@blogic-cz/agent-tools 0.18.1 → 1.0.0

package/dist/azdo-tool/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/azdo-tool/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC"}

package/dist/config/index.d.ts

@@ -1,4 +1,4 @@
-export type { AgentToolsConfig, AzureConfig, K8sConfig, DbEnvConfig, DbAllowedMutationTargets, DbMutationOperation, DatabaseConfig, ObservabilityConfig, ObservabilityEnvTarget, LogsConfig, AuditConfig, CliToolOverride, CredentialGuardConfig, GitHubPrTitlePolicy, GitHubRepoConfig, } from "./types";
+export type { AgentToolsConfig, AzureConfig, AzurePlatformConfig, K8sConfig, DbEnvConfig, DbAllowedMutationTargets, DbMutationOperation, DatabaseConfig, ObservabilityConfig, ObservabilityEnvTarget, LogsConfig, AuditConfig, CliToolOverride, CredentialGuardConfig, GitHubPrTitlePolicy, GitHubRepoConfig, } from "./types";
 export { DbMutationOperationSchema } from "./types";
 export { ConfigService, ConfigServiceLayer, getToolConfig, getDefaultEnvironment, getGitHubConfig, resolveGitHubRepoTarget, loadConfig, } from "./loader";
 //# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,UAAU,GACX,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,UAAU,GACX,MAAM,UAAU,CAAC"}

package/dist/config/loader.d.ts

@@ -13,7 +13,7 @@ export declare class ConfigLoadError extends ConfigLoadError_base<{
 }> {
 }
 export declare const ConfigServiceLayer: Layer.Layer<ConfigService, ConfigLoadError, never>;
-type ProfiledSection = keyof Pick<AgentToolsConfig, "azure" | "kubernetes" | "database" | "observability" | "logs">;
+type ProfiledSection = keyof Pick<AgentToolsConfig, "azure" | "azurePlatform" | "kubernetes" | "database" | "observability" | "logs">;
 export declare function getToolConfig<T>(config: AgentToolsConfig | undefined, section: ProfiledSection, profile?: string): T | undefined;
 export declare function getDefaultEnvironment(config: AgentToolsConfig | undefined): string | undefined;
 export declare function getGitHubConfig(config: AgentToolsConfig | undefined, profile?: string): GitHubRepoConfig | undefined;

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AA6NlE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,UAAU,GAAE,MAA4B,GACvC,gBAAgB,CAmClB;AAmFD,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcxE;;AAED,qBAAa,aAAc,SAAQ,kBAElC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,kBAAkB,oDAM9B,CAAC;AAEF,KAAK,eAAe,GAAG,MAAM,IAAI,CAC/B,gBAAgB,EAChB,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,MAAM,CAC/D,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAkCf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE9F;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAc9B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,SAAS,CAqBpB"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAsOlE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,UAAU,GAAE,MAA4B,GACvC,gBAAgB,CAmClB;AAmFD,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcxE;;AAED,qBAAa,aAAc,SAAQ,kBAElC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,kBAAkB,oDAM9B,CAAC;AAEF,KAAK,eAAe,GAAG,MAAM,IAAI,CAC/B,gBAAgB,EAChB,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,MAAM,CACjF,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAkCf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE9F;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAc9B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,SAAS,CAqBpB"}

package/dist/config/types.d.ts

@@ -1,10 +1,25 @@
 import { Schema } from "effect";
-/** Azure DevOps profile configuration */
+/** Azure DevOps profile, consumed by azdo-tool. */
 export type AzureConfig = {
     organization: string;
     defaultProject: string;
     timeoutMs?: number;
 };
+/** Azure platform (PaaS) profile, consumed by az-tool. */
+export type AzurePlatformConfig = {
+    subscription: string;
+    timeoutMs?: number;
+    /**
+     * Require --profile to be passed explicitly before this subscription is
+     * touched. Defaults to true for profiles keyed "prod" or "production".
+     */
+    production?: boolean;
+    /**
+     * Resource groups this profile may address. Empty or absent means every
+     * resource group in the subscription is allowed.
+     */
+    allowedResourceGroups?: string[];
+};
 export type CleanupPolicy = "leave-running" | "stop-if-started";
 export type VpnPrerequisite = {
     type: "vpn";
@@ -181,6 +196,8 @@ export type AgentToolsConfig = {
     $schema?: string;
     /** Named Azure DevOps profiles. e.g. { default: { organization: "...", defaultProject: "..." } } */
     azure?: Record<string, AzureConfig>;
+    /** Named Azure platform profiles. e.g. { default: { subscription: "..." } } */
+    azurePlatform?: Record<string, AzurePlatformConfig>;
     /** Named VPN definitions referenced by profile prerequisites. */
     vpns?: Record<string, VpnConfig>;
     /** Named Kubernetes cluster profiles. e.g. { default: {...}, staging: {...} } */

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,0BAA0B,CAAC;QACpC,KAAK,CAAC,EAAE,yBAAyB,CAAC;QAClC,KAAK,CAAC,EAAE,6BAA6B,CAAC;KACvC,CAAC;IACF,uGAAuG;IACvG,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG;IAC7C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,0DAAkD,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/F,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE;QACR,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9C,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,0BAA0B,CAAC;QACpC,KAAK,CAAC,EAAE,yBAAyB,CAAC;QAClC,KAAK,CAAC,EAAE,6BAA6B,CAAC;KACvC,CAAC;IACF,uGAAuG;IACvG,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG;IAC7C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,0DAAkD,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/F,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE;QACR,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9C,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC"}

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAkMF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAqMrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAjbD,SAAS,UAAU,UAAU,KAAK,IAibM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAnbC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAmbjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aArbE,MAAM,KAAK,OAqbgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAvbE,MAAM,KAAK,OAubgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAzbC,MAAM,KAAK,OAyb0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA3bC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA2bf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA7bC,MAAM,KAAK,OA6bsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/bC,MAAM,KAAK,MAAM,GAAG,IA+ba,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAuMF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAqMrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAtbD,SAAS,UAAU,UAAU,KAAK,IAsbM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAxbC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAwbjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA1bE,MAAM,KAAK,OA0bgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA5bE,MAAM,KAAK,OA4bgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA9bC,MAAM,KAAK,OA8b0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAhcC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAgcf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAlcC,MAAM,KAAK,OAkcsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YApcC,MAAM,KAAK,MAAM,GAAG,IAoca,CAAC"}

package/dist/shared/azure-credentials.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Azure CLI surfaces that return credential material.
+ *
+ * Shared because two tools reach the Azure CLI: az-tool for the platform, and
+ * azdo-tool for the `acr`/`account` groups it still passes through for
+ * backwards compatibility. Both must refuse the same commands — a term added
+ * to one list and not the other reopens a credential read through whichever
+ * tool was missed.
+ */
+/** Read-shaped verbs that return credential material, in any command group. */
+export declare const CREDENTIAL_BLOCKED_VERBS: readonly ["get-access-token", "get-credentials", "get-secrets", "list-account-keys", "list-connection-strings", "list-keys", "list-publishing-credentials", "list-publishing-profiles", "list-secrets", "show-connection-string", "show-secret"];
+/**
+ * Command group segments that carry credential material. For these the listing
+ * itself returns values — `az storage account keys list` and
+ * `az webapp config appsettings list` both print secrets.
+ */
+export declare const CREDENTIAL_BLOCKED_SEGMENTS: readonly ["admin-key", "appsettings", "connection-string", "credential", "credentials", "key", "keys", "password", "query-key", "sas", "secret", "secrets"];
+export declare const isCredentialBlockedVerb: (word: string) => boolean;
+export declare const isCredentialBlockedSegment: (word: string) => boolean;
+//# sourceMappingURL=azure-credentials.d.ts.map

package/dist/shared/azure-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-credentials.d.ts","sourceRoot":"","sources":["../../src/shared/azure-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,kPAY3B,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6JAa9B,CAAC;AAEX,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,OACS,CAAC;AAEjE,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,OACS,CAAC"}

package/dist/shared/binary-preflight.d.ts

@@ -1,6 +1,6 @@
 export declare const REQUIRED_BINARIES: {
     readonly az: {
-        readonly tools: "az-tool";
+        readonly tools: "az-tool and azdo-tool";
         readonly install: "Install it with `brew install azure-cli` (macOS) or see https://learn.microsoft.com/cli/azure/install-azure-cli.";
     };
     readonly gh: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.18.1",
-  "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
+  "version": "1.0.0",
+  "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
     "ai",
@@ -22,6 +22,7 @@
   "bin": {
     "agent-tools-audit": "./src/audit-tool/index.ts",
     "agent-tools-az": "./src/az-tool/index.ts",
+    "agent-tools-azdo": "./src/azdo-tool/index.ts",
     "agent-tools-db": "./src/db-tool/index.ts",
     "agent-tools-gh": "./src/gh-tool/index.ts",
     "agent-tools-k8s": "./src/k8s-tool/index.ts",
@@ -30,6 +31,7 @@
     "agent-tools-session": "./src/session-tool/index.ts",
     "audit-tool": "./src/audit-tool/index.ts",
     "az-tool": "./src/az-tool/index.ts",
+    "azdo-tool": "./src/azdo-tool/index.ts",
     "db-tool": "./src/db-tool/index.ts",
     "gh-tool": "./src/gh-tool/index.ts",
     "k8s-tool": "./src/k8s-tool/index.ts",
@@ -87,6 +89,10 @@
       "types": "./dist/az-tool/*.d.ts",
       "default": "./src/az-tool/*.ts"
     },
+    "#azdo/*": {
+      "types": "./dist/azdo-tool/*.d.ts",
+      "default": "./src/azdo-tool/*.ts"
+    },
     "#guard": {
       "types": "./dist/credential-guard/index.d.ts",
       "default": "./src/credential-guard/index.ts"

package/schemas/agent-tools.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://raw.githubusercontent.com/blogic-cz/agent-tools/main/schemas/agent-tools.schema.json",
   "title": "Agent Tools Configuration",
-  "description": "Root configuration for the agent-tools package. Tool-specific sections (azure, kubernetes, database, observability, logs) are maps of named profiles keyed by profile name. Tools choose a profile via --profile <name> (default key is 'default', single-entry maps can be auto-selected). session, audit, and credentialGuard are global sections.",
+  "description": "Root configuration for the agent-tools package. Tool-specific sections (azure, azurePlatform, kubernetes, database, observability, logs) are maps of named profiles keyed by profile name. Tools choose a profile via --profile <name> (default key is 'default', single-entry maps can be auto-selected). session, audit, and credentialGuard are global sections.",
   "type": "object",
   "additionalProperties": true,
   "properties": {
@@ -18,6 +18,14 @@
         "$ref": "#/definitions/AzureConfig"
       }
     },
+    "azurePlatform": {
+      "description": "Named Azure platform (PaaS) profiles as Record<string, AzurePlatformConfig>.",
+      "type": "object",
+      "additionalProperties": {
+        "description": "Azure platform profile pinning az-tool to one subscription.",
+        "$ref": "#/definitions/AzurePlatformConfig"
+      }
+    },
     "kubernetes": {
       "description": "Named Kubernetes cluster profiles as Record<string, K8sConfig>.",
       "type": "object",
@@ -141,6 +149,33 @@
       },
       "required": ["organization", "defaultProject"]
     },
+    "AzurePlatformConfig": {
+      "description": "Azure platform (PaaS) profile configuration. Pins every az-tool command to one subscription.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "subscription": {
+          "description": "Azure subscription ID or name appended to every command as --subscription.",
+          "type": "string"
+        },
+        "timeoutMs": {
+          "description": "Optional command timeout in milliseconds.",
+          "type": "number"
+        },
+        "production": {
+          "description": "Require --profile to be passed explicitly before this subscription is touched. Defaults to true for profiles keyed 'prod' or 'production'.",
+          "type": "boolean"
+        },
+        "allowedResourceGroups": {
+          "description": "Resource groups this profile may address via -g/--resource-group. Empty or absent allows every resource group in the subscription.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": ["subscription"]
+    },
     "K8sConfig": {
       "description": "Kubernetes cluster profile configuration.",
       "type": "object",
@@ -651,6 +686,12 @@
           "timeoutMs": 60000
         }
       },
+      "azurePlatform": {
+        "default": {
+          "subscription": "00000000-0000-0000-0000-000000000000",
+          "timeoutMs": 60000
+        }
+      },
       "kubernetes": {
         "default": {
           "clusterId": "398bf1ad-788c-40f5-a7e0-88366648d9d9",

package/src/az-tool/config.ts

@@ -1,33 +1,143 @@
-export const ALLOWED_SUBCOMMANDS = ["list", "run", "show", "show-tags"] as const;
+/** Command groups owned by azdo-tool. Routed there with a hint instead of being run here. */
+export const AZURE_DEVOPS_GROUPS = ["devops", "pipelines", "repos", "boards", "artifacts"] as const;
 
-export const BLOCKED_SUBCOMMANDS = ["create", "delete", "update", "cancel", "queue"] as const;
+/** Verbs that only read state, matched exactly against the command verb. */
+export const READ_ONLY_VERBS = [
+  "list",
+  "show",
+  "describe",
+  "exists",
+  "search",
+  "history",
+  "version",
+  "validate",
+  "wait",
+] as const;
+
+/** Verb families that only read state, matched as a prefix of the command verb. */
+export const READ_ONLY_VERB_PREFIXES = ["list-", "show-", "check-", "get-"] as const;
 
-export const DIRECT_AZ_COMMANDS = ["pipelines", "repos"] as const;
+/**
+ * Mutating verbs. Unknown verbs are rejected anyway; this list exists so the
+ * common cases get "'delete' is a mutating operation" instead of "unknown verb".
+ */
+export const BLOCKED_VERBS = [
+  "add",
+  "apply",
+  "approve",
+  "assign",
+  "attach",
+  "browse",
+  "cancel",
+  "clear",
+  "connect",
+  "create",
+  "delete",
+  "deploy",
+  "destroy",
+  "detach",
+  "disable",
+  "down",
+  "download",
+  "enable",
+  "execute",
+  "failover",
+  "generate",
+  "grant",
+  "import",
+  "init",
+  "install",
+  "invoke",
+  "login",
+  "logout",
+  "move",
+  "patch",
+  "publish",
+  "prune",
+  "purge",
+  "regenerate",
+  "reject",
+  "remove",
+  "renew",
+  "repair",
+  "replace",
+  "reset",
+  "restart",
+  "restore",
+  "revoke",
+  "rotate",
+  "run",
+  "scale",
+  "set",
+  "ssh",
+  "start",
+  "stop",
+  "swap",
+  "sync",
+  "tunnel",
+  "unassign",
+  "uninstall",
+  "untag",
+  "up",
+  "update",
+  "upgrade",
+  "upload",
+] as const;
 
-export const STANDALONE_AZ_COMMANDS = ["acr", "account"] as const;
+/**
+ * Credential-bearing verbs and group segments live in `#shared` because
+ * azdo-tool's `acr`/`account` passthrough must refuse exactly the same
+ * commands. Re-exported here so this file stays the single place az-tool's
+ * security config is read from.
+ *
+ * Segment matching keeps neighbouring groups reachable: `keyvault list` works
+ * because the blocked segment is `secret`, not `keyvault`. Key Vault gets a
+ * further carve-out below.
+ */
+export { CREDENTIAL_BLOCKED_SEGMENTS, CREDENTIAL_BLOCKED_VERBS } from "#shared/azure-credentials";
 
-export const ALLOWED_INVOKE_AREAS = ["build"] as const;
+/** The Key Vault command group, which needs finer treatment than segment matching. */
+export const KEYVAULT_GROUP = "keyvault";
 
-export const ALLOWED_INVOKE_RESOURCES: Record<string, readonly string[]> = {
-  build: ["timeline", "logs", "builds"],
-} as const;
+/**
+ * Key Vault subgroups that expose public material only — a key's public JWK, a
+ * certificate's public half. The private halves live under `secret`, which
+ * stays gated. Without this, segment matching on `key` would block the whole
+ * `az keyvault key` surface for no gain.
+ */
+export const KEYVAULT_PUBLIC_SUBGROUPS = ["key", "certificate"] as const;
 
-export const BLOCKED_INVOKE_AREAS = [
-  "git",
-  "policy",
-  "security",
-  "wiki",
-  "work",
-  "graph",
-  "audit",
-  "permissions",
-] as const;
+/**
+ * Key Vault subgroups where listing is metadata-only but `show` returns the
+ * value. `az keyvault secret list` yields ids, attributes, and tags — no
+ * secret material — so the list family is allowed and `show` is not.
+ */
+export const KEYVAULT_NAME_ONLY_SUBGROUPS = ["secret", "secrets"] as const;
+
+/**
+ * Flags controlled by the selected profile. A user override would defeat the
+ * configured subscription pin, so they are rejected rather than forwarded.
+ */
+export const CONTROLLED_FLAGS = ["--subscription"] as const;
+
+/**
+ * Alternate addressing modes rejected outright. `--ids` takes a full ARM
+ * resource ID that carries its own subscription and resource group, so it
+ * side-steps both the subscription pin and the resource group allowlist.
+ * `-g` plus `--name` expresses the same target inside the guarded scope.
+ */
+export const REJECTED_ADDRESSING_FLAGS = ["--ids"] as const;
+
+/** Flags naming the resource group a command addresses. */
+export const RESOURCE_GROUP_FLAGS = ["-g", "--resource-group"] as const;
 
-export const BLOCKED_INVOKE_RESOURCES: Record<string, readonly string[]> = {
-  build: ["definitions", "folders", "tags", "retention"],
-} as const;
+/**
+ * The resource group segment of an ARM resource ID. Flags such as `--scope`
+ * and `--resource` take a full ID, naming a resource group without ever using
+ * -g, so IDs are mined for group names too.
+ */
+export const RESOURCE_GROUP_IN_ID_PATTERN = /\/resourceGroups\/([^/\s]+)/gi;
 
-export type AllowedSubcommand = (typeof ALLOWED_SUBCOMMANDS)[number];
-export type BlockedSubcommand = (typeof BLOCKED_SUBCOMMANDS)[number];
-export type AllowedInvokeArea = (typeof ALLOWED_INVOKE_AREAS)[number];
-export type BlockedInvokeArea = (typeof BLOCKED_INVOKE_AREAS)[number];
+export type ReadOnlyVerb = (typeof READ_ONLY_VERBS)[number];
+export type BlockedVerb = (typeof BLOCKED_VERBS)[number];
+export type AzureDevOpsGroup = (typeof AZURE_DEVOPS_GROUPS)[number];

package/src/az-tool/errors.ts

@@ -27,6 +27,14 @@ export class AzTimeoutError extends Schema.TaggedError<AzTimeoutError>()("AzTime
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
+export class AzProfileError extends Schema.TaggedError<AzProfileError>()("AzProfileError", {
+  message: Schema.String,
+  profile: Schema.String,
+  hint: Schema.optionalKey(Schema.String),
+  nextCommand: Schema.optionalKey(Schema.String),
+  retryable: Schema.optionalKey(Schema.Boolean),
+}) {}
+
 export class AzParseError extends Schema.TaggedError<AzParseError>()("AzParseError", {
   message: Schema.String,
   rawOutput: Schema.String,
@@ -35,4 +43,9 @@ export class AzParseError extends Schema.TaggedError<AzParseError>()("AzParseErr
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export type AzError = AzSecurityError | AzCommandError | AzTimeoutError | AzParseError;
+export type AzError =
+  | AzSecurityError
+  | AzCommandError
+  | AzTimeoutError
+  | AzParseError
+  | AzProfileError;