@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/modules/tool-auth/external-api-key.service.js

@@ -78,7 +78,9 @@ export class ExternalApiKeyService {
         // Join users so a single round-trip resolves both "token is valid" and
         // "load the user it belongs to". The unique index on token_hash makes
         // this a point-lookup. `isNull(revokedAt)` is what enforces revocation
-        // — the row remains for audit.
+        // — the row remains for audit — and `isNull(deactivatedAt)` is what
+        // stops a switched-off account's keys without revoking them, so
+        // switching it back on restores them.
         const [row] = await this.db
             .select({
             tokenId: externalApiKeys.id,
@@ -89,7 +91,7 @@ export class ExternalApiKeyService {
         })
             .from(externalApiKeys)
             .innerJoin(users, eq(externalApiKeys.userId, users.id))
-            .where(and(eq(externalApiKeys.tokenHash, tokenHash), isNull(externalApiKeys.revokedAt)))
+            .where(and(eq(externalApiKeys.tokenHash, tokenHash), isNull(externalApiKeys.revokedAt), isNull(users.deactivatedAt)))
             .limit(1);
         if (!row)
             return null;

package/dist/modules/tool-auth/external-api-key.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACjF,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,kEAAkE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CACvG;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EACpC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,sCAAsC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;aACpH,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACjF,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,MAAM,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,kEAAkE;QAClE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CACvG;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,EACpC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;QACtD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/internal-token.service.d.ts

@@ -10,9 +10,9 @@ export interface InternalTokenClaim {
     /**
      * The agent run / conversation id (the Mastra thread id) this token is scoped
      * to, when minted per-run. Surfaced as `ToolContext.sessionId` so the
-     * ontology-session boundary can scope to one run for the in-process agent
-     * (the external/MCP path carries `sessionId` on the tool body instead).
-     * Absent for identity-only tokens.
+     * agent-access hooks can tell the in-process agent's run apart (the
+     * external/MCP path carries `sessionId` on the tool body instead). Absent
+     * for identity-only tokens.
      */
     sessionId?: string;
     /**

package/dist/modules/tool-auth/tool-auth.middleware.d.ts

@@ -62,10 +62,10 @@ declare global {
 export declare const requireInternalSource: RequestHandler;
 /**
  * Mirror of `requireInternalSource` for surfaces that must admit ONLY external
- * callers. `start_session` mints a fresh chat thread as the caller's
- * ontology-session id; an internal (in-process agent) token already carries
- * its run's `sessionId`, so letting it mint a new thread mid-run would
- * silently reset the one-ontology-per-conversation boundary.
+ * callers. `start_session` mints a fresh chat thread as the caller's session
+ * id; an internal (in-process agent) token already carries its run's
+ * `sessionId`, so letting it mint a new thread mid-run would silently split
+ * one conversation in two.
  *
  * "External" is decided by the VERIFIER, not by which credential shape
  * authenticated: a `bevel_…` connection key resolves external, and so does an
@@ -100,14 +100,23 @@ export type VerifyResult = {
  * primitive both `createToolAuthMiddleware` (our Express hosting) and
  * `validateToken` (the tool-author SDK) are built on, so there is ONE auth path.
  */
-export declare function createTokenVerifier(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService): (token: string | undefined) => Promise<VerifyResult>;
+export declare function createTokenVerifier(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, 
+/**
+ * Whether the account an internal token was minted for is still on. An
+ * internal token carries only a user id and lives up to an hour (longer
+ * for the MCP loopback), so without this a switched-off account's running
+ * agent would keep working until it expired. Connection keys need no
+ * second look: their lookup reads the account. Every deployment passes
+ * it; absent, internal tokens are judged on their signature alone.
+ */
+accounts?: Pick<AuthService, 'isActive'>): (token: string | undefined) => Promise<VerifyResult>;
 /**
  * The one auth gate every tool endpoint applies — a THIN Express adapter over
  * `createTokenVerifier`: parse the bearer header, run the shared verify core,
  * normalize the result to `req.toolAuth` (or the matching status). All auth logic
  * lives in the verifier; this only does header parsing + HTTP mapping.
  */
-export declare function createToolAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService): RequestHandler;
+export declare function createToolAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, accounts?: Pick<AuthService, 'isActive'>): RequestHandler;
 /**
  * Auth gate for the READ-ONLY discovery manuals (`GET /agent/utcp` +
  * `/agent/internal/utcp`) ONLY. Superset of `createToolAuthMiddleware`: it
@@ -119,5 +128,5 @@ export declare function createToolAuthMiddleware(externalApiKeyService: IExterna
  * JWT can read the manual but can never invoke a tool. The internal manual stays
  * `requireInternalSource`-gated downstream, so a session/key is 403'd there.
  */
-export declare function createManualAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, authService: AuthService): RequestHandler;
+export declare function createManualAuthMiddleware(externalApiKeyService: IExternalApiKeyService, internalTokenService: InternalTokenService, authService: Pick<AuthService, 'isActive' | 'resolveSession'>): RequestHandler;
 //# sourceMappingURL=tool-auth.middleware.d.ts.map

package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CAqCtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,GACvB,cAAc,CAuChB"}
+{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB;AAC1C;;;;;;;GAOG;AACH,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CAwCtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,QAAQ,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,GACvC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,gBAAgB,CAAC,GAC5D,cAAc,CAgDhB"}

package/dist/modules/tool-auth/tool-auth.middleware.js

@@ -1,5 +1,6 @@
 import { logger } from '../../shared/logging.js';
 const log = logger('tools');
+import { ACCOUNT_DEACTIVATED_MESSAGE, AuthBackendError } from '../auth/account-admission.js';
 import { INVALID_CONNECTION_KEY_CHALLENGE, INVALID_CONNECTION_KEY_MESSAGE } from './connection-key-rejection.js';
 const WWW_AUTH = 'Bearer realm="bevel-tools"';
 /**
@@ -23,10 +24,10 @@ export const requireInternalSource = (req, res, next) => {
 };
 /**
  * Mirror of `requireInternalSource` for surfaces that must admit ONLY external
- * callers. `start_session` mints a fresh chat thread as the caller's
- * ontology-session id; an internal (in-process agent) token already carries
- * its run's `sessionId`, so letting it mint a new thread mid-run would
- * silently reset the one-ontology-per-conversation boundary.
+ * callers. `start_session` mints a fresh chat thread as the caller's session
+ * id; an internal (in-process agent) token already carries its run's
+ * `sessionId`, so letting it mint a new thread mid-run would silently split
+ * one conversation in two.
  *
  * "External" is decided by the VERIFIER, not by which credential shape
  * authenticated: a `bevel_…` connection key resolves external, and so does an
@@ -52,7 +53,16 @@ export const requireExternalSource = (req, res, next) => {
  * primitive both `createToolAuthMiddleware` (our Express hosting) and
  * `validateToken` (the tool-author SDK) are built on, so there is ONE auth path.
  */
-export function createTokenVerifier(externalApiKeyService, internalTokenService) {
+export function createTokenVerifier(externalApiKeyService, internalTokenService, 
+/**
+ * Whether the account an internal token was minted for is still on. An
+ * internal token carries only a user id and lives up to an hour (longer
+ * for the MCP loopback), so without this a switched-off account's running
+ * agent would keep working until it expired. Connection keys need no
+ * second look: their lookup reads the account. Every deployment passes
+ * it; absent, internal tokens are judged on their signature alone.
+ */
+accounts) {
     const missing = { ok: false, status: 401, message: 'A connection key or internal token is required' };
     return async (token) => {
         if (!token)
@@ -67,6 +77,9 @@ export function createTokenVerifier(externalApiKeyService, internalTokenService)
             const claim = internalTokenService.verify(token);
             if (!claim)
                 return { ok: false, status: 401, message: 'Invalid or expired internal token' };
+            if (accounts && !(await accounts.isActive(claim.userId))) {
+                return { ok: false, status: 401, message: ACCOUNT_DEACTIVATED_MESSAGE };
+            }
             return claim.externalProxy
                 ? {
                     ok: true,
@@ -95,8 +108,8 @@ export function createTokenVerifier(externalApiKeyService, internalTokenService)
  * normalize the result to `req.toolAuth` (or the matching status). All auth logic
  * lives in the verifier; this only does header parsing + HTTP mapping.
  */
-export function createToolAuthMiddleware(externalApiKeyService, internalTokenService) {
-    const verify = createTokenVerifier(externalApiKeyService, internalTokenService);
+export function createToolAuthMiddleware(externalApiKeyService, internalTokenService, accounts) {
+    const verify = createTokenVerifier(externalApiKeyService, internalTokenService, accounts);
     return async (req, res, next) => {
         const header = req.headers.authorization;
         if (!header || !header.toLowerCase().startsWith('bearer ')) {
@@ -134,7 +147,7 @@ export function createToolAuthMiddleware(externalApiKeyService, internalTokenSer
  * `requireInternalSource`-gated downstream, so a session/key is 403'd there.
  */
 export function createManualAuthMiddleware(externalApiKeyService, internalTokenService, authService) {
-    const verify = createTokenVerifier(externalApiKeyService, internalTokenService);
+    const verify = createTokenVerifier(externalApiKeyService, internalTokenService, authService);
     return async (req, res, next) => {
         const header = req.headers.authorization;
         if (!header || !header.toLowerCase().startsWith('bearer ')) {
@@ -163,15 +176,24 @@ export function createManualAuthMiddleware(externalApiKeyService, internalTokenS
             return;
         }
         // Otherwise treat the bearer as a browser session JWT.
+        let userId;
         try {
-            const { userId } = authService.verifyToken(token);
-            req.toolAuth = { source: 'session', userId, scope: 'write' };
-            next();
+            ({ userId } = await authService.resolveSession(token));
         }
-        catch {
+        catch (err) {
+            // The account could not be looked up: an outage, not a verdict on the
+            // session, and a 401 would sign a valid caller out over it.
+            if (err instanceof AuthBackendError) {
+                log.error('session account lookup failed:', { err: err.cause });
+                res.status(500).json({ error: 'Authentication backend unavailable' });
+                return;
+            }
             res.setHeader('WWW-Authenticate', WWW_AUTH);
             res.status(401).json({ error: 'Invalid or expired token' });
+            return;
         }
+        req.toolAuth = { source: 'session', userId, scope: 'write' };
+        next();
     };
 }
 //# sourceMappingURL=tool-auth.middleware.js.map

package/dist/modules/tool-auth/tool-auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAI5B,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAkDjH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,KAAK,EAAE,OAAO;qBACf;iBACF;gBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QACvH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C;IAE1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAAwB;IAExB,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAClD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YAC7D,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAG5B,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE7F,OAAO,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAkDjH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,qBAA6C,EAC7C,oBAA0C;AAC1C;;;;;;;GAOG;AACH,QAAwC;IAExC,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAC/G,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAE3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;YAC5F,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC,aAAa;gBACxB,CAAC,CAAC;oBACE,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,MAAM,EAAE,UAAU;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,KAAK,EAAE,OAAO;qBACf;iBACF;gBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;QACvJ,CAAC;QAED,wGAAwG;QACxG,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ;gBACb,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjH,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC;QACvH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,qBAA6C,EAC7C,oBAA0C,EAC1C,QAAwC;IAExC,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAC1F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;gBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CACxC,qBAA6C,EAC7C,oBAA0C,EAC1C,WAA6D;IAE7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC7F,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,4EAA4E;QAC5E,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/G,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;wBAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;oBAC3F,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC3B,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool-handler.d.ts

@@ -1,6 +1,7 @@
 import type { Request, Response } from 'express';
 import { type ToolHandler } from './tool.contract.js';
 import type { ResolveToolContext } from './tool-context.js';
+import { type IWriteAccess } from '../write-access/write-access.js';
 import '../tool-auth/tool-auth.middleware.js';
 export interface ToolHandlerOptions {
     /** Mutating tool — refuse read-scoped callers up front (defense in depth). */
@@ -14,6 +15,6 @@ export interface ToolHandlerOptions {
  * The handler receives `req.body` as the flat args (UTCP's `body_field` already
  * delivered the inner body as the request body).
  */
-export declare function createToolHandlerFactory(resolve: ResolveToolContext): (handler: ToolHandler, opts?: ToolHandlerOptions) => (req: Request, res: Response) => Promise<void>;
+export declare function createToolHandlerFactory(resolve: ResolveToolContext, writeAccess?: IWriteAccess): (handler: ToolHandler, opts?: ToolHandlerOptions) => (req: Request, res: Response) => Promise<void>;
 export type ToolHandlerFactory = ReturnType<typeof createToolHandlerFactory>;
 //# sourceMappingURL=tool-handler.d.ts.map

package/dist/modules/tool-helpers/tool-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,IACtC,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CAyE5D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"tool-handler.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIjD,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGhF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAmD,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACrH,OAAO,sCAAsC,CAAC;AAU9C,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,EAAE,WAAW,GAAE,YAA6B,IAClF,SAAS,WAAW,EAAE,OAAM,kBAAuB,MAC/D,KAAK,OAAO,EAAE,KAAK,QAAQ,KAAG,OAAO,CAAC,IAAI,CAAC,CA4F5D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/modules/tool-helpers/tool-handler.js

@@ -3,6 +3,7 @@ const log = logger('tools');
 import { hasHttpStatus, ToolError } from './tool.contract.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
+import { alwaysWritable, READ_ONLY_CODE, refuseWriteTool } from '../write-access/write-access.js';
 import '../tool-auth/tool-auth.middleware.js'; // Express Request.toolAuth augmentation
 function isAsyncIterable(v) {
     return (typeof v === 'object' &&
@@ -17,7 +18,7 @@ function isAsyncIterable(v) {
  * The handler receives `req.body` as the flat args (UTCP's `body_field` already
  * delivered the inner body as the request body).
  */
-export function createToolHandlerFactory(resolve) {
+export function createToolHandlerFactory(resolve, writeAccess = alwaysWritable) {
     return function toolHandler(handler, opts = {}) {
         return async (req, res) => {
             const auth = req.toolAuth;
@@ -29,11 +30,31 @@ export function createToolHandlerFactory(resolve) {
                 res.status(403).json({ error: 'This tool requires write access.' });
                 return;
             }
+            // Before anything is awaited: a client that goes away during the
+            // write-access check below must still abort the call.
+            //
+            // Asked of the RESPONSE. The request closes as soon as its body has
+            // been read, with the client still there and waiting, so its `close`
+            // says nothing about the client; the response closes when it has been
+            // sent or the connection is gone, and `writableEnded` tells the two
+            // apart.
             const abort = new AbortController();
-            req.on('close', () => {
+            res.on('close', () => {
                 if (!res.writableEnded)
                     abort.abort();
             });
+            // The tool layer's half of the read-only gate: the HTTP gate lets every
+            // tool call through, since only here is a write tool told from a read.
+            if (opts.write) {
+                const refusal = await refuseWriteTool(writeAccess);
+                if (refusal !== null) {
+                    res.status(403).json({ error: refusal, code: READ_ONLY_CODE });
+                    return;
+                }
+                // The client left while the verdict was awaited: nobody to answer.
+                if (abort.signal.aborted)
+                    return;
+            }
             const body = req.body;
             if (body !== undefined && body !== null && (typeof body !== 'object' || Array.isArray(body))) {
                 res.status(400).json({ error: 'Request body must be a JSON object.' });
@@ -42,8 +63,8 @@ export function createToolHandlerFactory(resolve) {
             const args = (body ?? {});
             // `sessionId` rides the tool body like `branch` does: the external MCP
             // proxy injects it (ask-tool continuity convention) and the in-process
-            // agent passes its thread id. Surfaced on the context so the ontology
-            // gate can scope to one run without each handler re-reading args.
+            // agent passes its thread id. Surfaced on the context so the
+            // agent-access gate can name the run without each handler re-reading args.
             const sessionId = typeof args.sessionId === 'string' && args.sessionId.length > 0
                 ? args.sessionId
                 : undefined;

package/dist/modules/tool-helpers/tool-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;wBACrF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,gEAAgE;oBAChE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-handler.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,iCAAiC,CAAC;AACrH,OAAO,sCAAsC,CAAC,CAAC,wCAAwC;AAEvF,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAA0C,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CACxF,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA2B,EAAE,cAA4B,cAAc;IAC9G,OAAO,SAAS,WAAW,CAAC,OAAoB,EAAE,OAA2B,EAAE;QAC7E,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;YAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,iEAAiE;YACjE,sDAAsD;YACtD,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,SAAS;YACT,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,mEAAmE;gBACnE,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;YACnC,CAAC;YACD,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACrD,uEAAuE;YACvE,uEAAuE;YACvE,6DAA6D;YAC7D,2EAA2E;YAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;oBACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;oBAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;wBAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAClD,CAAC;oBACD,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,gEAAgE;gBAChE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,aAAa,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;wBACrF,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,kEAAkE;oBAClE,gEAAgE;oBAChE,iEAAiE;oBACjE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,mEAAmE;oBACnE,6CAA6C;oBAC7C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;wBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;wBAClD,OAAO;oBACT,CAAC;oBACD,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;oBACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/tool.contract.d.ts

@@ -30,8 +30,9 @@ export interface ToolContext {
      * The agent run / conversation id this call belongs to (the agent thread id).
      * Supplied as a `sessionId` field on the tool's input body — the external MCP
      * proxy injects it via the `ask`-tool continuity convention, and the
-     * in-process agent passes its thread id. Used to scope the ontology-session
-     * boundary to one run. Absent for non-agent or unthreaded calls.
+     * in-process agent passes its thread id. Handed to the agent-access hooks,
+     * which is how a deployment scopes a rule to one conversation. Absent for
+     * non-agent or unthreaded calls.
      */
     sessionId?: string;
     /**

package/dist/modules/tool-helpers/tool.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}
+{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAIxB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,gBAAgB,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/C;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAF1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUtF"}

package/dist/modules/tool-helpers/tool.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAoEA;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/tool.contract.ts"],"names":[],"mappings":"AAqEA;;;;;;;;GAQG;AACH,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,GAAG;QACb,MAAM,IAAI,GAAG;QACb,OAAQ,GAA6B,CAAC,OAAO,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}

package/dist/modules/tool-helpers/validate-token.js

@@ -2,7 +2,7 @@ import { createTokenVerifier } from '../tool-auth/tool-auth.middleware.js';
 import { createToolContextResolver } from './tool-context.js';
 import { ToolError } from './tool.contract.js';
 export function createToolValidator(deps) {
-    const verify = createTokenVerifier(deps.externalApiKeyService, deps.internalTokenService);
+    const verify = createTokenVerifier(deps.externalApiKeyService, deps.internalTokenService, deps.authService);
     const resolve = createToolContextResolver(deps);
     return async (token, signal) => {
         let result;

package/dist/modules/tool-helpers/validate-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-token.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/validate-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAwB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAgCjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validate-token.js","sourceRoot":"","sources":["../../../src/modules/tool-helpers/validate-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAwB,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AAgCjE,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/workflow/agent-tools/change-request-summary.d.ts

@@ -0,0 +1,98 @@
+import type { ChangeRequestDetail, ChangeRequestState } from '@bevel-software/platform-shared';
+/**
+ * What `open_change_request` answers, and why it is not the detail the app's
+ * dialog reads.
+ *
+ * The dialog renders every file's diff, so its detail carries every patch. An
+ * agent that opens a change request needs none of that: it needs the link to
+ * hand the user, and enough of the request to confirm it carries the files it
+ * meant to propose and to say what the request is now waiting on. Handing it
+ * the dialog's detail cost ~445,000 characters for 27 files of 15 KB — past
+ * every tool-result limit, so the one field the agent actually needed (the
+ * link) could not be read at all.
+ *
+ * So this is a purpose-made answer: the link first, the request's identity,
+ * who must approve each path, what blocks the merge verbatim from the detail,
+ * and the changed paths with their kind of change — no patch, no file content.
+ * An agent that wants more asks for it by name through `include`.
+ */
+/** What `include` accepts. */
+export type ChangeRequestInclude = 'patches' | 'all-paths';
+/** The two `include` values, for the tool's input schema and its validation. */
+export declare const CHANGE_REQUEST_INCLUDES: readonly ChangeRequestInclude[];
+/** How many paths the answer lists before it cuts; `all-paths` lifts the cut. */
+export declare const CHANGE_REQUEST_PATH_LIMIT = 25;
+/**
+ * The kind of change to one path, in the four words the answer speaks. Git's
+ * own statuses are finer (`modified` vs `changed`, `renamed` vs `copied`) in
+ * ways nothing downstream acts on.
+ */
+export type ChangeKind = 'added' | 'changed' | 'deleted' | 'moved';
+/** One changed path. `previousPath` is where a `moved` one came from. */
+export interface ChangeRequestSummaryFile {
+    path: string;
+    change: ChangeKind;
+    previousPath?: string;
+    /** Unified diff. Only with `include: ["patches"]`, and absent for a binary or oversized file. */
+    patch?: string;
+}
+/**
+ * Who must approve one path, at the same per-path granularity the detail
+ * carries (the access tree resolves a role per file or per folder; this says
+ * what it resolved to for this file).
+ *
+ * The detail's own entry is the dialog's: it also carries each approver's
+ * email, the viewer's own eligibility, and every approval's timestamp and
+ * staleness. Repeated over 25 files that is ~4,500 characters an agent cannot
+ * act on — it may not approve anything — and it is what would push the
+ * 27-file answer back over the limit this ticket exists to get under. So the
+ * answer keeps what "who must approve" means and nothing else.
+ */
+export interface ChangeRequestApprovers {
+    path: string;
+    /** Roles that confer approval here. `everyone` means any signed-in approver. */
+    roles: string[];
+    /** Approvers named directly, by display name. */
+    users: string[];
+    /** True once an eligible approver has approved at the request's current head. */
+    approved: boolean;
+    /** False when the merge gate does not bind this path — then nobody has to approve it. */
+    inMergeGate: boolean;
+    /**
+     * Present when the access tree could not be resolved for this path — which
+     * includes a detail that carries no verdict at all. Then empty
+     * `roles`/`users` means "not known", NOT "nobody has to approve".
+     */
+    approversUnknown?: true;
+}
+export interface ChangeRequestSummary {
+    /** First field on purpose: it is the one an agent must hand the user. */
+    url: string;
+    urlNote?: string;
+    number: number;
+    title: string;
+    state: ChangeRequestState;
+    sourceBranch: string;
+    targetBranch: string;
+    /** Who must approve, one entry per listed path. */
+    approvals: ChangeRequestApprovers[];
+    /** What blocks the merge — verbatim from the detail. Empty when nothing does. */
+    mergeBlockedReasons: string[];
+    /** The changed paths, cut to {@link CHANGE_REQUEST_PATH_LIMIT} unless `all-paths` was asked for. */
+    files: ChangeRequestSummaryFile[];
+    /** How many files the request changes in total, cut or not. */
+    totalFiles: number;
+}
+/**
+ * Shape the tool's answer out of the detail the service already returns. Pure:
+ * the service and the app's routes are untouched, and the detail they serve is
+ * exactly what it was.
+ *
+ * `approvals` is narrowed to the paths the answer lists, because the detail's
+ * contract is one entry per listed file. Nothing about the merge gate is lost
+ * by that: `mergeBlockedReasons` names every missing approval, cut or not.
+ */
+export declare function summarizeChangeRequest(detail: ChangeRequestDetail, include?: readonly ChangeRequestInclude[]): ChangeRequestSummary;
+/** The `include` values off a tool call's arguments; anything else is ignored. */
+export declare function parseInclude(raw: unknown): ChangeRequestInclude[];
+//# sourceMappingURL=change-request-summary.d.ts.map

package/dist/modules/workflow/agent-tools/change-request-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-request-summary.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/change-request-summary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAInB,MAAM,iCAAiC,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AAEH,8BAA8B;AAC9B,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE3D,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAA6B,CAAC;AAEjG,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnE,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,iFAAiF;IACjF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oGAAoG;IACpG,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AA+CD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,GAAE,SAAS,oBAAoB,EAAO,GAC5C,oBAAoB,CAkBtB;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAGjE"}

package/dist/modules/workflow/agent-tools/change-request-summary.js

@@ -0,0 +1,81 @@
+/** The two `include` values, for the tool's input schema and its validation. */
+export const CHANGE_REQUEST_INCLUDES = ['patches', 'all-paths'];
+/** How many paths the answer lists before it cuts; `all-paths` lifts the cut. */
+export const CHANGE_REQUEST_PATH_LIMIT = 25;
+/**
+ * A copy and a rename both carry `previousPath`, and the one thing a reader
+ * does with either is look at where the text came from — so both read `moved`.
+ * `unchanged` is a file the request lists without changing (git reports it on
+ * a mode-only change); `changed` is the honest word for it among these four.
+ */
+function changeKindOf(status) {
+    switch (status) {
+        case 'added':
+            return 'added';
+        case 'removed':
+            return 'deleted';
+        case 'renamed':
+        case 'copied':
+            return 'moved';
+        default:
+            return 'changed';
+    }
+}
+function approversOf(approval) {
+    const eligible = approval.eligibleApprovers ?? { roles: [], users: [] };
+    return {
+        path: approval.path,
+        roles: eligible.roles ?? [],
+        users: (eligible.users ?? []).map((u) => u.name),
+        approved: approval.isApproved,
+        inMergeGate: approval.inMergeGate,
+        // Anything but an explicit `true` is unresolved — a detail built before
+        // the flag existed carries no flag at all, and reading that as "resolved"
+        // would turn an empty approver set into "nobody must approve". Same
+        // fail-closed reading as `computeViewerCanUpdate`.
+        ...(approval.eligibilityResolved !== true ? { approversUnknown: true } : {}),
+    };
+}
+function summaryFileOf(file, withPatch) {
+    return {
+        path: file.path,
+        change: changeKindOf(file.status),
+        ...(file.previousPath ? { previousPath: file.previousPath } : {}),
+        ...(withPatch && file.patch ? { patch: file.patch } : {}),
+    };
+}
+/**
+ * Shape the tool's answer out of the detail the service already returns. Pure:
+ * the service and the app's routes are untouched, and the detail they serve is
+ * exactly what it was.
+ *
+ * `approvals` is narrowed to the paths the answer lists, because the detail's
+ * contract is one entry per listed file. Nothing about the merge gate is lost
+ * by that: `mergeBlockedReasons` names every missing approval, cut or not.
+ */
+export function summarizeChangeRequest(detail, include = []) {
+    const all = detail.files ?? [];
+    const withPatch = include.includes('patches');
+    const listed = include.includes('all-paths') ? all : all.slice(0, CHANGE_REQUEST_PATH_LIMIT);
+    const listedPaths = new Set(listed.map((f) => f.path));
+    return {
+        url: detail.url,
+        ...(detail.urlNote ? { urlNote: detail.urlNote } : {}),
+        number: detail.number,
+        title: detail.title,
+        state: detail.state,
+        sourceBranch: detail.branch,
+        targetBranch: detail.base,
+        approvals: (detail.approvals ?? []).filter((a) => listedPaths.has(a.path)).map(approversOf),
+        mergeBlockedReasons: detail.mergeBlockedReasons ?? [],
+        files: listed.map((f) => summaryFileOf(f, withPatch)),
+        totalFiles: all.length,
+    };
+}
+/** The `include` values off a tool call's arguments; anything else is ignored. */
+export function parseInclude(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return CHANGE_REQUEST_INCLUDES.filter((v) => raw.includes(v));
+}
+//# sourceMappingURL=change-request-summary.js.map

package/dist/modules/workflow/agent-tools/change-request-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-request-summary.js","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/change-request-summary.ts"],"names":[],"mappings":"AA6BA,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAoC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAEjG,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAmE5C;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAgC;IACpD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAsB;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,QAAQ,EAAE,QAAQ,CAAC,UAAU;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,mDAAmD;QACnD,GAAG,CAAC,QAAQ,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAiB,EAAE,SAAkB;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,UAA2C,EAAE;IAE7C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAC3F,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE;QACrD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrD,UAAU,EAAE,GAAG,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/modules/workflow/agent-tools/workflow.tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.tools.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/workflow.tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,sCAAsC,CAAC;AAGtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAmH/D;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,kBAAkB;AAC/B,2GAA2G;AAC3G,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC,GAC9F,IAAI,CA4cN"}
+{"version":3,"file":"workflow.tools.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/workflow.tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,sCAAsC,CAAC;AAGtF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAuJ/D;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,kBAAkB;AAC/B,2GAA2G;AAC3G,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC,GAC9F,IAAI,CA2dN"}