npm - @bevel-software/platform-core-backend - Versions diffs - 0.21.0 → 0.23.0 - Mend

@bevel-software/platform-core-backend 0.21.0 → 0.23.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (434) hide show

package/dist/modules/tool-auth/external-api-key.service.js CHANGED Viewed

@@ -78,7 +78,9 @@ export class ExternalApiKeyService {
         // Join users so a single round-trip resolves both "token is valid" and
         // "load the user it belongs to". The unique index on token_hash makes
         // this a point-lookup. `isNull(revokedAt)` is what enforces revocation
-        // — the row remains for audit.
+        // — the row remains for audit — and `isNull(deactivatedAt)` is what
+        // stops a switched-off account's keys without revoking them, so
+        // switching it back on restores them.
         const [row] = await this.db
             .select({
             tokenId: externalApiKeys.id,
@@ -89,7 +91,7 @@ export class ExternalApiKeyService {
         })
             .from(externalApiKeys)
             .innerJoin(users, eq(externalApiKeys.userId, users.id))
-            .where(and(eq(externalApiKeys.tokenHash, tokenHash), isNull(externalApiKeys.revokedAt)))
+            .where(and(eq(externalApiKeys.tokenHash, tokenHash), isNull(externalApiKeys.revokedAt), isNull(users.deactivatedAt)))
             .limit(1);
         if (!row)
             return null;

package/dist/modules/tool-auth/external-api-key.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE~~,+BAA+B~~;~~QAC/B~~,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;~~aACvF~~,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACjF,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,kEAAkE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CACvG;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EACpC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,sCAAsC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;aACpH,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACjF,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,kEAAkE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CACvG;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EACpC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/internal-token.service.d.ts CHANGED Viewed

@@ -10,9 +10,9 @@ export interface InternalTokenClaim {
     /**
      * The agent run / conversation id (the Mastra thread id) this token is scoped
      * to, when minted per-run. Surfaced as `ToolContext.sessionId` so the
-     * ontology-session boundary can scope to one run for the in-process agent
-     * (the external/MCP path carries `sessionId` on the tool body instead).
-     * Absent for identity-only tokens.
+     * agent-access hooks can tell the in-process agent's run apart (the
+     * external/MCP path carries `sessionId` on the tool body instead). Absent
+     * for identity-only tokens.
      */
     sessionId?: string;
     /**

package/dist/modules/tool-auth/tool-auth.middleware.d.ts CHANGED Viewed

@@ -62,10 +62,10 @@ declare global {
 export declare const requireInternalSource: RequestHandler;
 /**
  * Mirror of `requireInternalSource` for surfaces that must admit ONLY external
- * callers. `start_session` mints a fresh chat thread as the caller's
- * ontology-session id; an internal (in-process agent) token already carries
- * its run's `sessionId`, so letting it mint a new thread mid-run would
- * silently reset the one-ontology-per-conversation boundary.
+ * callers. `start_session` mints a fresh chat thread as the caller's session
+ * id; an internal (in-process agent) token already carries its run's
+ * `sessionId`, so letting it mint a new thread mid-run would silently split
+ * one conversation in two.
  *
  * "External" is decided by the VERIFIER, not by which credential shape
  * authenticated: a `bevel_…` connection key resolves external, and so does an
@@ -100,14 +100,23 @@ export type VerifyResult = {
  * primitive both `createToolAuthMiddleware` (our Express hosting) and
  * `validateToken` (the tool-author SDK) are built on, so there is ONE auth path.
  */
-export declare function createTokenVerifier(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService): (token: string | undefined) => Promise<VerifyResult>;
+export declare function createTokenVerifier(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService,
+/**
+ * Whether the account an internal token was minted for is still on. An
+ * internal token carries only a user id and lives up to an hour (longer
+ * for the MCP loopback), so without this a switched-off account's running
+ * agent would keep working until it expired. Connection keys need no
+ * second look: their lookup reads the account. Every deployment passes
+ * it; absent, internal tokens are judged on their signature alone.
+ */
+accounts?: Pick<AuthService, 'isActive'>): (token: string | undefined) => Promise<VerifyResult>;
 /**
  * The one auth gate every tool endpoint applies — a THIN Express adapter over
  * `createTokenVerifier`: parse the bearer header, run the shared verify core,
  * normalize the result to `req.toolAuth` (or the matching status). All auth logic
  * lives in the verifier; this only does header parsing + HTTP mapping.
  */
-export declare function createToolAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService): RequestHandler;
+export declare function createToolAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, accounts?: Pick<AuthService, 'isActive'>): RequestHandler;
 /**
  * Auth gate for the READ-ONLY discovery manuals (`GET /agent/utcp` +
  * `/agent/internal/utcp`) ONLY. Superset of `createToolAuthMiddleware`: it
@@ -119,5 +128,5 @@ export declare function createToolAuthMiddleware(externalApiKeyService: IExterna
  * JWT can read the manual but can never invoke a tool. The internal manual stays
  * `requireInternalSource`-gated downstream, so a session/key is 403'd there.
  */
-export declare function createManualAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, authService: AuthService): RequestHandler;
+export declare function createManualAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, authService: Pick<AuthService, 'isActive' | 'resolveSession'>): RequestHandler;
 //# sourceMappingURL=tool-auth.middleware.d.ts.map

package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;~~AAC3D~~,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,~~GACzC~~,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,~~CAqCtD~~;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,~~GACzC~~,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,~~GACvB~~,cAAc,~~CAuChB~~"}
1	+ {"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB;AAC1C;;;;;;;GAOG;AACH,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CAwCtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,gBAAgB,CAAC,GAC5D,cAAc,CAgDhB"}

package/dist/modules/tool-auth/tool-auth.middleware.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { logger } from '../../shared/logging.js';
 const log = logger('tools');
+import { ACCOUNT_DEACTIVATED_MESSAGE, AuthBackendError } from '../auth/account-admission.js';
 import { INVALID_CONNECTION_KEY_CHALLENGE, INVALID_CONNECTION_KEY_MESSAGE } from './connection-key-rejection.js';
 const WWW_AUTH = 'Bearer realm="bevel-tools"';
 /**
@@ -23,10 +24,10 @@ export const requireInternalSource = (req, res, next) => {
 };
 /**
  * Mirror of `requireInternalSource` for surfaces that must admit ONLY external
- * callers. `start_session` mints a fresh chat thread as the caller's
- * ontology-session id; an internal (in-process agent) token already carries
- * its run's `sessionId`, so letting it mint a new thread mid-run would
- * silently reset the one-ontology-per-conversation boundary.
+ * callers. `start_session` mints a fresh chat thread as the caller's session
+ * id; an internal (in-process agent) token already carries its run's
+ * `sessionId`, so letting it mint a new thread mid-run would silently split
+ * one conversation in two.
  *
  * "External" is decided by the VERIFIER, not by which credential shape
  * authenticated: a `bevel_…` connection key resolves external, and so does an
@@ -52,7 +53,16 @@ export const requireExternalSource = (req, res, next) => {
  * primitive both `createToolAuthMiddleware` (our Express hosting) and
  * `validateToken` (the tool-author SDK) are built on, so there is ONE auth path.
  */
-export function createTokenVerifier(externalApiKeyService, internalTokenService) {
+export function createTokenVerifier(externalApiKeyService, internalTokenService,
+/**
+ * Whether the account an internal token was minted for is still on. An
+ * internal token carries only a user id and lives up to an hour (longer
+ * for the MCP loopback), so without this a switched-off account's running
+ * agent would keep working until it expired. Connection keys need no
+ * second look: their lookup reads the account. Every deployment passes
+ * it; absent, internal tokens are judged on their signature alone.
+ */
+accounts) {
     const missing = { ok: false, status: 401, message: 'A connection key or internal token is required' };
     return async (token) => {
         if (!token)
@@ -67,6 +77,9 @@ export function createTokenVerifier(externalApiKeyService, internalTokenService)
             const claim = internalTokenService.verify(token);
             if (!claim)
                 return { ok: false, status: 401, message: 'Invalid or expired internal token' };
+            if (accounts && !(await accounts.isActive(claim.userId))) {
+                return { ok: false, status: 401, message: ACCOUNT_DEACTIVATED_MESSAGE };
+            }
             return claim.externalProxy
                 ? {
                     ok: true,
@@ -95,8 +108,8 @@ export function createTokenVerifier(externalApiKeyService, internalTokenService)
  * normalize the result to `req.toolAuth` (or the matching status). All auth logic
  * lives in the verifier; this only does header parsing + HTTP mapping.
  */
-export function createToolAuthMiddleware(externalApiKeyService, internalTokenService) {
-    const verify = createTokenVerifier(externalApiKeyService, internalTokenService);
+export function createToolAuthMiddleware(externalApiKeyService, internalTokenService, accounts) {
+    const verify = createTokenVerifier(externalApiKeyService, internalTokenService, accounts);
     return async (req, res, next) => {
         const header = req.headers.authorization;
         if (!header || !header.toLowerCase().startsWith('bearer ')) {
@@ -134,7 +147,7 @@ export function createToolAuthMiddleware(externalApiKeyService, internalTokenSer
  * `requireInternalSource`-gated downstream, so a session/key is 403'd there.
  */
 export function createManualAuthMiddleware(externalApiKeyService, internalTokenService, authService) {
-    const verify = createTokenVerifier(externalApiKeyService, internalTokenService);
+    const verify = createTokenVerifier(externalApiKeyService, internalTokenService, authService);
     return async (req, res, next) => {
         const header = req.headers.authorization;
         if (!header || !header.toLowerCase().startsWith('bearer ')) {
@@ -163,15 +176,24 @@ export function createManualAuthMiddleware(externalApiKeyService, internalTokenS
             return;
         }
         // Otherwise treat the bearer as a browser session JWT.
+        let userId;
         try {
-            const { userId } = authService.verifyToken(token);
-            req.toolAuth = { source: 'session', userId, scope: 'write' };
-            next();
+            ({ userId } = await authService.resolveSession(token));
         }
-        catch {
+        catch (err) {
+            // The account could not be looked up: an outage, not a verdict on the
+            // session, and a 401 would sign a valid caller out over it.
+            if (err instanceof AuthBackendError) {
+                log.error('session account lookup failed:', { err: err.cause });
+                res.status(500).json({ error: 'Authentication backend unavailable' });
+                return;
+            }
             res.setHeader('WWW-Authenticate', WWW_AUTH);
             res.status(401).json({ error: 'Invalid or expired token' });
+            return;
         }
+        req.toolAuth = { source: 'session', userId, scope: 'write' };
+        next();
     };
 }
 //# sourceMappingURL=tool-auth.middleware.js.map

package/dist/modules/tool-auth/tool-auth.middleware.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;~~AAI5B~~,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAkDjH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;~~IAE1C~~,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,KAAK,EAAE,OAAO;qBACf;iBACF;gBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QACvH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C;~~IAE1C~~,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;~~IAChF~~,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,~~WAAwB~~;~~IAExB~~,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;~~IAChF~~,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC;YACH,~~MAAM~~,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,~~WAAW~~,CAAC,KAAK,CAAC,CAAC;~~YAClD~~,GAAG,CAAC,~~QAAQ~~,GAAG,~~EAAE~~,~~MAAM~~,EAAE,~~SAAS~~,~~EAAE~~,~~MAAM~~,EAAE,~~KAAK~~,EAAE,~~OAAO~~,EAAE,CAAC;~~YAC7D~~,IAAI,EAAE,CAAC~~;QACT~~,CAAC;~~QAAC~~,~~MAAM~~,CAAC;~~YACP~~,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;~~QAC9D~~,CAAC;~~IACH~~,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAG5B,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE7F,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAkDjH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;AAC1C;;;;;;;GAOG;AACH,QAAwC;IAExC,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,KAAK,EAAE,OAAO;qBACf;iBACF;gBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QACvH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C,EAC1C,QAAwC;IAExC,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAA6D;IAE7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC7F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool-context.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-context.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAOxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;~~AAG1E~~,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAC/C,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,EAAE,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACpF;AAYD,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,~~CAyEnF~~"}
1	+ {"version":3,"file":"tool-context.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAOxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAC/C,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE;YAAE,EAAE,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACpF;AAYD,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,WAAW,EACxB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,WAAW,CAAC,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,CAuFnF"}

package/dist/modules/tool-helpers/tool-context.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
 import { ReadOnlyFilesystem } from '../kb-fs/read-only-filesystem.js';
 import { makeAgentRolesYamlWriteValidator, ROLES_YAML_BASENAME, } from '../access-model/roles-yaml-guard.js';
 import { isAbsence } from '../../shared/fs.contract.js';
+import { assertBranchProvided } from '../../shared/domain-errors.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
 import { ToolError } from './tool.contract.js';
 /** A file's text, or null when it does not exist. Any other failure throws. */
@@ -36,6 +37,20 @@ export function createToolContextResolver(deps) {
         const { loadActiveGroups } = deps;
         const fsCache = new Map();
         const getFilesystem = async (branch) => {
+            // THE choke point: every knowledge-base tool resolves its workspace
+            // through here, and a `call_tool_chain` call reaches the very same route
+            // over loopback — so refusing a branch-less call here refuses it on both
+            // paths at once, with no per-tool guard to keep in step.
+            //
+            // Before ANY workspace work, because both things downstream do with this
+            // value are wrong when it is absent: `getOrCreateForUser` defaults a
+            // missing branch to the deployment's default (protected) branch, so an
+            // omitted argument would silently act on `main`; and a present-but-absent
+            // value like the string "undefined" goes to `workspaceIdForBranch`, which
+            // makes it a workspace directory of that name and then tries to clone a
+            // branch nobody ever pushed. Failing closed here means no workspace is
+            // created and no clone is attempted.
+            assertBranchProvided(branch);
             const cached = fsCache.get(branch);
             if (cached)
                 return cached;

package/dist/modules/tool-helpers/tool-context.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-context.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EACL,gCAAgC,EAChC,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AA2BjE,+EAA+E;AAC/E,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,KAAK,UAAU,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC3E,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,OAAO;gBACpB,CAAC,CAAC,IAAI,iBAAiB,CACnB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B;oBACE,QAAQ,EAAE,IAAI,CAAC,eAAe;oBAC9B,WAAW;oBACX,MAAM,EAAE,oBAAoB,CAAC,WAAW,CAAC;oBACzC,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,gEAAgE;oBAChE,4DAA4D;oBAC5D,gEAAgE;oBAChE,2DAA2D;oBAC3D,+CAA+C;oBAC/C,aAAa,EAAE,gCAAgC,CAC7C,IAAI,CAAC,SAAS,EACd,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAChF,gBAAgB;wBACd,CAAC,KAAK,IAAI,EAAE;4BACV,uDAAuD;4BACvD,oDAAoD;4BACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;4BACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;wBAC1C,CAAC,CAAC,CACL;oBACD,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF;gBACH,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YACpF,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1E,WAAW;YACX,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa;SACd,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tool-context.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EACL,gCAAgC,EAChC,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAI7C,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AA2BjE,+EAA+E;AAC/E,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,OAAO,KAAK,UAAU,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QAE5E,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;YACvE,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,yDAAyD;YACzD,EAAE;YACF,yEAAyE;YACzE,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,qCAAqC;YACrC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC3E,MAAM,EAAE,GACN,IAAI,CAAC,KAAK,KAAK,OAAO;gBACpB,CAAC,CAAC,IAAI,iBAAiB,CACnB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B;oBACE,QAAQ,EAAE,IAAI,CAAC,eAAe;oBAC9B,WAAW;oBACX,MAAM,EAAE,oBAAoB,CAAC,WAAW,CAAC;oBACzC,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,gEAAgE;oBAChE,4DAA4D;oBAC5D,gEAAgE;oBAChE,2DAA2D;oBAC3D,+CAA+C;oBAC/C,aAAa,EAAE,gCAAgC,CAC7C,IAAI,CAAC,SAAS,EACd,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,EAChF,gBAAgB;wBACd,CAAC,KAAK,IAAI,EAAE;4BACV,uDAAuD;4BACvD,oDAAoD;4BACpD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;4BACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;wBAC1C,CAAC,CAAC,CACL;oBACD,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CACF;gBACH,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,SAAS,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;YACpF,sEAAsE;YACtE,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,2DAA2D;YAC3D,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1E,WAAW;YACX,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa;SACd,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool-handler.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import type { Request, Response } from 'express';
 import { type ToolHandler } from './tool.contract.js';
 import type { ResolveToolContext } from './tool-context.js';
+import { type IWriteAccess } from '../write-access/write-access.js';
 import '../tool-auth/tool-auth.middleware.js';
 export interface ToolHandlerOptions {
     /** Mutating tool — refuse read-scoped callers up front (defense in depth). */
@@ -14,6 +15,6 @@ export interface ToolHandlerOptions {
  * The handler receives `req.body` as the flat args (UTCP's `body_field` already
  * delivered the inner body as the request body).
  */
-export declare function createToolHandlerFactory(resolve: ResolveToolContext): (handler: ToolHandler, opts?: ToolHandlerOptions) => (req: Request, res: Response) => Promise<void>;
+export declare function createToolHandlerFactory(resolve: ResolveToolContext, writeAccess?: IWriteAccess): (handler: ToolHandler, opts?: ToolHandlerOptions) => (req: Request, res: Response) => Promise<void>;
 export type ToolHandlerFactory = ReturnType<typeof createToolHandlerFactory>;
 //# sourceMappingURL=tool-handler.d.ts.map

package/dist/modules/tool-helpers/tool-handler.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,~~IACtC~~,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,~~CAyE5D~~;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
1	+ {"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAmD,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACrH,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,EAAE,WAAW,GAAE,YAA6B,IAClF,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CA4F5D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/modules/tool-helpers/tool-handler.js CHANGED Viewed

@@ -3,6 +3,7 @@ const log = logger('tools');
 import { hasHttpStatus, ToolError } from './tool.contract.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
+import { alwaysWritable, READ_ONLY_CODE, refuseWriteTool } from '../write-access/write-access.js';
 import '../tool-auth/tool-auth.middleware.js'; // Express Request.toolAuth augmentation
 function isAsyncIterable(v) {
     return (typeof v === 'object' &&
@@ -17,7 +18,7 @@ function isAsyncIterable(v) {
  * The handler receives `req.body` as the flat args (UTCP's `body_field` already
  * delivered the inner body as the request body).
  */
-export function createToolHandlerFactory(resolve) {
+export function createToolHandlerFactory(resolve, writeAccess = alwaysWritable) {
     return function toolHandler(handler, opts = {}) {
         return async (req, res) => {
             const auth = req.toolAuth;
@@ -29,11 +30,31 @@ export function createToolHandlerFactory(resolve) {
                 res.status(403).json({ error: 'This tool requires write access.' });
                 return;
             }
+            // Before anything is awaited: a client that goes away during the
+            // write-access check below must still abort the call.
+            //
+            // Asked of the RESPONSE. The request closes as soon as its body has
+            // been read, with the client still there and waiting, so its `close`
+            // says nothing about the client; the response closes when it has been
+            // sent or the connection is gone, and `writableEnded` tells the two
+            // apart.
             const abort = new AbortController();
-            req.on('close', () => {
+            res.on('close', () => {
                 if (!res.writableEnded)
                     abort.abort();
             });
+            // The tool layer's half of the read-only gate: the HTTP gate lets every
+            // tool call through, since only here is a write tool told from a read.
+            if (opts.write) {
+                const refusal = await refuseWriteTool(writeAccess);
+                if (refusal !== null) {
+                    res.status(403).json({ error: refusal, code: READ_ONLY_CODE });
+                    return;
+                }
+                // The client left while the verdict was awaited: nobody to answer.
+                if (abort.signal.aborted)
+                    return;
+            }
             const body = req.body;
             if (body !== undefined && body !== null && (typeof body !== 'object' || Array.isArray(body))) {
                 res.status(400).json({ error: 'Request body must be a JSON object.' });
@@ -42,8 +63,8 @@ export function createToolHandlerFactory(resolve) {
             const args = (body ?? {});
             // `sessionId` rides the tool body like `branch` does: the external MCP
             // proxy injects it (ask-tool continuity convention) and the in-process
-            // agent passes its thread id. Surfaced on the context so the ontology
-            // gate can scope to one run without each handler re-reading args.
+            // agent passes its thread id. Surfaced on the context so the
+            // agent-access gate can name the run without each handler re-reading args.
             const sessionId = typeof args.sessionId === 'string' && args.sessionId.length > 0
                 ? args.sessionId
                 : undefined;

package/dist/modules/tool-helpers/tool-handler.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B;~~IAClE~~,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,~~sEAAsE~~;~~YACtE~~,~~kEAAkE~~;~~YAClE~~,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;wBACrF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,gEAAgE;oBAChE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,iCAAiC,CAAC;AACrH,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B,EAAE,cAA4B,cAAc;IAC9G,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,iEAAiE;YACjE,sDAAsD;YACtD,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,SAAS;YACT,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,mEAAmE;gBACnE,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;YACnC,CAAC;YACD,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,6DAA6D;YAC7D,2EAA2E;YAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;wBACrF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,gEAAgE;oBAChE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool.contract.d.ts CHANGED Viewed

@@ -30,8 +30,9 @@ export interface ToolContext {
      * The agent run / conversation id this call belongs to (the agent thread id).
      * Supplied as a `sessionId` field on the tool's input body — the external MCP
      * proxy injects it via the `ask`-tool continuity convention, and the
-     * in-process agent passes its thread id. Used to scope the ontology-session
-     * boundary to one run. Absent for non-agent or unthreaded calls.
+     * in-process agent passes its thread id. Handed to the agent-access hooks,
+     * which is how a deployment scopes a rule to one conversation. Absent for
+     * non-agent or unthreaded calls.
      */
     sessionId?: string;
     /**

package/dist/modules/tool-helpers/tool.contract.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB~~;;;;;;OAMG~~;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}
1	+ {"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}

package/dist/modules/tool-helpers/tool.contract.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"~~AAoEA~~;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAqEA;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/validate-token.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { createTokenVerifier } from '../tool-auth/tool-auth.middleware.js';
 import { createToolContextResolver } from './tool-context.js';
 import { ToolError } from './tool.contract.js';
 export function createToolValidator(deps) {
-    const verify = createTokenVerifier(deps.externalApiKeyService, deps.internalTokenService);
+    const verify = createTokenVerifier(deps.externalApiKeyService, deps.internalTokenService, deps.authService);
     const resolve = createToolContextResolver(deps);
     return async (token, signal) => {
         let result;

package/dist/modules/tool-helpers/validate-token.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"validate-token.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/validate-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAwB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAgCjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;~~IAC1F~~,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"validate-token.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/validate-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAwB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAgCjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/workflow/agent-tools/change-request-summary.d.ts ADDED Viewed

@@ -0,0 +1,98 @@
+import type { ChangeRequestDetail, ChangeRequestState } from '@bevel-software/platform-shared';
+/**
+ * What `open_change_request` answers, and why it is not the detail the app's
+ * dialog reads.
+ *
+ * The dialog renders every file's diff, so its detail carries every patch. An
+ * agent that opens a change request needs none of that: it needs the link to
+ * hand the user, and enough of the request to confirm it carries the files it
+ * meant to propose and to say what the request is now waiting on. Handing it
+ * the dialog's detail cost ~445,000 characters for 27 files of 15 KB — past
+ * every tool-result limit, so the one field the agent actually needed (the
+ * link) could not be read at all.
+ *
+ * So this is a purpose-made answer: the link first, the request's identity,
+ * who must approve each path, what blocks the merge verbatim from the detail,
+ * and the changed paths with their kind of change — no patch, no file content.
+ * An agent that wants more asks for it by name through `include`.
+ */
+/** What `include` accepts. */
+export type ChangeRequestInclude = 'patches' | 'all-paths';
+/** The two `include` values, for the tool's input schema and its validation. */
+export declare const CHANGE_REQUEST_INCLUDES: readonly ChangeRequestInclude[];
+/** How many paths the answer lists before it cuts; `all-paths` lifts the cut. */
+export declare const CHANGE_REQUEST_PATH_LIMIT = 25;
+/**
+ * The kind of change to one path, in the four words the answer speaks. Git's
+ * own statuses are finer (`modified` vs `changed`, `renamed` vs `copied`) in
+ * ways nothing downstream acts on.
+ */
+export type ChangeKind = 'added' | 'changed' | 'deleted' | 'moved';
+/** One changed path. `previousPath` is where a `moved` one came from. */
+export interface ChangeRequestSummaryFile {
+    path: string;
+    change: ChangeKind;
+    previousPath?: string;
+    /** Unified diff. Only with `include: ["patches"]`, and absent for a binary or oversized file. */
+    patch?: string;
+}
+/**
+ * Who must approve one path, at the same per-path granularity the detail
+ * carries (the access tree resolves a role per file or per folder; this says
+ * what it resolved to for this file).
+ *
+ * The detail's own entry is the dialog's: it also carries each approver's
+ * email, the viewer's own eligibility, and every approval's timestamp and
+ * staleness. Repeated over 25 files that is ~4,500 characters an agent cannot
+ * act on — it may not approve anything — and it is what would push the
+ * 27-file answer back over the limit this ticket exists to get under. So the
+ * answer keeps what "who must approve" means and nothing else.
+ */
+export interface ChangeRequestApprovers {
+    path: string;
+    /** Roles that confer approval here. `everyone` means any signed-in approver. */
+    roles: string[];
+    /** Approvers named directly, by display name. */
+    users: string[];
+    /** True once an eligible approver has approved at the request's current head. */
+    approved: boolean;
+    /** False when the merge gate does not bind this path — then nobody has to approve it. */
+    inMergeGate: boolean;
+    /**
+     * Present when the access tree could not be resolved for this path — which
+     * includes a detail that carries no verdict at all. Then empty
+     * `roles`/`users` means "not known", NOT "nobody has to approve".
+     */
+    approversUnknown?: true;
+}
+export interface ChangeRequestSummary {
+    /** First field on purpose: it is the one an agent must hand the user. */
+    url: string;
+    urlNote?: string;
+    number: number;
+    title: string;
+    state: ChangeRequestState;
+    sourceBranch: string;
+    targetBranch: string;
+    /** Who must approve, one entry per listed path. */
+    approvals: ChangeRequestApprovers[];
+    /** What blocks the merge — verbatim from the detail. Empty when nothing does. */
+    mergeBlockedReasons: string[];
+    /** The changed paths, cut to {@link CHANGE_REQUEST_PATH_LIMIT} unless `all-paths` was asked for. */
+    files: ChangeRequestSummaryFile[];
+    /** How many files the request changes in total, cut or not. */
+    totalFiles: number;
+}
+/**
+ * Shape the tool's answer out of the detail the service already returns. Pure:
+ * the service and the app's routes are untouched, and the detail they serve is
+ * exactly what it was.
+ *
+ * `approvals` is narrowed to the paths the answer lists, because the detail's
+ * contract is one entry per listed file. Nothing about the merge gate is lost
+ * by that: `mergeBlockedReasons` names every missing approval, cut or not.
+ */
+export declare function summarizeChangeRequest(detail: ChangeRequestDetail, include?: readonly ChangeRequestInclude[]): ChangeRequestSummary;
+/** The `include` values off a tool call's arguments; anything else is ignored. */
+export declare function parseInclude(raw: unknown): ChangeRequestInclude[];
+//# sourceMappingURL=change-request-summary.d.ts.map

package/dist/modules/workflow/agent-tools/change-request-summary.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"change-request-summary.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/change-request-summary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAInB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AAEH,8BAA8B;AAC9B,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE3D,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAA6B,CAAC;AAEjG,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnE,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oGAAoG;IACpG,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AA+CD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,GAAE,SAAS,oBAAoB,EAAO,GAC5C,oBAAoB,CAkBtB;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAGjE"}