;aACN,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CAAC,8DAA8D,CAAC;QAC3E,iBAAiB,EAAE,CAAC;aACjB,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;aACnB,QAAQ,EAAE;aACV,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,OAAO,EAAE,CAAC;aACP,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,qEAAqE;YACnE,sBAAsB,CACzB;KACJ,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,CACrE,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,MAAM,WAAW,EAAE;QAClE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,4EAA4E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD,EAC1D;QACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QACxD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;KAChE,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAC5E,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,0EAA0E;QACxE,0BAA0B,EAC5B,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,0EAA0E;QACxE,gCAAgC,EAClC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,kDAAkD,EAClD,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAC/C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClB,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,CACtF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,oEAAoE;QAClE,kEAAkE,EACpE;QACE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KAChF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CACvE,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,kBAAkB,EAClB,0EAA0E;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,wEAAwE,EAC1E;QACE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAC9E,OAAO,EAAE,OAAO;KACjB,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACnB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CACtE,CACJ,CAAC;AACJ,CAAC"}

package/dist/tools/secrets.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Reading the tenant's secret catalogue.
+ *
+ * A connector points at a secret by id (`authConfig.secretId`), and the
+ * credential guard lets that id through — it is a locator, not a credential.
+ * Until now nothing let an agent FIND the id: the whole `/secrets` family was
+ * deny-listed, so wiring a connector ended in "ask a human to copy the id out
+ * of the UI". That is the gap these two tools close, and all they close.
+ *
+ * Reading is safe by construction on the backend: no secrets route ever returns
+ * a decrypted value, and both GETs are open to any authenticated caller,
+ * read-only tokens included (`backend/src/routes/secrets.py`). WRITES stay out
+ * of this connector — the backend refuses them from a service token, and the
+ * value-less half of that story is axonity-mcp#39 / axonity-flow#910.
+ *
+ * The one thing that is not safe by construction is `metadata`. It is stored
+ * unencrypted, returned verbatim, readable by every user in the tenant
+ * (axonity-flow#908), and after axonity-flow#890 an operator can put arbitrary
+ * handshake headers in it — an `Authorization: Basic …` is the obvious next
+ * use. So it is redacted on the way out: the shape of a handshake is what an
+ * agent needs, the credential inside it is not.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { AxonityClient } from "../client.js";
+/**
+ * Redact credential-shaped entries out of a secret's `metadata`, and say so.
+ *
+ * Exported for testing. Anything that is not an object with a `metadata` key
+ * passes through untouched — the backend owns this response shape, and a
+ * connector that silently reshapes it is the drift this repo keeps closing.
+ */
+export declare function redactSecretMetadata(response: unknown): unknown;
+export declare function registerSecretTools(server: McpServer, client: AxonityClient): void;

package/dist/tools/secrets.js

@@ -0,0 +1,69 @@
+/**
+ * Reading the tenant's secret catalogue.
+ *
+ * A connector points at a secret by id (`authConfig.secretId`), and the
+ * credential guard lets that id through — it is a locator, not a credential.
+ * Until now nothing let an agent FIND the id: the whole `/secrets` family was
+ * deny-listed, so wiring a connector ended in "ask a human to copy the id out
+ * of the UI". That is the gap these two tools close, and all they close.
+ *
+ * Reading is safe by construction on the backend: no secrets route ever returns
+ * a decrypted value, and both GETs are open to any authenticated caller,
+ * read-only tokens included (`backend/src/routes/secrets.py`). WRITES stay out
+ * of this connector — the backend refuses them from a service token, and the
+ * value-less half of that story is axonity-mcp#39 / axonity-flow#910.
+ *
+ * The one thing that is not safe by construction is `metadata`. It is stored
+ * unencrypted, returned verbatim, readable by every user in the tenant
+ * (axonity-flow#908), and after axonity-flow#890 an operator can put arbitrary
+ * handshake headers in it — an `Authorization: Basic …` is the obvious next
+ * use. So it is redacted on the way out: the shape of a handshake is what an
+ * agent needs, the credential inside it is not.
+ */
+import { z } from "zod";
+import { redactCredentials } from "./credentials.js";
+import { guard, jsonResult } from "./result.js";
+/**
+ * Redact credential-shaped entries out of a secret's `metadata`, and say so.
+ *
+ * Exported for testing. Anything that is not an object with a `metadata` key
+ * passes through untouched — the backend owns this response shape, and a
+ * connector that silently reshapes it is the drift this repo keeps closing.
+ */
+export function redactSecretMetadata(response) {
+    if (typeof response !== "object" || response === null || Array.isArray(response)) {
+        return response;
+    }
+    const source = response;
+    if (source.metadata === undefined || source.metadata === null)
+        return response;
+    const { value, redactedPaths } = redactCredentials(source.metadata);
+    if (redactedPaths.length === 0)
+        return response;
+    return {
+        ...source,
+        metadata: value,
+        // An omission the reader cannot see is worse than the omission itself.
+        metadataRedacted: {
+            paths: redactedPaths,
+            why: "A secret's metadata is stored unencrypted and is readable by every user " +
+                "in this tenant, so anything credential-shaped in it is withheld from " +
+                "the agent. Read these fields in Axonity → Settings → Secrets.",
+        },
+    };
+}
+export function registerSecretTools(server, client) {
+    server.tool("list_secrets", "List the tenant's secrets (id, name, description, authType, version). This " +
+        "is the catalogue of what EXISTS — no route in Axonity ever returns a " +
+        "secret's value, and this connector cannot create, change or delete one. " +
+        "Use it to find the id for a connector's `authConfig.secretId` instead of " +
+        "asking a human to copy one out of the UI.", {}, async () => guard(async () => jsonResult(await client.get("/api/v1/secrets"))));
+    server.tool("read_secret", "Read one secret's configuration: `authType`, `valueKeys` (WHICH keys are " +
+        "filled — never their values), `metadata` (connection config, e.g. a " +
+        "session_cookie handshake) and `version`. Check `valueKeys` before you wire " +
+        "a connector to a secret: an empty list means a human has not filled it in " +
+        "yet, and the connector will fail at run time, not at author time. " +
+        "Credential-shaped entries in `metadata` are withheld — see " +
+        "`metadataRedacted` in the response for which and why.", { secretId: z.string().describe("The secret's id (from list_secrets).") }, async ({ secretId }) => guard(async () => jsonResult(redactSecretMetadata(await client.get(`/api/v1/secrets/${secretId}`)))));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/tools/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/tools/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAE/E,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEhD,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,KAAK;QACf,uEAAuE;QACvE,gBAAgB,EAAE;YAChB,KAAK,EAAE,aAAa;YACpB,GAAG,EACD,0EAA0E;gBAC1E,uEAAuE;gBACvE,+DAA+D;SAClE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAqB;IAC1E,MAAM,CAAC,IAAI,CACT,cAAc,EACd,6EAA6E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,2CAA2C,EAC7C,EAAE,EACF,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,2EAA2E;QACzE,sEAAsE;QACtE,6EAA6E;QAC7E,4EAA4E;QAC5E,oEAAoE;QACpE,6DAA6D;QAC7D,uDAAuD,EACzD,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC,EAAE,EACzE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CACrB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,UAAU,CACR,oBAAoB,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC,CACtE,CACF,CACJ,CAAC;AACJ,CAAC"}

package/dist/tools/subworkflows.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Finding the workflows a sub-process step may call.
+ *
+ * Workflows can call each other (axonity-flow#898). Both halves of that live in
+ * the workflow DOCUMENT and are therefore already authorable over this
+ * connector: `add_trigger` with `typeId: "subprocess-invocation"` declares the
+ * callee's signature — in that one call, `parameters` included, since
+ * axonity-flow#961 S3 — and `add_step` with `type: "subprocess"` makes the
+ * call. What an agent could not do was find out WHICH workflow to call — the
+ * same gap the secret catalogue closed (#39): the platform can express the
+ * wiring, the agent cannot find the id.
+ *
+ * `GET /workflows/callable` answers it, and answers the harder half too: a
+ * workflow that CANNOT be called is listed with the reason rather than filtered
+ * out. An author hunting for a workflow that is right there is a support
+ * question; "here it is, and here is what to fix" is a two-second answer.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { AxonityClient } from "../client.js";
+export declare function registerSubworkflowTools(server: McpServer, client: AxonityClient): void;

package/dist/tools/subworkflows.js

@@ -0,0 +1,42 @@
+/**
+ * Finding the workflows a sub-process step may call.
+ *
+ * Workflows can call each other (axonity-flow#898). Both halves of that live in
+ * the workflow DOCUMENT and are therefore already authorable over this
+ * connector: `add_trigger` with `typeId: "subprocess-invocation"` declares the
+ * callee's signature — in that one call, `parameters` included, since
+ * axonity-flow#961 S3 — and `add_step` with `type: "subprocess"` makes the
+ * call. What an agent could not do was find out WHICH workflow to call — the
+ * same gap the secret catalogue closed (#39): the platform can express the
+ * wiring, the agent cannot find the id.
+ *
+ * `GET /workflows/callable` answers it, and answers the harder half too: a
+ * workflow that CANNOT be called is listed with the reason rather than filtered
+ * out. An author hunting for a workflow that is right there is a support
+ * question; "here it is, and here is what to fix" is a two-second answer.
+ */
+import { z } from "zod";
+import { guard, jsonResult } from "./result.js";
+export function registerSubworkflowTools(server, client) {
+    server.tool("list_callable_workflows", "List the workflows a sub-process step may call, each with its INTERFACE: " +
+        "`parameters` (what to bind the calling step's inputs to, matched by name) " +
+        "and `outcomes` (the callee's end steps and the fields each carries — " +
+        "which end was reached is itself part of the answer). A workflow that " +
+        "cannot be called is listed too, with `callable: false` and a " +
+        "`blockedReason` — usually that it has never been published, or has no " +
+        "`subprocess-invocation` trigger. " +
+        "\n\nCall this BEFORE authoring a sub-process step. `validate_workflow` " +
+        "does check the target now — a missing one, a self-call, a target that is " +
+        "deleted, unpublished or not callable each have their own issue code — " +
+        "but it can only tell you AFTERWARDS that the workflow you picked was " +
+        "wrong. This is how you pick, and how you read the interface you are " +
+        "about to bind the calling step's inputs to.", {
+        exclude: z
+            .string()
+            .optional()
+            .describe("The workflow you are editing. A workflow cannot call itself — every " +
+            "run would spawn a child that reaches the same step again — so pass " +
+            "its id to keep it out of the list."),
+    }, async ({ exclude }) => guard(async () => jsonResult(await client.get("/api/v1/workflows/callable", exclude ? { exclude } : undefined))));
+}
+//# sourceMappingURL=subworkflows.js.map