@bevel-software/platform-core-backend 0.32.0 → 0.34.0

package/dist/modules/tool-registry/read-only-hints.js

@@ -0,0 +1,212 @@
+import express from 'express';
+import { META_TOOL_NAMES, META_TOOL_READ_ONLY, READ_ONLY_TAG } from '@bevel-software/platform-mcp-core';
+import { declaresWrite } from './tool.contract.js';
+import { parseToolReadOnlyOverrides } from '../settings/index.js';
+import { logger } from '../../shared/logging.js';
+import '../auth/index.js'; // Express Request augmentation (req.userId, req.userEmail), through auth's public entry
+const log = logger('tool-read-only-hints');
+/** The deployment setting the overrides live in — see `CORE_SETTINGS`. */
+export const TOOL_READ_ONLY_SETTING = 'toolReadOnlyOverrides';
+/** A name that is neither a platform tool nor a meta-tool. */
+export class UnknownToolError extends Error {
+    toolName;
+    constructor(toolName) {
+        super(`"${toolName}" is not a platform tool or a code-mode meta-tool of this deployment.`);
+        this.toolName = toolName;
+        this.name = 'UnknownToolError';
+    }
+}
+/**
+ * What MCP clients are told about each platform tool's effect.
+ *
+ * Every platform tool declares whether it writes (the `write` tag `toolDef`
+ * puts on it), and that declaration is its BUILT-IN read-only hint: a tool
+ * that declares no write only reads. The same declaration already decides
+ * branch handling and the write gate, so a tool cannot be a reader there and
+ * a writer here. The code-mode meta-tools are not in the manual, so theirs is
+ * `META_TOOL_READ_ONLY`.
+ *
+ * An admin may override either kind per deployment, in either direction, from
+ * the Tools page. The override is the `toolReadOnlyOverrides` deployment
+ * setting, read from the database on every use — so a change made on one
+ * replica is in the next listing of every other, without a restart.
+ *
+ * Carried to the two MCP servers in two ways, both from here, and both joined
+ * on at LISTING time, never baked into anything cached: the hosted endpoint
+ * lists each platform tool with the built-in hint the agent manual's
+ * `read-only` tag carries (`GET /agent/utcp`), then applies {@link overrides}
+ * read for that very listing; the local `hexis-mcp` — whose discovery goes
+ * through the MCP endpoint, where tags do not survive — reads every effective
+ * hint from `GET /agent/tool-hints` per listing. Tools from the knowledge base (`.tool` manuals,
+ * plugin MCP servers) are not the registry's and are untouched.
+ */
+export class ToolReadOnlyHints {
+    registry;
+    settings;
+    constructor(registry, settings) {
+        this.registry = registry;
+        this.settings = settings;
+    }
+    /**
+     * The overrides in effect, as the database has them now. A value that cannot
+     * be read, or is not a map, is no override: every consumer then serves the
+     * built-in hints rather than failing its listing.
+     */
+    async overrides() {
+        let raw;
+        try {
+            raw = await this.settings.reload(TOOL_READ_ONLY_SETTING);
+        }
+        catch (err) {
+            log.warn(`could not read ${TOOL_READ_ONLY_SETTING}; using the built-in hints:`, { err });
+            return {};
+        }
+        const parsed = parseToolReadOnlyOverrides(raw);
+        if (parsed === null) {
+            log.warn(`the stored ${TOOL_READ_ONLY_SETTING} is not a map of tool names to booleans — ignoring it.`);
+            return {};
+        }
+        return parsed;
+    }
+    /**
+     * The agent manual's tools, each tagged `read-only` exactly when its
+     * BUILT-IN hint is true — its write declaration, never an override. The
+     * hosted endpoint caches the tool surface it builds from this manual, so an
+     * override in it would outlive the toggle that set it; the override is
+     * joined on per listing instead (see the class note). New objects: the
+     * registry's own defs are shared by every request and are never written to.
+     */
+    apply(tools) {
+        return tools.map((tool) => {
+            const readOnly = !declaresWrite(tool);
+            const tags = (tool.tags ?? []).filter((t) => t !== READ_ONLY_TAG);
+            return { ...tool, tags: readOnly ? [...tags, READ_ONLY_TAG] : tags };
+        });
+    }
+    /** Every platform tool, then every meta-tool, with its built-in, override and effective value. */
+    async describe() {
+        const [tools, overrides] = await Promise.all([this.registry.listExternal({}), this.overrides()]);
+        const entry = (name, kind, builtIn) => {
+            const override = Object.hasOwn(overrides, name) ? overrides[name] : null;
+            return { name, kind, builtIn, override, readOnly: override ?? builtIn };
+        };
+        const seen = new Set();
+        const platform = [];
+        for (const tool of tools) {
+            // A registry copy of a meta-tool's name is never listed as itself; the
+            // meta-tool below is what that name means to a client.
+            if (META_TOOL_NAMES.has(tool.name) || seen.has(tool.name))
+                continue;
+            seen.add(tool.name);
+            platform.push(entry(tool.name, 'platform', !declaresWrite(tool)));
+        }
+        const meta = [...META_TOOL_NAMES].map((name) => entry(name, 'meta', META_TOOL_READ_ONLY[name] === true));
+        return [...platform, ...meta];
+    }
+    /** Every tool's effective hint, by name — what `hexis-mcp` lists. */
+    async hints() {
+        return Object.fromEntries((await this.describe()).map((e) => [e.name, e.readOnly]));
+    }
+    /**
+     * Set one tool's override, or remove it (`null`), and answer the tool as it
+     * now stands. A compare-and-swap on the stored map, retried, so two admins
+     * saving different tools at once both land.
+     *
+     * `updatedBy` is the admin's USER ID, never their email: it lands in
+     * `deployment_settings.updated_by`, a uuid referencing `users.id`, and
+     * anything else is refused by the database.
+     */
+    async set(name, readOnly, updatedBy) {
+        const known = (await this.describe()).find((e) => e.name === name);
+        if (!known)
+            throw new UnknownToolError(name);
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const current = await this.settings.reload(TOOL_READ_ONLY_SETTING);
+            // Own properties throughout, so a name like `__proto__` is stored as itself.
+            const map = Object.fromEntries(Object.entries(parseToolReadOnlyOverrides(current) ?? {}).filter(([key]) => key !== name));
+            if (readOnly !== null)
+                Object.defineProperty(map, name, { value: readOnly, enumerable: true, writable: true, configurable: true });
+            const next = Object.keys(map).length ? JSON.stringify(map) : null;
+            const done = !current
+                ? next === null || (await this.settings.recordIfAbsent(TOOL_READ_ONLY_SETTING, next, updatedBy))
+                : next === current || (await this.settings.swapIfValue(TOOL_READ_ONLY_SETTING, current, next, updatedBy));
+            if (done) {
+                const override = readOnly;
+                return { ...known, override, readOnly: override ?? known.builtIn };
+            }
+        }
+        throw new Error('The read-only override kept changing under this save; try again.');
+    }
+}
+/**
+ * The routes over {@link IToolReadOnlyHints}:
+ *
+ *   GET /agent/tool-hints     — every tool's effective hint, for `hexis-mcp`
+ *                               (behind `manualAuth`, like the manual itself)
+ *   GET /tool-hints           — every tool with its effective value, for the
+ *                               Tools page; any signed-in person, plus whether
+ *                               they may edit. The built-in value and the
+ *                               override go to an admin only: who changed what
+ *                               clients are told is the admins' business.
+ *   PUT /tool-hints/:name     — `{ readOnly: true | false | null }`, admins only;
+ *                               null removes the override
+ *
+ * The agent route is returned separately so it can mount on the tools router,
+ * ahead of the JWT `/api` mounts; the other two mount behind `authMiddleware`.
+ */
+export function createToolHintsAgentRoutes(hints, manualAuth) {
+    const router = express.Router();
+    router.get('/agent/tool-hints', manualAuth, async (_req, res) => {
+        try {
+            res.json({ tools: await hints.hints() });
+        }
+        catch (err) {
+            log.error('tool-hints failed:', { err });
+            res.status(500).json({ error: 'Failed to read the tool hints' });
+        }
+    });
+    return router;
+}
+export function createToolHintsRoutes(hints, adminAccess) {
+    const router = express.Router();
+    router.get('/tool-hints', async (req, res) => {
+        try {
+            const [tools, canEdit] = await Promise.all([hints.describe(), adminAccess.isAdmin(req.userEmail)]);
+            res.json({ canEdit, tools: canEdit ? tools : tools.map(({ name, kind, readOnly }) => ({ name, kind, readOnly })) });
+        }
+        catch (err) {
+            log.error('tool-hints listing failed:', { err });
+            res.status(500).json({ error: 'Failed to read the tool hints' });
+        }
+    });
+    router.put('/tool-hints/:name', express.json(), async (req, res) => {
+        if (!(await adminAccess.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Only an admin can change what clients are told about a tool.' });
+            return;
+        }
+        const readOnly = req.body?.readOnly;
+        if (readOnly !== true && readOnly !== false && readOnly !== null) {
+            res.status(400).json({ error: '`readOnly` must be true, false, or null to remove the override.' });
+            return;
+        }
+        try {
+            const name = String(req.params.name);
+            // The user ID, as the setup routes record it: `updated_by` is a uuid column.
+            const entry = await hints.set(name, readOnly, req.userId ?? null);
+            // The admin by user id, as the row records them: an address is personal
+            // data, and the log keeps its lines longer than the audit needs it.
+            log.info(`admin ${req.userId ?? 'unknown'} set the read-only hint of "${name}" to ${readOnly === null ? 'its built-in value' : String(readOnly)}`);
+            res.json(entry);
+        }
+        catch (err) {
+            if (err instanceof UnknownToolError) {
+                res.status(404).json({ error: err.message });
+                return;
+            }
+            log.error('tool-hints save failed:', { err });
+            res.status(500).json({ error: 'Failed to save the override' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=read-only-hints.js.map

package/dist/modules/tool-registry/read-only-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-hints.js","sourceRoot":"","sources":["../../../src/modules/tool-registry/read-only-hints.ts"],"names":[],"mappings":"AAAA,OAAO,OAA8C,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACxG,OAAO,EAAE,aAAa,EAAqC,MAAM,oBAAoB,CAAC;AAOtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjD,OAAO,kBAAkB,CAAC,CAAC,wFAAwF;AAEnH,MAAM,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAE3C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,8DAA8D;AAC9D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,IAAI,QAAQ,uEAAuE,CAAC,CAAC;QADxE,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,QAA6C,EAC7C,QAAmC;QADnC,aAAQ,GAAR,QAAQ,CAAqC;QAC7C,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,sBAAsB,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,cAAc,sBAAsB,wDAAwD,CAAC,CAAC;YACvG,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAiB;QACrB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAClE,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAA+B,EAAE,OAAgB,EAAqB,EAAE;YACnG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC1E,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,QAAQ,GAAwB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,KAAK;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,QAAwB,EAAE,SAAwB;QACxE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACnE,6EAA6E;YAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAC1F,CAAC;YACF,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACnI,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,MAAM,IAAI,GAAG,CAAC,OAAO;gBACnB,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAChG,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAC5G,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,QAAQ,CAAC;gBAC1B,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAyB,EAAE,UAA0B;IAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,WAAiD;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAG,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACnG,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAG,EAAE,EAAE;QAC1E,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA2C,EAAE,QAAQ,CAAC;QAC5E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,6EAA6E;YAC7E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YAClE,wEAAwE;YACxE,oEAAoE;YACpE,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,SAAS,+BAA+B,IAAI,QAAQ,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnJ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/tool-registry/tool.contract.d.ts

@@ -1,5 +1,14 @@
 import type { JsonSchema, Tool as UtcpTool } from '@utcp/sdk';
+import type { ConnectionScope } from '../agent-scope/index.js';
 export type { JsonSchema, UtcpTool };
+/**
+ * Whether a tool declares that it writes: the `write` tag `toolDef` puts on
+ * every tool declared `write: true`. The one test of that declaration — it
+ * decides both a tool's built-in read-only hint and whether a read-scoped
+ * caller is shown the tool, so a tool cannot be a reader in one and a writer
+ * in the other.
+ */
+export declare function declaresWrite(tool: Pick<UtcpTool, 'tags'>): boolean;
 /**
  * Per-request context handed to a `ToolProvider` when the manual is built, so a
  * provider can tailor its def to the caller (e.g. the skill tools name only the
@@ -10,6 +19,12 @@ export interface ToolManualContext {
     userEmail?: string;
     /** The requesting user's id, when it could be resolved (for per-user gating). */
     userId?: string;
+    /**
+     * What the requesting connection may load, when it was made as an agent configuration
+     * file (`modules/agent-scope`): a provider that names skills or connectors
+     * in its description names only those. Absent is Everything.
+     */
+    connectionScope?: ConnectionScope;
 }
 /**
  * A lazy tool definition: a callable that produces a UTCP `Tool` at list time.

package/dist/modules/tool-registry/tool.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-registry/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IAC1D,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IAC1D;;;;OAIG;IACH,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxD,YAAY,CAAC,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"tool.contract.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-registry/tool.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAEnE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,iBAAiB,KAAK,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IAC1D,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IAC1D;;;;OAIG;IACH,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACxD,YAAY,CAAC,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3D,YAAY,CAAC,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC5D"}

package/dist/modules/tool-registry/tool.contract.js

@@ -1,2 +1,11 @@
-export {};
+/**
+ * Whether a tool declares that it writes: the `write` tag `toolDef` puts on
+ * every tool declared `write: true`. The one test of that declaration — it
+ * decides both a tool's built-in read-only hint and whether a read-scoped
+ * caller is shown the tool, so a tool cannot be a reader in one and a writer
+ * in the other.
+ */
+export function declaresWrite(tool) {
+    return (tool.tags ?? []).includes('write');
+}
 //# sourceMappingURL=tool.contract.js.map

package/dist/modules/tool-registry/tool.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-registry/tool.contract.ts"],"names":[],"mappings":""}
+{"version":3,"file":"tool.contract.js","sourceRoot":"","sources":["../../../src/modules/tool-registry/tool.contract.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAA4B;IACxD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/modules/update-check/update-check.routes.d.ts

@@ -1,7 +1,7 @@
 import express from 'express';
-import type { IAdminAccessService } from '../admin/admin.interface.js';
+import type { IAdminAccessService } from '../admin/index.js';
 import type { UpdateCheckService } from './update-check.service.js';
-import '../auth/auth.middleware.js';
+import '../auth/index.js';
 /**
  * `GET /api/update-check` — ADMIN-ONLY (same `requireAdmin` shape as the setup
  * routes): admins are the audience of the banner and the only ones who can act

package/dist/modules/update-check/update-check.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/update-check/update-check.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,4BAA4B,CAAC;AAEpC;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAC1C,WAAW,EAAE,mBAAmB,GAC/B,OAAO,CAAC,MAAM,CAYhB"}
+{"version":3,"file":"update-check.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/update-check/update-check.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAC1C,WAAW,EAAE,mBAAmB,GAC/B,OAAO,CAAC,MAAM,CAYhB"}

package/dist/modules/update-check/update-check.routes.js

@@ -1,5 +1,5 @@
 import express from 'express';
-import '../auth/auth.middleware.js'; // Express Request augmentation
+import '../auth/index.js'; // Express Request augmentation
 /**
  * `GET /api/update-check` — ADMIN-ONLY (same `requireAdmin` shape as the setup
  * routes): admins are the audience of the banner and the only ones who can act

package/dist/modules/update-check/update-check.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.routes.js","sourceRoot":"","sources":["../../../src/modules/update-check/update-check.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,4BAA4B,CAAC,CAAC,+BAA+B;AAEpE;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0C,EAC1C,WAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"update-check.routes.js","sourceRoot":"","sources":["../../../src/modules/update-check/update-check.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,kBAAkB,CAAC,CAAC,+BAA+B;AAE1D;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA0C,EAC1C,WAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/workflow/agent-tools/change-request-read-shape.d.ts

@@ -22,8 +22,8 @@
  *     and an agent reading `state` should not have to read a second field to
  *     learn whether the change landed.
  *   - **One name per path.** GitHub names a pull-request file's path `filename`
- *     and a review comment's `path`; mirroring that inconsistency was the point
- *     while these tools wore GitHub's names, and is now just a trap. Every path
+ *     and elsewhere `path`; mirroring that inconsistency was the point while
+ *     these tools wore GitHub's names, and is now just a trap. Every path
  *     in every answer is `path`, and a moved file's old name is `previousPath`,
  *     as `open_change_request` names them.
  *   - **A file's kind of change** is `change` — `added` / `changed` / `deleted`
@@ -37,9 +37,6 @@
  *   - **`stale`, not `DISMISSED`.** Hexis's word for an approval a later push
  *     invalidated is `isStale`; a review entry reports `stale: true` rather
  *     than borrowing GitHub's review state.
- *   - **A reply names its parent `parentId`**, which is the argument
- *     `post_change_request_comment` takes to create one. Reading a comment and
- *     replying to it use the same word for the same thing.
  *
  * The tools' INPUTS are untouched and stay GitHub's (`state`, `head`, `base`,
  * `author`, `per_page`, `page`, `include`): the ticket pins them by name, and
@@ -52,18 +49,18 @@
  * one of the functions below (which belongs to a test that can read it). The
  * tools file does the IO and calls in here for every decision.
  */
-import type { ChangeRequest, ChangeRequestComment, ChangeRequestDetail, ChangeRequestState, ChangedFile, FileApproval } from '@bevel-software/platform-shared';
+import { type ChangeRequest, type ChangeRequestDetail, type ChangeRequestState, type ChangedFile, type FileApproval } from '@bevel-software/platform-shared';
 import { type ChangeKind } from './change-request-summary.js';
-/** A person on a change request, a review or a comment. */
+/** A person on a change request or a review. */
 export interface CrUser {
     /** Hexis's author login — `user-<first 12 of the email hash>`, no raw email. */
     login: string;
     /** Display name, when Hexis knows one. */
     name?: string;
     /**
-     * The person's address, for a comment author and an approver — the two
-     * places the app's own change-request surfaces already show it, and what an
-     * agent needs to address a reply to a reviewer. Never set on a change
+     * The person's address, for an approver — where the app's own
+     * change-request surfaces already show it, and what an agent needs to
+     * reach a reviewer. Never set on a change
      * request's `author`, which carries a hash-derived login only.
      */
     email?: string;
@@ -191,25 +188,6 @@ export interface CrReview {
     /** How many further files of this review the caller may not read. */
     withheldFiles: number;
 }
-export interface CrComment {
-    id: string;
-    author: CrUser;
-    body: string;
-    /** Set on a file-level or inline comment. */
-    path?: string;
-    /** Set on an inline comment. */
-    line?: number;
-    /**
-     * The comment this one replies to — the same `parentId`
-     * `post_change_request_comment` takes to post the reply.
-     */
-    parentId?: string;
-    /** The head the comment was anchored to. */
-    headSha: string;
-    createdAt: string;
-    /** Present once edited. */
-    updatedAt?: string;
-}
 /** One page of a list, and whether there is another. */
 export interface CrPage<T> {
     items: T[];
@@ -287,7 +265,7 @@ export declare function toCrSummary(cr: ChangeRequest, counts: {
     readable: number;
     withheld: number;
 }): CrSummary;
-/** A detail: the row, the author's description, and the gate as this caller sees it. */
+/** A detail: the row, its description, and the gate as this caller sees it. */
 export declare function toCrDetail(detail: ChangeRequestDetail, counts: {
     readable: number;
     withheld: number;
@@ -295,42 +273,6 @@ export declare function toCrDetail(detail: ChangeRequestDetail, counts: {
     visible: string[];
     withheld: number;
 }, viewer: CrViewer): CrDetail;
-/**
- * The part of a change-request body its AUTHOR wrote.
- *
- * A Hexis body is part human and part machine: `openChangeRequest` appends an
- * `## Affected owners` block — one line per changed path, naming that path and
- * its eligible approvers — to whatever the author typed. Returning the body
- * verbatim NAMED every file of the request, including the ones this caller may
- * not read: Local Testing caught a GTM-team reader being handed
- * `- \`KnowledgeBase/Engineering/…\` — Admin` out of a request whose file list
- * had correctly withheld that very path.
- *
- * So the generated block goes, and NOTHING ELSE does. The first cut at this
- * copied the app's dialog, which drops everything from the first `##` heading
- * on; Razvan's review (2026-10-02) asked for the narrower cut, because an
- * author who writes their description in sections loses it from that heading
- * onwards and is never told. The generated block is appended LAST and begins
- * with a line that is exactly `## Affected owners`, so cutting at the LAST such
- * line removes the machinery and keeps every heading a person wrote. (An author
- * who writes that exact heading themselves loses their text from there — the
- * safe direction, and the only way this can err.)
- *
- * Hexis's OWN hidden markers go too — the `<!--hexis:…-->` / `<!--bevel:…-->`
- * comments older bodies carry identity in — and no other comment: an HTML
- * comment the author wrote is the author's prose, like the rest.
- *
- * Who must approve each file is NOT lost by this — it is what
- * `list_change_request_files` answers under `requiredApprovers`, per file and
- * access-filtered, which is where a caller should read it from anyway.
- *
- * Two things this deliberately does not do. It does not vary by caller: one
- * body for everyone is a body nobody has to reason about. And it does not touch
- * the author's own prose, which may mention any path they chose to write about —
- * that is a person's sentence, shown to every viewer in the app, not Hexis
- * naming a file it was asked to withhold.
- */
-export declare function authorsDescription(body: string): string;
 /**
  * What this caller may do with the request.
  *
@@ -403,47 +345,10 @@ export declare function loginFor(email: string): string;
  * readable approvals alone, for the same reason.
  *
  * Hexis records nothing about who DECLINED a request — a rejection closes it
- * and stores no reviewer — so no review entry can report one. A reviewer's
- * objection lives in a comment, which `list_change_request_comments` returns.
+ * and stores no reviewer — so no review entry can report one.
  */
 export declare function toCrReviews(approvals: FileApproval[], mayShow?: (path: string) => boolean): {
     reviews: CrReview[];
     withheldReviews: number;
 };
-/** A comment. Covers the file-anchored and the general ones — Hexis has one table. */
-export declare function toCrComment(comment: ChangeRequestComment): CrComment;
-/**
- * The comments the caller may read, replies included in the answer only when
- * the comment they reply to is.
- *
- * A comment with no path is about the request as a whole, and a comment with
- * one is as readable as that path is NAMEABLE here (`mayShow`, so a comment
- * anchored to the new name of a file withheld for its old one goes with the
- * file rather than announcing it). A REPLY is neither, quite: it carries no
- * path of its own when it was posted without one, so judged on itself it is a
- * general comment — and `post_change_request_comment` takes `parentId` without
- * requiring `path`, so a reply to a comment on a withheld file was returned
- * with its body and a `parentId` naming a comment the caller cannot see.
- * Razvan's review (2026-10-02) asked for the rule the ticket states: a reply is
- * shown only when its parent is.
- *
- * So a comment is visible when its OWN path may be shown (if it has one) AND
- * its parent is visible, all the way up the chain. Both halves are needed:
- * inheriting only would show a reply naming a withheld file under a readable
- * parent, and checking only its own path would show it under a withheld one.
- *
- * Fail-closed at the edges. A `parentId` naming a comment that is not in this
- * request's list (deleted, or from somewhere this answer cannot see) is not
- * provably pathless, so the reply goes. A cycle — which the schema does not
- * permit and a corrupted row could still hold — is unresolvable, so it goes
- * too. Both are counted in the withheld total, never named.
- */
-export declare function visibleComments<T extends {
-    id: string;
-    path?: string;
-    parentId?: string;
-}>(comments: T[], mayShow: (path: string) => boolean): {
-    visible: T[];
-    withheld: number;
-};
 //# sourceMappingURL=change-request-read-shape.d.ts.map

package/dist/modules/workflow/agent-tools/change-request-read-shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-request-read-shape.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/change-request-read-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,YAAY,EACb,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE5E,2DAA2D;AAC3D,MAAM,WAAW,MAAM;IACrB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,2DAA2D,CAAC;AAEtG,+EAA+E;AAC/E,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,yEAAyE;IACzE,2BAA2B,EAAE,MAAM,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,iBAAiB,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,CAAC;IACxB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,gDAAgD;IAChD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wDAAwD;AACxD,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAOA;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAS5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,kBAAkB,EAAE,CAIjF;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,MAAM,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,UAAU,CAAC,EAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAKT;AAED,iDAAiD;AACjD,wBAAgB,QAAQ,CACtB,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EACnC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAEV;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC7C,SAAS,CA8BX;AAED,wFAAwF;AACxF,wBAAgB,UAAU,CACxB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9C,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACjD,MAAM,EAAE,QAAQ,GACf,QAAQ,CAcV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,OAAO,GAAG,qBAAqB,GAAG,eAAe,GAAG,sBAAsB,CAC3E,EACD,cAAc,EAAE,OAAO,EACvB,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAAE,GACvD,QAAQ,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,EAChD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACjC,OAAO,CAGT;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,GAAG,MAAM,EAAE,CAElF;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,CACtB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,YAAY,GAAG,SAAS;AAClC,+FAA+F;AAC/F,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC,MAAM,CAsCR;AAWD,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,YAAY,EAAE,EACzB,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC9C;IAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAmClD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAgBpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EACxF,QAAQ,EAAE,CAAC,EAAE,EACb,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACjC;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAmBpC"}
+{"version":3,"file":"change-request-read-shape.d.ts","sourceRoot":"","sources":["../../../../src/modules/workflow/agent-tools/change-request-read-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE5E,gDAAgD;AAChD,MAAM,WAAW,MAAM;IACrB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,2DAA2D,CAAC;AAEtG,+EAA+E;AAC/E,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,yEAAyE;IACzE,2BAA2B,EAAE,MAAM,CAAC;IACpC,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,iBAAiB,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,IAAI,CAAC;IACxB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,gDAAgD;IAChD,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAOA;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAS5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,kBAAkB,EAAE,CAIjF;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,MAAM,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,UAAU,CAAC,EAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAKT;AAED,iDAAiD;AACjD,wBAAgB,QAAQ,CACtB,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EACnC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAEV;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CACzB,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC7C,SAAS,CA8BX;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC9C,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACjD,MAAM,EAAE,QAAQ,GACf,QAAQ,CAiBV;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,OAAO,GAAG,qBAAqB,GAAG,eAAe,GAAG,sBAAsB,CAC3E,EACD,cAAc,EAAE,OAAO,EACvB,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAAE,GACvD,QAAQ,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EAAE,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAIzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,EAChD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GACjC,OAAO,CAGT;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,GAAG,MAAM,EAAE,CAElF;AAED,8CAA8C;AAC9C,wBAAgB,QAAQ,CACtB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,YAAY,GAAG,SAAS;AAClC,+FAA+F;AAC/F,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC,MAAM,CAsCR;AAWD,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,YAAY,EAAE,EACzB,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC9C;IAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAmClD"}