@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/tool-auth/external-api-key.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AAOtC,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAMb;IACA;IANnB;;;OAGG;IACH,YACmB,EAAY,EACZ,SAAiB;QADjB,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,6EAA6E;IAC7E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa;QACtC,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;aAC7C,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CACrC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CACrC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/internal-token.service.d.ts

@@ -70,8 +70,11 @@ export declare class InternalTokenService {
     });
     /** Token lifetime in ms — so callers caching a minted token can refresh it before expiry. */
     get tokenTtlMs(): number;
-    /** @param ttlMs Override the default lifetime — e.g. the MCP proxy mints
-     *   session-loopback tokens that must outlive its 4h session idle TTL. */
+    /** @param ttlMs Override the default lifetime — for a caller whose token
+     *   must live a different span than the default: the MCP proxy's loopback
+     *   bearer (`MCP_LOOPBACK_TOKEN_TTL_MS`, longer, so a long tool call is not
+     *   cut off mid-way) and the external-proxy token minted for a grant, whose
+     *   life is bounded by the grant's remaining time (`mcp.routes.ts`). */
     mint(claim: InternalTokenClaim, ttlMs?: number): string;
     /** Returns the claim for a valid, unexpired token; null otherwise. */
     verify(token: string): InternalTokenClaim | null;

package/dist/modules/tool-auth/internal-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA4BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;4EAIwE;IACxE,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA4BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}

package/dist/modules/tool-auth/internal-token.service.js

@@ -46,8 +46,11 @@ export class InternalTokenService {
     get tokenTtlMs() {
         return this.ttlMs;
     }
-    /** @param ttlMs Override the default lifetime — e.g. the MCP proxy mints
-     *   session-loopback tokens that must outlive its 4h session idle TTL. */
+    /** @param ttlMs Override the default lifetime — for a caller whose token
+     *   must live a different span than the default: the MCP proxy's loopback
+     *   bearer (`MCP_LOOPBACK_TOKEN_TTL_MS`, longer, so a long tool call is not
+     *   cut off mid-way) and the external-proxy token minted for a grant, whose
+     *   life is bounded by the grant's remaining time (`mcp.routes.ts`). */
     mint(claim, ttlMs) {
         const payload = { ...claim, exp: this.now() + (ttlMs ?? this.ttlMs) };
         const body = b64url(Buffer.from(JSON.stringify(payload), 'utf8'));

package/dist/modules/tool-auth/internal-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8CvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8CvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;4EAIwE;IACxE,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/modules/tool-auth/key-or-session.middleware.d.ts

@@ -0,0 +1,23 @@
+import type { RequestHandler } from 'express';
+/**
+ * One gate for an endpoint that serves the app AND agents: a bearer that
+ * looks like a tool credential (a `bevel_…` connection key, an internal
+ * token) goes through the tool-auth middleware; anything else — the
+ * browser's session JWT, its cookie — goes through the session middleware.
+ * Whichever admitted the caller, `req.userId` names them afterwards, so a
+ * handler written for sessions (`resolveUser` → `req.userId`) serves both.
+ *
+ * Composition, not a third verifier: each credential is still checked by
+ * the code that owns it. Deliberately NOT the read-only-manuals gate
+ * (`createManualAuthMiddleware`), which is documented as the one place a
+ * session may stand in for a tool credential; here it is the other way
+ * round — a tool credential is admitted to an app endpoint — and only for
+ * endpoints a tool definition describes.
+ */
+export declare function keyOrSessionAuth(deps: {
+    sessionAuth: RequestHandler;
+    toolAuth: RequestHandler;
+    /** Whether a bearer value is a tool credential rather than a session token. */
+    isToolCredential(token: string): boolean;
+}): RequestHandler;
+//# sourceMappingURL=key-or-session.middleware.d.ts.map

package/dist/modules/tool-auth/key-or-session.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-or-session.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/key-or-session.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAE/E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,WAAW,EAAE,cAAc,CAAC;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C,GAAG,cAAc,CAsBjB"}

package/dist/modules/tool-auth/key-or-session.middleware.js

@@ -0,0 +1,39 @@
+/**
+ * One gate for an endpoint that serves the app AND agents: a bearer that
+ * looks like a tool credential (a `bevel_…` connection key, an internal
+ * token) goes through the tool-auth middleware; anything else — the
+ * browser's session JWT, its cookie — goes through the session middleware.
+ * Whichever admitted the caller, `req.userId` names them afterwards, so a
+ * handler written for sessions (`resolveUser` → `req.userId`) serves both.
+ *
+ * Composition, not a third verifier: each credential is still checked by
+ * the code that owns it. Deliberately NOT the read-only-manuals gate
+ * (`createManualAuthMiddleware`), which is documented as the one place a
+ * session may stand in for a tool credential; here it is the other way
+ * round — a tool credential is admitted to an app endpoint — and only for
+ * endpoints a tool definition describes.
+ */
+export function keyOrSessionAuth(deps) {
+    return (req, res, next) => {
+        const header = req.headers.authorization;
+        const token = header && header.toLowerCase().startsWith('bearer ') ? header.slice(header.indexOf(' ') + 1).trim() : '';
+        if (!token || !deps.isToolCredential(token)) {
+            deps.sessionAuth(req, res, next);
+            return;
+        }
+        deps.toolAuth(req, res, (err) => {
+            if (err) {
+                next(err);
+                return;
+            }
+            // The tool gate names the caller on `req.toolAuth`; the endpoint reads
+            // `req.userId`, as it does for a session. Assigned unconditionally: the
+            // credential this gate accepted is who the caller is, whatever an
+            // earlier middleware may have written there.
+            if (req.toolAuth)
+                req.userId = req.toolAuth.userId;
+            next();
+        });
+    };
+}
+//# sourceMappingURL=key-or-session.middleware.js.map

package/dist/modules/tool-auth/key-or-session.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-or-session.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/key-or-session.middleware.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GACT,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,6CAA6C;YAC7C,IAAI,GAAG,CAAC,QAAQ;gBAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/tool-auth.middleware.d.ts

@@ -68,7 +68,12 @@ export declare const requireInternalSource: RequestHandler;
  * Mount AFTER `toolAuth`. 403 (authenticated, but not authorized).
  */
 export declare const requireExternalSource: RequestHandler;
-/** Outcome of verifying a bearer token — either a normalized identity or a status+message to surface. */
+/**
+ * Outcome of verifying a bearer token — either a normalized identity or a
+ * status+message to surface. `challenge` overrides the default
+ * `WWW-Authenticate` value on a 401 (a rejected connection key answers with
+ * its own plain `invalid_token` challenge).
+ */
 export type VerifyResult = {
     ok: true;
     auth: ToolAuth;
@@ -76,6 +81,7 @@ export type VerifyResult = {
     ok: false;
     status: number;
     message: string;
+    challenge?: string;
 };
 /**
  * The framework-agnostic verify core: bearer token (the value AFTER `Bearer `) →

package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CA6BtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,GACvB,cAAc,CAuChB"}
+{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CA6BtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,GACvB,cAAc,CAuChB"}

package/dist/modules/tool-auth/tool-auth.middleware.js

@@ -1,3 +1,6 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('tools');
+import { INVALID_CONNECTION_KEY_CHALLENGE, INVALID_CONNECTION_KEY_MESSAGE } from './connection-key-rejection.js';
 const WWW_AUTH = 'Bearer realm="bevel-tools"';
 /**
  * Gate that admits ONLY in-process callers (those bearing an internal HMAC
@@ -73,7 +76,7 @@ export function createTokenVerifier(externalApiKeyService, internalTokenService)
             const resolved = await externalApiKeyService.verifyAndLoadToken(token);
             return resolved
                 ? { ok: true, auth: { source: 'external', userId: resolved.user.id, tokenId: resolved.tokenId, scope: 'write' } }
-                : { ok: false, status: 401, message: 'Invalid or revoked connection key' };
+                : { ok: false, status: 401, message: INVALID_CONNECTION_KEY_MESSAGE, challenge: INVALID_CONNECTION_KEY_CHALLENGE };
         }
         return missing;
     };
@@ -98,7 +101,7 @@ export function createToolAuthMiddleware(externalApiKeyService, internalTokenSer
             const result = await verify(token);
             if (!result.ok) {
                 if (result.status === 401)
-                    res.setHeader('WWW-Authenticate', WWW_AUTH);
+                    res.setHeader('WWW-Authenticate', result.challenge ?? WWW_AUTH);
                 res.status(result.status).json({ error: result.message });
                 return;
             }
@@ -106,7 +109,7 @@ export function createToolAuthMiddleware(externalApiKeyService, internalTokenSer
             next();
         }
         catch (err) {
-            console.error('[tools] connection-key verification failed:', err);
+            log.error('connection-key verification failed:', { err });
             res.status(500).json({ error: 'Authentication backend unavailable' });
         }
     };
@@ -138,7 +141,7 @@ export function createManualAuthMiddleware(externalApiKeyService, internalTokenS
                 const result = await verify(token);
                 if (!result.ok) {
                     if (result.status === 401)
-                        res.setHeader('WWW-Authenticate', WWW_AUTH);
+                        res.setHeader('WWW-Authenticate', result.challenge ?? WWW_AUTH);
                     res.status(result.status).json({ error: result.message });
                     return;
                 }
@@ -146,7 +149,7 @@ export function createManualAuthMiddleware(externalApiKeyService, internalTokenS
                 next();
             }
             catch (err) {
-                console.error('[tools] connection-key verification failed:', err);
+                log.error('connection-key verification failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
             }
             return;

package/dist/modules/tool-auth/tool-auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AA6CA,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAOF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;QAC/E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBACvE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAAwB;IAExB,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;oBACvE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAClD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7D,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAI5B,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AA0CjH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QACvH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAAwB;IAExB,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAClD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7D,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool-context.d.ts

@@ -1,5 +1,6 @@
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { ICreatorAccess } from '../access-model/creator.js';
+import type { GroupsIndex } from '../access-model/group-files.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import type { WorkflowEventBus } from '../workflow/event-bus.js';
 import type { AuthService } from '../auth/auth.service.js';
@@ -18,6 +19,19 @@ export interface ToolContextDeps {
      * `modules/access/creator-access`).
      */
     creatorAccess: ICreatorAccess;
+    /**
+     * The resolver's active-group-source loader (`loadActiveGroups` in
+     * `modules/access`), injected so an agent's `roles.yaml` write adding a
+     * `- group:<Name>` entry is checked against the groups on that branch.
+     * Absent → group entries go unchecked.
+     */
+    loadActiveGroups?: (read: (filename: string) => Promise<string | null>) => Promise<{
+        groups: GroupsIndex;
+        sourceFile: string;
+        health: {
+            ok: boolean;
+        };
+    }>;
 }
 export type ResolveToolContext = (auth: ToolAuth, abortSignal: AbortSignal, sessionId?: string) => Promise<ToolContext>;
 /**

package/dist/modules/tool-helpers/tool-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-context.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAIxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,cAAc,CAAC;CAC/B;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,CA4DnF"}
+{"version":3,"file":"tool-context.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAOxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAC/C,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,EAAE,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACpF;AAYD,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,CAyEnF"}

package/dist/modules/tool-helpers/tool-context.js

@@ -1,8 +1,22 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
 import { ReadOnlyFilesystem } from '../kb-fs/read-only-filesystem.js';
-import { makeRolesYamlWriteValidator } from '../access-model/roles-yaml-guard.js';
+import { makeAgentRolesYamlWriteValidator, ROLES_YAML_BASENAME, } from '../access-model/roles-yaml-guard.js';
+import { isAbsence } from '../../shared/fs.contract.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { ToolError } from './tool.contract.js';
+/** A file's text, or null when it does not exist. Any other failure throws. */
+async function readTextIfExists(absolutePath) {
+    try {
+        return await fs.readFile(absolutePath, 'utf-8');
+    }
+    catch (err) {
+        if (isAbsence(err))
+            return null;
+        throw err;
+    }
+}
 /**
  * Build the per-call `ToolContext` from a verified `ToolAuth`. Identity (user,
  * scope, source) is resolved up front; the WORKSPACE is resolved on demand by
@@ -15,14 +29,11 @@ import { ToolError } from './tool.contract.js';
  * a request body; `branch` arrives as an explicit argument from the tool.
  */
 export function createToolContextResolver(deps) {
-    // Reject an agent write that would leave roles.yaml unparseable (app-wide
-    // admin lockout) before it reaches disk — the agent gets a tool error and the
-    // file is untouched, mirroring the human editor's save-time gate.
-    const validateRolesWrite = makeRolesYamlWriteValidator(deps.kbDirName);
     return async function resolveToolContext(auth, abortSignal, sessionId) {
         const user = await deps.authService.getUserById(auth.userId);
         if (!user)
             throw new ToolError('Your account is no longer available.', 401);
+        const { loadActiveGroups } = deps;
         const fsCache = new Map();
         const getFilesystem = async (branch) => {
             const cached = fsCache.get(branch);
@@ -38,7 +49,18 @@ export function createToolContextResolver(deps) {
                     branch: branchForWorkspaceId(workspaceId),
                     user,
                     kbDirName: deps.kbDirName,
-                    validateWrite: validateRolesWrite,
+                    // Reject an agent write that would leave roles.yaml unparseable
+                    // (app-wide admin lockout) or that creates a role before it
+                    // reaches disk, or that adds a `- group:` entry naming no group
+                    // — the agent gets a tool error and the file is untouched.
+                    // Agents manage membership; roles are pre-set.
+                    validateWrite: makeAgentRolesYamlWriteValidator(deps.kbDirName, () => readTextIfExists(path.join(basePath, deps.kbDirName, ROLES_YAML_BASENAME)), loadActiveGroups &&
+                        (async () => {
+                            // A source that exists but cannot be read leaves group
+                            // entries unchecked rather than refusing every one.
+                            const active = await loadActiveGroups((file) => readTextIfExists(path.join(basePath, deps.kbDirName, file)));
+                            return active.health.ok ? active : null;
+                        })),
                     creatorAccess: deps.creatorAccess,
                 })
                 : new ReadOnlyFilesystem({ basePath, contained: true });

package/dist/modules/tool-helpers/tool-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-context.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAGlF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAwBjE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,0EAA0E;IAC1E,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,OAAO,KAAK,UAAU,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC3E,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,OAAO;gBACpB,CAAC,CAAC,IAAI,iBAAiB,CACnB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B;oBACE,QAAQ,EAAE,IAAI,CAAC,eAAe;oBAC9B,WAAW;oBACX,MAAM,EAAE,oBAAoB,CAAC,WAAW,CAAC;oBACzC,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,aAAa,EAAE,kBAAkB;oBACjC,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF;gBACH,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YACpF,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1E,WAAW;YACX,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa;SACd,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-context.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EACL,gCAAgC,EAChC,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AA2BjE,+EAA+E;AAC/E,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,KAAK,UAAU,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC3E,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,OAAO;gBACpB,CAAC,CAAC,IAAI,iBAAiB,CACnB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B;oBACE,QAAQ,EAAE,IAAI,CAAC,eAAe;oBAC9B,WAAW;oBACX,MAAM,EAAE,oBAAoB,CAAC,WAAW,CAAC;oBACzC,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,gEAAgE;oBAChE,4DAA4D;oBAC5D,gEAAgE;oBAChE,2DAA2D;oBAC3D,+CAA+C;oBAC/C,aAAa,EAAE,gCAAgC,CAC7C,IAAI,CAAC,SAAS,EACd,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAChF,gBAAgB;wBACd,CAAC,KAAK,IAAI,EAAE;4BACV,uDAAuD;4BACvD,oDAAoD;4BACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;4BACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;wBAC1C,CAAC,CAAC,CACL;oBACD,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF;gBACH,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YACpF,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1E,WAAW;YACX,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa;SACd,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,IACtC,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CA4D5D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,IACtC,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CAyE5D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/modules/tool-helpers/tool-handler.js

@@ -1,4 +1,8 @@
-import { hasHttpStatus } from './tool.contract.js';
+import { logger } from '../../shared/logging.js';
+const log = logger('tools');
+import { hasHttpStatus, ToolError } from './tool.contract.js';
+import { WorkflowDomainError } from '../../shared/domain-errors.js';
+import { domainErrorBody } from '../../shared/http-errors.js';
 import '../tool-auth/tool-auth.middleware.js'; // Express Request.toolAuth augmentation
 function isAsyncIterable(v) {
     return (typeof v === 'object' &&
@@ -64,18 +68,31 @@ export function createToolHandlerFactory(resolve) {
                 // that case we can only end the stream, not rewrite the status.
                 if (res.headersSent) {
                     if (hasHttpStatus(err))
-                        console.error('[tools] handler failed post-stream:', err.message);
+                        log.error('handler failed post-stream:', { detail: err.message });
                     else
-                        console.error('[tools] handler failed post-stream:', err instanceof Error ? err.message : err);
+                        log.error('handler failed post-stream:', { err });
                     res.end();
                     return;
                 }
                 if (hasHttpStatus(err)) {
-                    res.status(err.status).json({ error: err.message });
+                    // Structured details ride beside `error`, never over it. A domain
+                    // refusal brings its own payload exactly as it does on the HTTP
+                    // routes — most subclasses carry a `kind` and whatever that kind
+                    // brings with it, others carry their own keys (`AccessConfigError`
+                    // carries an `accessConfigErrors` list; see each subclass for its
+                    // payload) — so a tool caller
+                    // switching on `branch-not-found` vs `remote-branch-gone` does not
+                    // have to read the prose to tell them apart.
+                    if (err instanceof WorkflowDomainError) {
+                        res.status(err.status).json(domainErrorBody(err));
+                        return;
+                    }
+                    const details = err instanceof ToolError ? err.details : undefined;
+                    res.status(err.status).json({ ...details, error: err.message });
                     return;
                 }
                 const msg = err instanceof Error ? err.message : 'Unknown error';
-                console.error('[tools] handler failed:', msg);
+                log.error('handler failed:', { detail: msg });
                 res.status(500).json({ error: msg });
             }
         };

package/dist/modules/tool-helpers/tool-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AAErE,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;;wBACrF,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACpG,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;wBACrF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,gEAAgE;oBAChE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool.contract.d.ts

@@ -61,10 +61,15 @@ export type ToolHandler = (args: Record<string, unknown>, ctx: ToolContext) => P
  * A failure a tool handler can throw to choose its own HTTP status. The route
  * maps any thrown value with a numeric `status` to that code — covering this
  * and `AgentAskService`'s `AgentAskError`.
+ *
+ * `details` are machine-readable fields sent beside `error` in the response
+ * body (e.g. `{ kind: 'binary_not_writable', fileKind, useInstead }`), so a
+ * caller can branch on the refusal instead of parsing its prose.
  */
 export declare class ToolError extends Error {
     readonly status: number;
-    constructor(message: string, status: number);
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(message: string, status: number, details?: Record<string, unknown> | undefined);
 }
 export declare function hasHttpStatus(err: unknown): err is {
     status: number;

package/dist/modules/tool-helpers/tool.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADvB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;CAK1B;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}
+{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}

package/dist/modules/tool-helpers/tool.contract.js

@@ -2,12 +2,18 @@
  * A failure a tool handler can throw to choose its own HTTP status. The route
  * maps any thrown value with a numeric `status` to that code — covering this
  * and `AgentAskService`'s `AgentAskError`.
+ *
+ * `details` are machine-readable fields sent beside `error` in the response
+ * body (e.g. `{ kind: 'binary_not_writable', fileKind, useInstead }`), so a
+ * caller can branch on the refusal instead of parsing its prose.
  */
 export class ToolError extends Error {
     status;
-    constructor(message, status) {
+    details;
+    constructor(message, status, details) {
         super(message);
         this.status = status;
+        this.details = details;
         this.name = 'ToolError';
     }
 }

package/dist/modules/tool-helpers/tool.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAoEA;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAoEA;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}

package/dist/modules/tool-manuals/index.d.ts

@@ -1,5 +1,6 @@
 export { ToolManualService } from './tool-manuals.service.js';
+export { PendingToolsService } from './pending-tools.service.js';
 export { registerToolManualsTools } from './tool-manuals.tools.js';
 export { createToolManualsAgentRoutes, createToolManualsBrowserRoutes, } from './tool-manuals.routes.js';
-export { EXTERNAL_KB_MANUAL_NAME, type IToolManualService, type ToolManualSummary, type ToolManualDetail, type ToolCapability, type ToolManualType, } from './tool-manuals.contract.js';
+export { EXTERNAL_KB_MANUAL_NAME, type IPendingToolService, type IToolManualService, type PendingTool, type ToolManualSummary, type ToolManualDetail, type ToolCapability, type ToolManualType, } from './tool-manuals.contract.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/modules/tool-manuals/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-manuals/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-manuals/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,4BAA4B,CAAC"}

package/dist/modules/tool-manuals/index.js

@@ -1,4 +1,5 @@
 export { ToolManualService } from './tool-manuals.service.js';
+export { PendingToolsService } from './pending-tools.service.js';
 export { registerToolManualsTools } from './tool-manuals.tools.js';
 export { createToolManualsAgentRoutes, createToolManualsBrowserRoutes, } from './tool-manuals.routes.js';
 export { EXTERNAL_KB_MANUAL_NAME, } from './tool-manuals.contract.js';

package/dist/modules/tool-manuals/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/tool-manuals/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,GAMxB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/tool-manuals/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,GAQxB,MAAM,4BAA4B,CAAC"}

package/dist/modules/tool-manuals/mcp-json-discovery.d.ts

@@ -61,5 +61,41 @@ export declare function validatedVariables(raw: unknown): ToolVariable[] | null;
  * materialization is a later phase — so a stdio server relying on them will
  * fail to spawn until then; bare-command servers (`npx …`) work today.
  */
+/**
+ * The ONE judgement of an `mcp.json` server entry — its name and its
+ * transport — shared by the manual scanner (which layers the platform's
+ * extension data and its reachability gate on top), the bundle dialect's
+ * registry (whose configs become entries) and the marketplace compiler
+ * (which ships only what a client could run). An entry that fails here fails
+ * everywhere, for one reason; an entry that passes is returned NORMALISED to
+ * the portable shape every consumer emits.
+ */
+export type McpEntryVerdict = {
+    ok: true;
+    transport: 'stdio';
+    entry: PortableStdioEntry;
+} | {
+    ok: true;
+    transport: 'streamable-http';
+    entry: PortableHttpEntry;
+} | {
+    ok: false;
+    reason: string;
+};
+/** A stdio server as a client launches it — every field already the type the launcher needs. */
+export interface PortableStdioEntry {
+    type: 'stdio';
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+}
+/** An http server as a client dials it — an endpoint, never a credential. */
+export interface PortableHttpEntry {
+    type: 'streamable-http';
+    url: string;
+    headers?: Record<string, string>;
+}
+export declare function judgeMcpServerEntry(name: string, raw: unknown): McpEntryVerdict;
 export declare function descriptorsFromMcpJson(pluginFolder: string, mcpJsonText: string, pluginJsonText: string | null): ToolManualDescriptor[];
 //# sourceMappingURL=mcp-json-discovery.d.ts.map

package/dist/modules/tool-manuals/mcp-json-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-json-discovery.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-manuals/mcp-json-discovery.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAerF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,EAAE,GAAG,IAAI,CA8FtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,oBAAoB,EAAE,CAkKxB"}
+{"version":3,"file":"mcp-json-discovery.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-manuals/mcp-json-discovery.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAkBrF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,EAAE,GAAG,IAAI,CA8FtE;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AACD,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAmBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,eAAe,CAmE/E;AAED,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,oBAAoB,EAAE,CAiHxB"}