@ebitex/content-mcp 0.5.198 → 0.5.206

package/dist/errors.d.ts

@@ -51,4 +51,9 @@ export declare function toContentApiError(response: Response): Promise<ContentAp
  * here would remove exactly the field the next call has to set.
  */
 export declare function describe(status: number, code: string | null, body: unknown, requestId?: string | null): string;
+/**
+ * The one sentence an agent can relay to its user. The key's scopes are not the problem here — the
+ * role the key runs as is — and the fix is in the key's settings, not in anything the agent can do.
+ */
+export declare function permissionHint(permission: string): string;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;gBAErB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW;CAQjH;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBpF;AAaD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,CAOpH"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;gBAErB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW;CAQjH;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBpF;AAaD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,CASpH;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKzD"}

package/dist/errors.js

@@ -85,12 +85,29 @@ function readRequestId(response, body) {
  */
 export function describe(status, code, body, requestId = null) {
     const statusLine = code ? `HTTP ${status} ${code}` : `HTTP ${status}`;
-    const heading = requestId ? `${statusLine}\nRequest id: ${requestId}` : statusLine;
+    const withId = requestId ? `${statusLine}\nRequest id: ${requestId}` : statusLine;
+    const missing = missingPermission(status, body);
+    const heading = missing ? `${withId}\n${permissionHint(missing)}` : withId;
     if (body === undefined || body === null || body === '')
         return heading;
     const rendered = typeof body === 'string' ? body : safeStringify(body);
     return `${heading}\n${rendered}`;
 }
+/** The permission a `403 permission_denied` names, or null for any other response. */
+function missingPermission(status, body) {
+    if (status !== 403 || !body || typeof body !== 'object')
+        return null;
+    const { error, permission } = body;
+    return error === 'permission_denied' && typeof permission === 'string' && permission ? permission : null;
+}
+/**
+ * The one sentence an agent can relay to its user. The key's scopes are not the problem here — the
+ * role the key runs as is — and the fix is in the key's settings, not in anything the agent can do.
+ */
+export function permissionHint(permission) {
+    return (`Missing permission: ${permission}. The role this key runs as does not hold it, so the key's ` +
+        `scopes are not the problem. Ask the user to run the key as a role that has ${permission}.`);
+}
 function safeStringify(value) {
     try {
         return JSON.stringify(value, null, 2);

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAQ;IACvB,oGAAoG;IAC3F,IAAI,CAAe;IAC5B,8FAA8F;IACrF,IAAI,CAAS;IACtB;;;OAGG;IACM,SAAS,CAAe;IAEjC,YAAY,MAAc,EAAE,IAAmB,EAAE,IAAa,EAAE,OAAe,EAAE,YAA2B,IAAI;QAC9G,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAElD,IAAI,IAAI,GAAY,IAAI,CAAA;IACxB,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChG,IAAI,GAAI,IAA0B,CAAC,KAAK,CAAA;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;AACtH,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAgC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxG,OAAQ,IAA8B,CAAC,SAAS,IAAI,IAAI,CAAA;IAC1D,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAmB,EAAE,IAAa,EAAE,YAA2B,IAAI;IAC1G,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAA;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,iBAAiB,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;IAClF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,OAAO,CAAA;IAEtE,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACtE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,0FAA0F;QAC1F,eAAe;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,wEAAwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAQ;IACvB,oGAAoG;IAC3F,IAAI,CAAe;IAC5B,8FAA8F;IACrF,IAAI,CAAS;IACtB;;;OAGG;IACM,SAAS,CAAe;IAEjC,YAAY,MAAc,EAAE,IAAmB,EAAE,IAAa,EAAE,OAAe,EAAE,YAA2B,IAAI;QAC9G,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAElD,IAAI,IAAI,GAAY,IAAI,CAAA;IACxB,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChG,IAAI,GAAI,IAA0B,CAAC,KAAK,CAAA;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC/C,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;AACtH,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAgC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxG,OAAQ,IAA8B,CAAC,SAAS,IAAI,IAAI,CAAA;IAC1D,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAmB,EAAE,IAAa,EAAE,YAA2B,IAAI;IAC1G,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAA;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,iBAAiB,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,CAAA;IACjF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IAC1E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,OAAO,CAAA;IAEtE,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACtE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAA;AAClC,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAa;IACtD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAiD,CAAA;IAC/E,OAAO,KAAK,KAAK,mBAAmB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,CACL,uBAAuB,UAAU,6DAA6D;QAC9F,8EAA8E,UAAU,GAAG,CAC5F,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,0FAA0F;QAC1F,eAAe;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}

package/dist/resources/helpCorpus.generated.js

@@ -6,7 +6,7 @@ export const HELP_TOPICS = [
     {
         "slug": "agent-authoring",
         "title": "Building a content model through the API",
-        "body": "# Building a content model through the API\n\nThe rest of this help corpus describes Content as you drive it in Composer — tabs, panels, buttons.\nThe concepts all transfer; the steps do not. This page is the same model described in terms of the\nAPI, for a script or an agent working through the Content Management API rather than the interface.\n\nRead this first if you are about to create anything. Everything here is about *what the pieces are*;\nthe exact shape of each request is answered live by the API itself, and you should never guess it.\n\n## The one rule that saves the most time\n\n**Ask the server what things look like; do not assume.**\n\n`GET /field-types` returns every field type this platform has, each with its **own JSON Schema for\nits settings**. That schema is generated from the field type's own definition, so it is never out of\ndate — Composer's Contract builder renders its settings form from exactly this, rather than\nhard-coding a form per type. Use it the same way.\n\n`GET /contracts` and `GET /templates` tell you what this environment already has. Check before\ncreating: a duplicate is much harder to undo than it is to avoid.\n\nWhen a write is refused, the refusal names the failing field and says what is wrong with it. That\nmessage is the fastest route to a correct request. Read it and correct the one thing it names,\nrather than rewriting the payload.\n\n## The pieces, and what each one is for\n\nContent separates four concerns that many systems collapse into one. The separation is the reason\nthe same content can be rendered several ways, and reused in places its author never anticipated.\n\n### Contract — what content *is*\n\nA Contract is a type. It has a name, an external id, and a list of **fields**. Each field names a\nfield type (short text, rich text, number, date, blob, reference, component, presentation, category,\nlink, and so on) and carries that type's own settings.\n\nContracts support **inheritance**. A Contract may name a parent, and it then has the parent's fields\nplus its own. A Contract may be **abstract**, meaning nothing is ever an instance of it directly —\nit exists to be inherited from, and to be named where several concrete types should be accepted.\n\nContracts describe content and nothing about how it looks. No colours, no layout, no \"variant\".\n\n### Component — an instance of a Contract\n\nA Component is a piece of content: a Contract, plus a **document** holding a value for each field.\nIt has its own name and external id and lives in a folder.\n\nThe document's shape follows the Contract's fields exactly. What a field's value looks like depends\non its type *and* on its modifiers, below.\n\n### Template — how content is *rendered*\n\nA Template names which Contracts it can render, and has its own **settings Contract**: an ordinary\nContract describing the presentational choices that template offers — a variant, an alignment, how\nmany columns.\n\nThis is why Contracts stay free of presentation. \"A statement, centred, with a ghost button\" is one\nTemplate's settings over a plain statement Contract, not three fields on the Contract itself.\n\n### Presentation — a Template bound to content\n\nA **presentation value** is where the two meet: it names a Template, binds a Component (or holds an\ninline document), and carries settings and contextual values for this one use.\n\nA page is usually a Component whose fields hold presentation values — a hero, then some sections —\nand each of those points at content that may be used elsewhere, rendered differently.\n\n### Adapter — a reusable mapping between Contracts\n\nSometimes a Template needs a `card` and what you have is a `blog-page`. An Adapter is a named,\nreusable mapping from one Contract to another: one rule per output field, plus a small set of logic\nnodes for lists, conditions and type dispatch.\n\nAn Adapter is applied by the server — at preview, at publish, and at delivery — so the mapping is\ndefined once and behaves identically everywhere.\n\n### Experience — where content lives on the web\n\nThe Experience tree is the site's address space. A **site** is a root; **nodes** under it are pages,\neach with a slug. A node's path is its ancestors' slugs plus its own.\n\nA node's **payload** says what it renders — usually a presentation value, sometimes a redirect,\nsometimes nothing at all (a node with no payload is pure structure, giving its children a path\nsegment without being a page itself).\n\nCreating a node and setting its payload are **two separate calls**. That is not an oversight: a\nnode's identity and location change for different reasons than its content does.\n\n## The five modifiers\n\nAny field can carry any combination of these. They compose, and each one changes the shape of the\nvalue stored in the document — which is the part worth understanding before writing one.\n\n| Modifier | What it means | Effect on the value |\n|---|---|---|\n| Mandatory | A value is required | Validation refuses an empty one |\n| Enumerable | Many rather than one | The value becomes a list |\n| Localizable | Translatable per locale | The value becomes `{ default, translations }` |\n| Personalizable | Varies by audience | The value becomes `{ default, variants }` |\n| Contextual | Overridable per use | The value may be supplied where the Component is *used*, not only where it is defined |\n\nCardinality is Enumerable's job, never the field type's. There is no \"list of text\" field type;\nthere is a text field that is enumerable.\n\n**Contextual** is the one worth dwelling on, because it has no counterpart in most systems. A\ncontextual field's value can be set on the Component (a default) *and* overridden by whoever binds\nthat Component somewhere — a heading that reads one way on the home page and another on a listing,\nfrom one Component with one document. Those overrides are the `contextualValues` that travel with a\nreference or a presentation value.\n\n## An order of operations that works\n\nDependencies run one way, so build in this order and nothing is ever waiting on something that does\nnot exist yet.\n\n1. **Describe.** `GET /field-types`, `/contracts`, `/templates`. Learn what exists before adding to\n   it.\n2. **Contracts.** Parents before children, since a child names its parent.\n3. **Templates.** After the Contracts they render, since a Template names them.\n4. **Components.** After their Contract, and after any Contract they reference.\n5. **A site**, if the environment has none. Then **nodes** under it, parents before children.\n6. **Node payloads.** After both the node and the Component it binds.\n7. **Publish.** Plan first, read the blockers, then publish.\n\nTwo ordering facts that are easy to get wrong: a Component referencing another Component needs that\none to exist first, and publishing follows the dependency closure automatically — so publishing a\npage will normally publish the content it binds, and the plan is where you see exactly what that\nmeans before it happens.\n\n## Publishing\n\nPublishing is two calls, and collapsing them would hide the thing that matters.\n\n**Plan** resolves the full dependency closure of what you asked to publish and reports every\n**blocker** — an unresolvable reference, a workflow state that forbids publishing, a document that\nfails validation. **Execute** publishes what the plan named.\n\nBoth are jobs: each returns an operation id, and you poll it. A real closure is too large to finish\ninside an HTTP request, which is why.\n\nRead the plan. It is the only place the system tells you what is about to change beyond what you\nexplicitly named.\n\n## Where writes land\n\nA management key is bound to exactly one organization and one **authoring environment**, and it acts\nas one **role**. It cannot reach another environment, and it is subject to the same branch access\nrules and workflow gating a person with that role is.\n\nThat binding is the real safety boundary, so it is worth confirming rather than assuming: ask the\nAPI who the key is before writing anything. If the answer is not the environment you expected, stop\n— nothing else about the request will tell you.\n\nThen ask where the environment sits (`GET /topology`, or the `content_topology` tool). It names this\nenvironment's direct neighbours, and each one tells you something about your own work:\n\n- **Publishes to.** Where a publish from here lands. If one of these is a live website, a publish\n  changes that website. With two or more, a publish has to say which one.\n- **Inherits from.** Content synced from this parent is read-only here. A refusal saying content is\n  inherited means the change has to be made in the parent instead.\n- **Inherited by.** These environments receive this one's library the next time they sync, so a\n  change here spreads there.\n- **Promoted from.** Someone promoting from one of these can overwrite what you write here.\n- **Promotes to.** Where this content goes when someone promotes it. You cannot promote yourself.\n\nNothing in the answer says which environment is production. Judge that from the names, and ask the\nperson you are working for when it is not obvious.\n\n## What an empty answer means\n\nThe binding governs **reads** exactly as it governs writes, and that changes how an empty result\nshould be read. `GET /contracts` returning nothing means *this environment has no Contracts*. It does\nnot mean the organization has none, and it certainly does not mean the account has no content.\n\nThe difference matters because acting on the wrong reading is expensive in one direction: concluding\n\"nothing exists\" and creating a model that already exists elsewhere produces duplicates, which are\nmuch harder to undo than to avoid. The safe habit is to confirm the scope before concluding anything\nfrom an empty list — `GET /whoami`, or the `content_whoami` tool, which needs no permissions at all\nprecisely so that a key holding almost nothing can still ask.\n\nA `404` on a single-entity read is the same fact in another shape: not found *here*. The entity may\nexist in another environment, and this key cannot see it.\n\n## Things that commonly go wrong\n\n- **Guessing a field type's settings** instead of reading its schema. Every field type declares its\n  own; there is nothing to guess.\n- **Creating a duplicate** because an external id was not checked first. External ids are how a\n  model refers to itself across environments; a duplicate is a lasting problem.\n- **Putting presentation on a Contract.** If you are adding a field called `variant`, `align`,\n  `theme` or `columns` to a Contract, it almost certainly belongs in a Template's settings.\n- **Forgetting a node's payload.** A node created and never given one is a real, published,\n  completely blank page.\n- **Treating a publish plan as a formality.** It is where blockers appear, and they do not appear\n  anywhere else until something is already wrong.\n\n## Related\n\n- [Contracts](contracts.md) — the type system in depth\n- [Templates](templates.md) — presentation\n- [Components](components.md) — authoring content\n- [Content Adapters](content-adapters.md) — mappings\n- [Composer](content-composer.md) — the Experience tree\n- [Publishing](publishing.md) — the publish pipeline\n- [Management keys](management-keys.md) — minting and scoping a key\n"
+        "body": "# Building a content model through the API\n\nThe rest of this help corpus describes Content as you drive it in Composer — tabs, panels, buttons.\nThe concepts all transfer; the steps do not. This page is the same model described in terms of the\nAPI, for a script or an agent working through the Content Management API rather than the interface.\n\nRead this first if you are about to create anything. Everything here is about *what the pieces are*;\nthe exact shape of each request is answered live by the API itself, and you should never guess it.\n\n## The one rule that saves the most time\n\n**Ask the server what things look like; do not assume.**\n\n`GET /field-types` returns every field type this platform has, each with its **own JSON Schema for\nits settings**. That schema is generated from the field type's own definition, so it is never out of\ndate — Composer's Contract builder renders its settings form from exactly this, rather than\nhard-coding a form per type. Use it the same way.\n\n`GET /contracts` and `GET /templates` tell you what this environment already has. Check before\ncreating: a duplicate is much harder to undo than it is to avoid.\n\nWhen a write is refused, the refusal names the failing field and says what is wrong with it. That\nmessage is the fastest route to a correct request. Read it and correct the one thing it names,\nrather than rewriting the payload.\n\n## The pieces, and what each one is for\n\nContent separates four concerns that many systems collapse into one. The separation is the reason\nthe same content can be rendered several ways, and reused in places its author never anticipated.\n\n### Contract — what content *is*\n\nA Contract is a type. It has a name, an external id, and a list of **fields**. Each field names a\nfield type (short text, rich text, number, date, blob, reference, component, presentation, category,\nlink, and so on) and carries that type's own settings.\n\nContracts support **inheritance**. A Contract may name a parent, and it then has the parent's fields\nplus its own. A Contract may be **abstract**, meaning nothing is ever an instance of it directly —\nit exists to be inherited from, and to be named where several concrete types should be accepted.\n\nContracts describe content and nothing about how it looks. No colours, no layout, no \"variant\".\n\n### Component — an instance of a Contract\n\nA Component is a piece of content: a Contract, plus a **document** holding a value for each field.\nIt has its own name and external id and lives in a folder.\n\nThe document's shape follows the Contract's fields exactly. What a field's value looks like depends\non its type *and* on its modifiers, below.\n\n### Template — how content is *rendered*\n\nA Template names which Contracts it can render, and has its own **settings Contract**: an ordinary\nContract describing the presentational choices that template offers — a variant, an alignment, how\nmany columns.\n\nThis is why Contracts stay free of presentation. \"A statement, centred, with a ghost button\" is one\nTemplate's settings over a plain statement Contract, not three fields on the Contract itself.\n\n### Presentation — a Template bound to content\n\nA **presentation value** is where the two meet: it names a Template, binds a Component (or holds an\ninline document), and carries settings and contextual values for this one use.\n\nA page is usually a Component whose fields hold presentation values — a hero, then some sections —\nand each of those points at content that may be used elsewhere, rendered differently.\n\n### Adapter — a reusable mapping between Contracts\n\nSometimes a Template needs a `card` and what you have is a `blog-page`. An Adapter is a named,\nreusable mapping from one Contract to another: one rule per output field, plus a small set of logic\nnodes for lists, conditions and type dispatch.\n\nAn Adapter is applied by the server — at preview, at publish, and at delivery — so the mapping is\ndefined once and behaves identically everywhere.\n\n### Experience — where content lives on the web\n\nThe Experience tree is the site's address space. A **site** is a root; **nodes** under it are pages,\neach with a slug. A node's path is its ancestors' slugs plus its own.\n\nA node's **payload** says what it renders — usually a presentation value, sometimes a redirect,\nsometimes nothing at all (a node with no payload is pure structure, giving its children a path\nsegment without being a page itself).\n\nCreating a node and setting its payload are **two separate calls**. That is not an oversight: a\nnode's identity and location change for different reasons than its content does.\n\n## The five modifiers\n\nAny field can carry any combination of these. They compose, and each one changes the shape of the\nvalue stored in the document — which is the part worth understanding before writing one.\n\n| Modifier | What it means | Effect on the value |\n|---|---|---|\n| Mandatory | A value is required | Validation refuses an empty one |\n| Enumerable | Many rather than one | The value becomes a list |\n| Localizable | Translatable per locale | The value becomes `{ default, translations }` |\n| Personalizable | Varies by audience | The value becomes `{ default, variants }` |\n| Contextual | Overridable per use | The value may be supplied where the Component is *used*, not only where it is defined |\n\nCardinality is Enumerable's job, never the field type's. There is no \"list of text\" field type;\nthere is a text field that is enumerable.\n\n**Contextual** is the one worth dwelling on, because it has no counterpart in most systems. A\ncontextual field's value can be set on the Component (a default) *and* overridden by whoever binds\nthat Component somewhere — a heading that reads one way on the home page and another on a listing,\nfrom one Component with one document. Those overrides are the `contextualValues` that travel with a\nreference or a presentation value.\n\n## An order of operations that works\n\nDependencies run one way, so build in this order and nothing is ever waiting on something that does\nnot exist yet.\n\n1. **Describe.** `GET /field-types`, `/contracts`, `/templates`. Learn what exists before adding to\n   it.\n2. **Contracts.** Parents before children, since a child names its parent.\n3. **Templates.** After the Contracts they render, since a Template names them.\n4. **Components.** After their Contract, and after any Contract they reference.\n5. **A site**, if the environment has none. Then **nodes** under it, parents before children.\n6. **Node payloads.** After both the node and the Component it binds.\n7. **Publish.** Plan first, read the blockers, then publish.\n\nTwo ordering facts that are easy to get wrong: a Component referencing another Component needs that\none to exist first, and publishing follows the dependency closure automatically — so publishing a\npage will normally publish the content it binds, and the plan is where you see exactly what that\nmeans before it happens.\n\n## Publishing\n\nPublishing is two calls, and collapsing them would hide the thing that matters.\n\n**Plan** resolves the full dependency closure of what you asked to publish and reports every\n**blocker** — an unresolvable reference, a workflow state that forbids publishing, a document that\nfails validation. **Execute** publishes what the plan named.\n\nBoth are jobs: each returns an operation id, and you poll it. A real closure is too large to finish\ninside an HTTP request, which is why.\n\nRead the plan. It is the only place the system tells you what is about to change beyond what you\nexplicitly named.\n\n## Where writes land\n\nA management key is bound to exactly one organization and one **authoring environment**, and it acts\nas one **role**. It cannot reach another environment, and it is subject to the same branch access\nrules and workflow gating a person with that role is.\n\nThat binding is the real safety boundary, so it is worth confirming rather than assuming: ask the\nAPI who the key is before writing anything. If the answer is not the environment you expected, stop\n— nothing else about the request will tell you.\n\nThen ask where the environment sits (`GET /topology`, or the `content_topology` tool). It names this\nenvironment's direct neighbours, and each one tells you something about your own work:\n\n- **Publishes to.** Where a publish from here lands. If one of these is a live website, a publish\n  changes that website. With two or more, a publish has to say which one.\n- **Inherits from.** Content synced from this parent is read-only here. A refusal saying content is\n  inherited means the change has to be made in the parent instead.\n- **Inherited by.** These environments receive this one's library the next time they sync, so a\n  change here spreads there.\n- **Promoted from.** Someone promoting from one of these can overwrite what you write here.\n- **Promotes to.** Where this content goes when someone promotes it. You cannot promote yourself.\n\nNothing in the answer says which environment is production. Judge that from the names, and ask the\nperson you are working for when it is not obvious.\n\n## What an empty answer means\n\nThe binding governs **reads** exactly as it governs writes, and that changes how an empty result\nshould be read. `GET /contracts` returning nothing means *this environment has no Contracts*. It does\nnot mean the organization has none, and it certainly does not mean the account has no content.\n\nThe difference matters because acting on the wrong reading is expensive in one direction: concluding\n\"nothing exists\" and creating a model that already exists elsewhere produces duplicates, which are\nmuch harder to undo than to avoid. The safe habit is to confirm the scope before concluding anything\nfrom an empty list — `GET /whoami`, or the `content_whoami` tool, which needs no permissions at all\nprecisely so that a key holding almost nothing can still ask.\n\nA `404` on a single-entity read is the same fact in another shape: not found *here*. The entity may\nexist in another environment, and this key cannot see it.\n\n## When a write is refused for a permission\n\nA key has two limits, and they are different. Its **scopes** say which kinds of call it may make at\nall (`read`, `authoring`, `publish`). The **role it runs as** says what that role may do, and a few\nkinds need a permission on top of the `authoring` scope:\n\n| To write or delete | The role needs |\n|---|---|\n| a Contract | `content.contracts.manage` |\n| a Template | `content.templates.manage` |\n\nThe Member role does not hold either. The `ContentSchemaAdmin` role holds both, as does Owner, but\nOwner grants far more than an agent needs; prefer `ContentSchemaAdmin` or a custom role with just\nthese. Any role in the organization can be chosen as a key's \"run as\" role.\n\nA refusal for this reason is `403 permission_denied`, and it names the permission. The MCP server\nsays so plainly and, when it already knows the role lacks the permission, declines the call without\nsending it. `content_whoami` lists the kinds withheld for this role, each with the permission it\nneeds. When you see this, tell the person which permission is missing; changing the role is theirs\nto do, in the key's settings, and not something to work around.\n\n## Things that commonly go wrong\n\n- **Guessing a field type's settings** instead of reading its schema. Every field type declares its\n  own; there is nothing to guess.\n- **Creating a duplicate** because an external id was not checked first. External ids are how a\n  model refers to itself across environments; a duplicate is a lasting problem.\n- **Putting presentation on a Contract.** If you are adding a field called `variant`, `align`,\n  `theme` or `columns` to a Contract, it almost certainly belongs in a Template's settings.\n- **Forgetting a node's payload.** A node created and never given one is a real, published,\n  completely blank page.\n- **Treating a publish plan as a formality.** It is where blockers appear, and they do not appear\n  anywhere else until something is already wrong.\n\n## Related\n\n- [Contracts](contracts.md) — the type system in depth\n- [Templates](templates.md) — presentation\n- [Components](components.md) — authoring content\n- [Content Adapters](content-adapters.md) — mappings\n- [Composer](content-composer.md) — the Experience tree\n- [Publishing](publishing.md) — the publish pipeline\n- [Management keys](management-keys.md) — minting and scoping a key\n"
     },
     {
         "slug": "blog-series",
@@ -26,7 +26,7 @@ export const HELP_TOPICS = [
     {
         "slug": "content-authoring",
         "title": "Authoring a presentation",
-        "body": "# Authoring a presentation\n\nA Contract field with the **Presentation** field type lets a Component\ninstantiate a Template inline — the common pattern for a page's body is an\n*enumerable* Presentation field, so the page becomes a list of presented\nsections. See [Presenting content with Templates](templates.md) for what a\nTemplate and a Presentation are; this page walks through the wizard you use\nto create or change one.\n\n## Adding a presentation\n\nWhen you reach an empty Presentation field while editing a Component (or an\nExperience node's payload, or a presentation embed in a Rich Text field),\nselect **+ Add presentation** to open the wizard.\n\n### Step 1 — Choose Template\n\nA searchable, sortable list of the Templates this field allows. Type to\nfilter by name or Id, or filter to Templates that support a specific\nContract. Select a row to move on to step 2.\n\nIf nothing is eligible yet, a link takes you to the Templates page to create\none.\n\n### Step 2 — Bind Component\n\nTwo tabs:\n\n- **Select existing** — a three-column view: the Component you're\n  considering on the left, a compatibility summary in the middle, and what\n  the Template needs on the right.\n- **Create new** — the same on-the-spot creation flow as before: pick a\n  Contract the Template accepts and fill in the required fields, without\n  leaving the page.\n\nOn **Select existing**, the left column lists every Component, grouped:\n\n- **Compatible** — a Component whose Contract is exactly what the Template\n  needs, or a more specific kind of it (a subtype). Selecting one shows\n  every field lining up on the right, marks Complete as ready, and you're\n  done.\n- **Needs an Adapter** — everything else, collapsed by default with a count\n  so the list stays short. A Component here has a Contract the Template\n  doesn't recognize at all. Selecting one shows *why* it doesn't fit, and\n  three buttons let you bridge the gap: **Use existing Adapter**, **Create\n  Adapter**, or **Connect manually** — see [Bridging Contracts with\n  Adapters](content-adapters.md) for what each does and how the field\n  mapping works. Until you attach one, Complete stays disabled — there's no\n  way to force a mismatched binding through unmapped.\n\nA Template that doesn't restrict which Contracts it accepts treats every\nComponent as compatible. A Template that accepts more than one Contract\nshows a small switcher on the right so you can see the fields for each one\nit supports.\n\nSelect **Complete** once you're happy with the binding. Nothing is saved to\nthe field until you do — closing the wizard at any point beforehand leaves\nthings exactly as they were.\n\n## Changing or removing a presentation\n\nOnce bound, the field shows a card with the Component's name and:\n\n- **Change** re-opens the wizard directly on step 2, so you can pick a\n  different Component (or select **Back** to choose a different Template\n  entirely — doing so resets any per-usage Contextual values and settings,\n  the same as a first-time pick).\n- **Contextual values** opens a panel for the bound Component's own\n  Contextual fields — present only when the bound Contract actually has\n  any. If a mandatory Contextual field still needs a value, a **Contextual\n  values needed** chip appears next to the button as a heads-up before you\n  try to save; selecting it opens the same panel.\n- **Settings** opens the Template's own settings form for this specific\n  placement.\n- **Quick edit** opens the bound Component itself, right here — see\n  [Editing something from where it's used](#editing-something-from-where-its-used)\n  below.\n- **Remove** clears the Presentation value entirely.\n\nIf the Template has been updated to a newer version since this Presentation\nwas created, a small notice appears — **Update to v_N_** moves it onto the\nnew version. Until you do, the existing Presentation keeps working exactly\nas before.\n\n## Editing something from where it's used\n\nAnything you open *from inside* an editor — a Component bound to a\nPresentation, a Component linked through a Reference field, the page a\nLink points at, a Nested value, a set of Contextual values — opens as a\n**layer** over the page you're on, instead of taking you somewhere else.\nLayers stack: open a Component from a page, then a Link target from inside\nthat Component, and you're three deep, with each layer you came through\ncollapsed to a title strip above the one you're in. Select any strip, or\nany name in the trail at the top of a layer, to go back to it.\n\nEvery layer says what it is and whose save it belongs to:\n\n- **Own save** (the pink chip) — this layer is a *separate thing*: a shared\n  Component, or a page in the Experience tree. It has its own **Save**\n  button, and saving changes it *everywhere it's used* — the panel on the\n  right lists every place, and the sentence at the bottom names exactly\n  what does and doesn't change. **Cancel** throws the layer's edits away and\n  leaves the page you came from untouched. Use **Open full editor** when you\n  need more than a quick change (publishing, workflow, moving folders).\n- **Part of …** (the blue chip) — this layer is a *view into the page you're\n  on*: a Nested value, Contextual values, Presentation settings. There's no\n  Save here — select **Done** and the edit rides along with the page's own\n  Save, exactly as if you'd made it in the page directly.\n\nClosing a layer that has unsaved changes asks first, inside the layer\nitself — **Keep editing** is selected by default, so a stray Enter never\ndiscards work. **Esc** closes one layer at a time. Quick edit is only offered\nfor content that lives in this organization; an item from a connected\nexternal provider has no editor here.\n"
+        "body": "# Authoring a presentation\n\nA Contract field with the **Presentation** field type lets a Component\ninstantiate a Template inline — the common pattern for a page's body is an\n*enumerable* Presentation field, so the page becomes a list of presented\nsections. See [Presenting content with Templates](templates.md) for what a\nTemplate and a Presentation are; this page walks through the wizard you use\nto create or change one.\n\n## Adding a presentation\n\nWhen you reach an empty Presentation field while editing a Component (or an\nExperience node's payload, or a presentation embed in a Rich Text field),\nselect **+ Add presentation** to open the wizard.\n\n### Step 1 — Choose Template\n\nA searchable, sortable list of the Templates this field allows. Type to\nfilter by name or Id, or filter to Templates that support a specific\nContract. Select a row to move on to step 2.\n\nIf nothing is eligible yet, a link takes you to the Templates page to create\none.\n\n### Step 2 — Bind Component\n\nTwo tabs:\n\n- **Select existing** — a three-column view: the Component you're\n  considering on the left, a compatibility summary in the middle, and what\n  the Template needs on the right.\n- **Create new** — the same on-the-spot creation flow as before: pick a\n  Contract the Template accepts and fill in the required fields, without\n  leaving the page.\n\nOn **Select existing**, the left column lists every Component, grouped:\n\n- **Compatible** — a Component whose Contract is exactly what the Template\n  needs, or a more specific kind of it (a subtype). Selecting one shows\n  every field lining up on the right, marks Complete as ready, and you're\n  done.\n- **Needs an Adapter** — everything else, collapsed by default with a count\n  so the list stays short. A Component here has a Contract the Template\n  doesn't recognize at all. Selecting one shows *why* it doesn't fit, and\n  three buttons let you bridge the gap: **Use existing Adapter**, **Create\n  Adapter**, or **Connect manually** — see [Bridging Contracts with\n  Adapters](content-adapters.md) for what each does and how the field\n  mapping works. Until you attach one, Complete stays disabled — there's no\n  way to force a mismatched binding through unmapped.\n\nA Template that doesn't restrict which Contracts it accepts treats every\nComponent as compatible. A Template that accepts more than one Contract\nshows a small switcher on the right so you can see the fields for each one\nit supports.\n\nSelect **Complete** once you're happy with the binding. Nothing is saved to\nthe field until you do — closing the wizard at any point beforehand leaves\nthings exactly as they were.\n\n## Changing or removing a presentation\n\nOnce bound, the field shows a card with the Component's name and:\n\n- **Change** re-opens the wizard directly on step 2, so you can pick a\n  different Component (or select **Back** to choose a different Template\n  entirely — doing so resets any per-usage Contextual values and settings,\n  the same as a first-time pick).\n- **Contextual values** opens a panel for the bound Component's own\n  Contextual fields — present only when the bound Contract actually has\n  any. If a mandatory Contextual field still needs a value, a **Contextual\n  values needed** chip appears next to the button as a heads-up before you\n  try to save; selecting it opens the same panel.\n- **Settings** opens the Template's own settings form for this specific\n  placement.\n- **Quick edit** opens the bound Component itself, right here — see\n  [Editing something from where it's used](#editing-something-from-where-its-used)\n  below.\n- **Remove** clears the Presentation value entirely.\n\nIf the Template has been updated to a newer version since this Presentation\nwas created, a small notice appears — **Update to v_N_** moves it onto the\nnew version. Until you do, the existing Presentation keeps working exactly\nas before.\n\n## Editing something from where it's used\n\nAnything you open *from inside* an editor — a Component bound to a\nPresentation, a Component linked through a Reference field, the page a\nLink points at, a Nested value, a set of Contextual values — opens as a\n**layer** over the page you're on, instead of taking you somewhere else.\nLayers stack: open a Component from a page, then a Link target from inside\nthat Component, and you're three deep, with each layer you came through\ncollapsed to a title strip above the one you're in. Select any strip, or\nany name in the trail at the top of a layer, to go back to it.\n\nEvery layer says what it is and whose save it belongs to:\n\n- **Own save** (the pink chip) — this layer is a *separate thing*: a shared\n  Component, or a page in the Experience tree. It has its own **Save**\n  button, and saving changes it *everywhere it's used* — the panel on the\n  right lists every place, and the sentence at the bottom names exactly\n  what does and doesn't change. **Cancel** throws the layer's edits away and\n  leaves the page you came from untouched. Use **Open full editor** when you\n  need more than a quick change (publishing, workflow, moving folders).\n- **Part of …** (the blue chip) — this layer is a *view into the page you're\n  on*: a Nested value, Contextual values, Presentation settings. There's no\n  Save here — select **Done** and the edit rides along with the page's own\n  Save, exactly as if you'd made it in the page directly.\n\nClosing a layer that has unsaved changes asks first, inside the layer\nitself — **Keep editing** is selected by default, so a stray Enter never\ndiscards work. **Esc** closes one layer at a time. Quick edit is only offered\nfor content that lives in this organization; an item from a connected\nexternal provider has no editor here.\n\n## Working with lists of values\n\nA field that holds several values (the sections of a page, a set of tags) is a list. In Content and in Data every list works the same way:\n\n- **Add** puts a new item at the end. To put one *between* two items, point at the thin gap between them and select the **+** that appears\n  (it also appears when you tab to it). For a list of Presentations or references, the chooser opens first.\n- **Reorder** by dragging an item by its handle (the dotted grip on the left) to a gap. To reorder without dragging, focus the handle and\n  press the up or down arrow, or open the **⋯** menu on the item and choose **Move up** or **Move down**.\n- **Remove** takes the item out of the list with the **✕** on its row. A Presentation card in a list has no Remove of its own.\n\nAnything you have typed is kept with its item when it moves, and a drill-in panel you have open stays on the same item.\n"
     },
     {
         "slug": "content-composer",
@@ -71,7 +71,7 @@ export const HELP_TOPICS = [
     {
         "slug": "contracts",
         "title": "Modeling content with Contracts",
-        "body": "# Modeling content with Contracts\n\nContracts define the field structure your content adheres to — think of a\nContract as a blueprint (for example \"Article\" or \"Author\") that every\nComponent built from it must follow. You need to belong to an organization to\nuse it — see [Creating an organization and inviting\nteammates](../hub/organizations.md) if you haven't set one up yet.\n\n## The Contracts list\n\n**Modeling > Contracts** lists every Contract with its name, its id (smaller, underneath), whether it is\nconcrete or abstract, which Contract it extends, how many fields it has, what it is used as, and when it\nlast changed.\n\n**What a Contract is used for is worked out from how it is used, never set by hand.** The row of buttons above\nthe list filters by it, with a count on each, and a Contract can sit in several at once:\n\n- **Components** — Components have been created from it.\n- **Experiences** — a Component of this Contract is the content of a page in your Experience tree.\n- **Templates** — it is a Template's own settings Contract. (A Contract a Template merely *supports* is an\n  ordinary content Contract, so it shows under Components, not here.)\n- **Base** — it is abstract, or other Contracts extend it.\n- **Not used yet** — nothing references it. This is the clean-up list.\n\nThe **Used as** column spells it out, for example *Components 17 · Experiences 4*. Search matches a name or an\nid, and **Kind** and **Source** narrow further (a Contract can come from a provider, or be inherited from\nanother environment; both are read-only here and say so).\n\nEach row's **⋯** menu offers **Open** (or **View**, for one you can't edit), **Where used** and **Delete…**.\nDelete is switched off while anything uses the Contract, and says how many places do. Tick several rows to\ndelete them together; it tells you how many of the selection it can actually delete.\n\n## Creating a Contract\n\n1. From the Contracts list, select **New Contract**.\n2. Switch to the **General** tab. Enter a **Name** — everything else below\n   fills in from it, so filling it in first saves retyping. **Id** — a\n   short, URL-safe identifier made of lowercase letters, numbers, and\n   hyphens — fills in from Name automatically; you can still edit it by\n   hand before saving.\n3. Turn on **Abstract** if this Contract exists only to be extended by\n   other Contracts, or to constrain what a field is allowed to point at —\n   an abstract Contract can't be used to create content directly.\n4. Optionally choose a **Parent Contract**. Every field the parent\n   declares is inherited automatically and shown read-only under\n   \"Inherited fields\" on the **Fields** tab — you can't redefine or hide an\n   inherited field, only add new ones of your own.\n5. Switch to the **Fields** tab (the default tab). The fields are a list on the left and the\n   selected field's settings are on the right. Select **Add field** and choose a type from the\n   searchable list (each type says what it is for); the new field opens for you to name. Then fill in\n   its Name and Id, change its type with **Change…**, and turn its modifiers on or off (see below).\n   Repeat for every field the Contract needs; drag a row by its handle to reorder it (or, from the\n   keyboard, use the **Move up** and **Move down** buttons on the field, or focus the handle, press\n   Space to pick it up, use the arrow keys to move it, and Space again to drop it), or select\n   **Delete field** to remove one. Fields inherited from a parent are collected under their own\n   heading, collapsed; select one to see its settings, read-only. A row with an unresolved error shows\n   a warning mark, and a failed save selects the first field that needs attention — or, for an error on\n   the General tab (Name, Id, Parent Contract), switches you back to that tab.\n6. A bar at the bottom counts your **unsaved changes** (select it to see each one in words: \"Added the\n   field Heading\", \"Turned on Mandatory for Body\") and says how saving will land. A change that would\n   make existing Components fail validation shows **Breaking change** *before* you save; saving it\n   asks you to confirm and names each reason, because it creates a new *version* (see \"Versions\"\n   below). **Discard** puts every edit back. Select **Save changes** (or **Create Contract** for a new\n   one) — the bar is visible from every tab.\n\n### Asking the assistant to draft one\n\nIf your organization has the assistant turned on, you can describe a Contract instead of building it field\nby field. On the New Contract form, open the assistant (the magenta ebitex-mark icon in the header, beside\n**?**) and ask — for example, \"Create me a Contract for a CTA Banner\". It proposes a Contract as a\n**Suggested** card listing the name and each field with its type. Nothing is saved until you select\n**Accept**, which fills in the form and saves it the same way **Create Contract** does; **Dismiss** discards\nit. Either way you can keep editing afterwards. See [Getting help](../general/getting-help.md).\n\n## Field types and modifiers\n\nEvery field has a **Field type** (Short Text, Number, Boolean, Date, Link,\nComponent, Blob, Presentation, Rich Text, or Category — Long Text, URL,\nReference, Nested, and Experience Reference are deprecated and no longer\noffered for new fields, though any field already using one keeps working\nunchanged; see \"Component fields\" below) plus up to five\nindependent modifiers, each shown as a toggle whose label changes with\nits state:\n\n- **Mandatory / Optional** — required, or not. For a Contextual field,\n  this only applies where the field is actually used, not on the\n  Component itself (see \"Contextual fields\" in\n  [Authoring Components](components.md)).\n- **Multiple / Single** — a list of values instead of one.\n- **Localized / Same in every locale** — a default value plus per-locale\n  overrides.\n- **Contextual / On the Component** — the value lives where the field is\n  *used*, not on the Component that declares it — useful for something\n  like a \"theme\" that should vary by where content is placed, not by the\n  content itself.\n- **Personalized / Same for every audience** — audience-conditioned\n  variant alternatives — see\n  [Personalizing content by audience](content-personalization.md).\n\nSome field types add an extra toggle of their own alongside these five —\nfor example, Short Text, Long Text, and Rich Text all show an **Allow\ntoken injection** toggle, since it's specific to text-bearing fields\nrather than something every field type needs.\n\nEach field type has its own extra settings, shown once you pick a type —\nfor example, Short Text and Long Text share an optional pattern plus\nlength limits, all grouped together under **Validation** (a label you\nselect to expand, staying expanded automatically whenever something\ninside still needs your attention), Component lets you restrict which\nContracts are allowed (and, optionally, which of the two modes below), and\nBlob lets you restrict file types and maximum size.\n\n### Date fields\n\nA **Date** field has one extra setting, **Include time** — off shows and\nedits just a calendar date; on adds a time of day too. Either way, the\ndate/time you enter is shown in your own local time zone, and switching\nthis setting on or off later is a normal (additive) change, not something\nthat requires a new version.\n\n### Restricting a field to a fixed list of values\n\nShort Text, Long Text, Number, and Date fields can be restricted to a\nfixed set of **Allowed values** in their settings — useful for something\nlike a status field that should only ever be \"Draft,\" \"In review,\" or\n\"Published,\" rather than any free-text string. Leave it empty to allow\nany value.\n\nHow the field is edited then depends on whether it also allows multiple\nvalues and how many options you listed: a small list of single-value\noptions shows as buttons to pick one of; a longer list shows as a\ndropdown; combined with **Multiple**, a small list shows as checkboxes and\na longer one as a searchable picker. Narrowing this list later (removing a\nvalue that was previously allowed) is a breaking change, since an\nexisting Component might already hold it; adding a new value is additive.\n\n### Picking options from another system\n\nInstead of typing a fixed list of Allowed values, a Short Text field can\nname a **Choice source** — an activated plugin that supplies the option\nlist live, kept automatically in sync with whatever it's connected to.\nThe first one, **ebitex Forms**, lists your organization's own published\nForms, so you can pick a form by name rather than typing its id — useful\nfor a field like \"which form should appear on this page.\" A field can use\neither Allowed values or a Choice source, never both.\n\nOnce a Choice source plugin is activated (in your organization's Settings)\nand picked in a field's settings, editing a Component with that field\nlooks exactly like a normal fixed-list field: buttons, a dropdown,\ncheckboxes, or a searchable picker, depending on how many options there\nare. If the source is temporarily unavailable — a misconfigured\nconnection, for example — you'll see a short message explaining that, and\nthe field falls back to a plain text box so you can still see and edit\nwhatever value is already saved; nothing else on the page is blocked from\nsaving while that happens.\n\n### Giving a field a default value\n\nMost field types — anything other than Component, Presentation, Rich\nText, and Category, which all point at other content rather than holding\na plain value — can be given a **Default value** in their expanded row.\nOnce set, every brand-new Component created from this Contract starts\nwith that value already filled in, instead of empty; editing or clearing\nthe default afterward never changes a Component that already exists. For a\nContextual field, its default becomes the Component's own fallback value —\nused whenever a specific placement doesn't override it.\n\n## Component fields\n\nA **Component** field holds a reference to another Component, an inline\n(embedded) value, or either — decided by whoever is *filling in* the field,\nnot fixed when you design the Contract:\n\n- **Linked** — points at another Component elsewhere in your organization;\n  the two stay separate, and deleting a Component that's linked elsewhere\n  is blocked until the link is removed first. Covers both picking an\n  existing Component and creating a brand-new one to link to.\n- **Inline** — embeds another Component's content directly inside; there's\n  no separate entity to manage, it's just part of the same document. Best\n  for content that only ever makes sense as part of its parent (for\n  example, an article's author details).\n\nIf you want to guarantee only one of these for a given field — say, a\n\"related articles\" field that should always link to a reusable Component,\nnever an inline one-off — the field's settings offer **Allowed value\nmodes**, a checklist of the two options above (at least one must stay\nchecked). Leaving both checked (the default) lets whoever fills in the\nfield choose either way each time. Either way, **allowedContractIds** lets\nyou restrict which Contracts are allowed — leave it empty to allow any\nContract (including descendants of one you do list).\n\nExisting Contracts may still have the older, separate **Reference** and\n**Nested** field types — a Reference field is equivalent to a Component\nfield restricted to Linked only, and a Nested field to one restricted to\nInline only. They keep working exactly as before; a new field just uses\nComponent instead.\n\n## Giving a Contract a title field\n\nContent built from a Contract needs a human label — the name shown in a site's\nnavigation menu, in a breadcrumb trail, and beside each item in a listing.\n**Title field** on the **General** tab is where you choose which field that\nlabel comes from.\n\nIt is a picker, not something you type. Choose a field; if the field you chose\nholds a nested block, a second dropdown appears so you can choose the field\ninside it — up to four levels deep. Only fields a title can actually come from\nare offered: text fields as the final choice, and nested blocks as the steps in\nbetween.\n\n**Set it once, on the most general Contract that has the field.** The choice is\ninherited, so if your \"Web page\" Contract declares its `title` field, every\nContract that extends it — Article, Landing page, and so on — uses the same one\nwith nothing more to set up. A Contract that needs a different field can choose\nits own, which takes over. When a Contract inherits its title field, the picker\nshows it read-only and names the Contract it came from, with **Override** to\nchoose a different one and **Clear** to remove it.\n\nA few notes on what to expect:\n\n- **It applies from the next publish.** Choosing a title field doesn't change\n  anything already published — each Component picks it up when it is next\n  published.\n- **Editing the title text is a Component publish.** Change the wording and\n  republish that Component, and its label updates everywhere it appears. You do\n  not need to republish the pages that use it.\n- **If it can't be resolved, the page's own name is used instead** — its\n  internal name from Composer. That happens when no Contract in the chain\n  declares a title field, when the field named no longer exists, or when the\n  content isn't published. Nothing breaks; you just see the internal name, which\n  is a good hint that the title field needs attention.\n- **A localizable title field is worth choosing.** One value covers every\n  locale, and each visitor sees theirs.\n\nIf the same piece of content appears in more than one place and should be named\ndifferently at each, make the title field **contextual** — then each page that\nuses it supplies its own wording. Bear in mind that a contextual title belongs to\nthe page, so changing it means republishing that page rather than the content.\n\n## Editing fields as a tree\n\nSome content refers to more of the same kind of content: a dog has a sire and a\ndam who are dogs too, a product is built from parts that are products, a person\nreports to a person. Building that with one picker per field means creating the\nfurthest ancestor first and working back towards the one you actually wanted.\n\n**Editing layout**, pinned under the fields on the **Fields** tab, changes that. Choose\n**Edit as a tree** and the Component editor draws those fields as one tree, where you fill in any\nslot directly. It only changes how the fields are edited. The fields, their validation and what is\npublished are exactly as before, and it creates no new Contract version, so a change to just the\nlayout is saved without a version bump. A preview beside the settings draws the chart or outline you\nhave chosen, using your own field names, and the fields in the tree carry an **In tree** chip.\nRenaming a field in the tree updates the layout, and removing it, or changing it to a type a tree\ncan't use, takes it out of the layout.\n\nTo set it up:\n\n1. Give the Contract the fields that point at itself: two or more single-value\n   Component fields (a sire and a dam), or one list field (parts). Each should\n   allow the Contract, or a Contract that extends it.\n2. On **Fields**, select **Editing layout**, then choose **Edit as a tree**.\n3. Tick the fields that make up the tree and choose how many generations (or\n   levels) to show.\n4. Choose whether the same Component may appear more than once.\n\n**Repeats.** *Allow across branches* lets one Component sit in several places, as\nin line-breeding or a part used in two assemblies. *Never* means each Component\nmay appear once in the whole tree, which suits an org chart or a taxonomy. If\nyou switch to *Never* on content that already repeats, the repeats are kept and\nnothing is rewritten; only a new repeat is refused. Either way, something can\nnever contain itself.\n\n**Inheritance.** Like the title field, the choice is inherited. Set it once on the\ngeneral Contract (a \"Pedigree dog\") and every Contract that extends it, such as\n\"Dog\" and \"Bitch\", edits as a tree. A Contract can choose its own, or choose\n*Ordinary fields (do not inherit the tree)* to opt out.\n\nIf the fields you tick no longer exist or no longer fit, the editor simply shows\nthe ordinary fields, so a Contract is never left uneditable.\n\n## Links to your site\n\nA Component has no page of its own, so nothing in Content takes you from a\nComponent to the page on your site that shows it. **External links** on the\n**General** tab adds that. Each link is a button in the Component editor that\nopens the page for the Component you are looking at, for example a dog's\nprintable pedigree or a blog post on the live site.\n\nTo add one:\n\n1. On **General**, under **External links**, choose **Declare links**.\n2. Give the link a **Label**, the words on the button.\n3. Write the **URL template**. It starts with `{origin}`, `https://` or\n   `http://`, and can use the Component's own details:\n   - `{id}` and `{externalId}`: the Component's id and external id.\n   - `{field:name}`: the value of one of its fields. A field inside an inline\n     value is written with dots, such as `{field:owner.name}`.\n   - `{key:sire}`: the **key** of the record a reference field points at, for\n     a page that is addressed by that key. A litter can link to a pedigree\n     page with `{origin}/pedigree?sire={key:sire}&dam={key:dam}`. A reference\n     with nothing chosen, or a value written in by hand rather than chosen\n     from the records, leaves its place empty, so a litter with an outside dam\n     still links; the link is switched off only when none of the `{key:}`\n     fields has a value.\n   - `{origin}`: the address of the **Site** you choose, always followed by a\n     `/`. It is how one Contract can point at the right host in every\n     environment.\n4. Choose the **Site** (when you used `{origin}`) and whether the link is\n   **Enabled** always or **Once published**.\n\nA live example under the form shows the link built from one of this Contract's\nown Components, so you can see it before you save. You can add up to five links.\n\n**What authors see.** A link that works opens in a new tab. A link that cannot\nwork is greyed and says why beside it: *Publish this Component first* for a\ndraft, *Needs a value for \"name\"* when a field it uses is empty, or that the Site\nhas no host yet. A Component with unpublished changes still has a live page, so\nits link works and says it shows the published version.\n\n**Safe by design.** A value from a field can never change where a link points:\nvalues are encoded into one part of the address, and the template's scheme and\nhost cannot use fields at all.\n\n**Nothing else changes.** Links are only shown in the editor. They create no new\nContract version, change no Component and appear in nothing your site receives.\nLike the tree, they are inherited: a Contract can declare its own, or choose\n*No links (do not inherit)*.\n\n## Versions\n\nEvery save is classified automatically:\n\n- **Additive** changes (adding an optional field, loosening a limit, …)\n  update the Contract's current version in place.\n- **Breaking** changes (removing a field, adding a *mandatory* field,\n  tightening a limit, …) create a new version, leaving the old one intact\n  so Components already pinned to it keep working.\n\nThe **History** tab on a Contract's page lists every version and\nwhat fields it resolved to. Existing Components aren't forced to update\nwhen a Contract changes — see \"The upgrade badge\" in\n[Authoring Components](components.md) for how that friction is surfaced\nand resolved.\n"
+        "body": "# Modeling content with Contracts\n\nContracts define the field structure your content adheres to — think of a\nContract as a blueprint (for example \"Article\" or \"Author\") that every\nComponent built from it must follow. You need to belong to an organization to\nuse it — see [Creating an organization and inviting\nteammates](../hub/organizations.md) if you haven't set one up yet.\n\n## The Contracts list\n\n**Modeling > Contracts** lists every Contract with its name, its id (smaller, underneath), whether it is\nconcrete or abstract, which Contract it extends, how many fields it has, what it is used as, and when it\nlast changed.\n\n**What a Contract is used for is worked out from how it is used, never set by hand.** The row of buttons above\nthe list filters by it, with a count on each, and a Contract can sit in several at once:\n\n- **Components** — Components have been created from it.\n- **Experiences** — a Component of this Contract is the content of a page in your Experience tree.\n- **Templates** — it is a Template's own settings Contract. (A Contract a Template merely *supports* is an\n  ordinary content Contract, so it shows under Components, not here.)\n- **Base** — it is abstract, or other Contracts extend it.\n- **Not used yet** — nothing references it. This is the clean-up list.\n\nThe **Used as** column spells it out, for example *Components 17 · Experiences 4*. Search matches a name or an\nid, and **Kind** and **Source** narrow further (a Contract can come from a provider, or be inherited from\nanother environment; both are read-only here and say so).\n\nEach row's **⋯** menu offers **Open** (or **View**, for one you can't edit), **Where used** and **Delete…**.\nDelete is switched off while anything uses the Contract, and says how many places do. Tick several rows to\ndelete them together; it tells you how many of the selection it can actually delete.\n\n## Creating a Contract\n\n1. From the Contracts list, select **New Contract**.\n2. Switch to the **General** tab. Enter a **Name** — everything else below\n   fills in from it, so filling it in first saves retyping. **Id** — a\n   short, URL-safe identifier made of lowercase letters, numbers, and\n   hyphens — fills in from Name automatically; you can still edit it by\n   hand before saving.\n3. Turn on **Abstract** if this Contract exists only to be extended by\n   other Contracts, or to constrain what a field is allowed to point at —\n   an abstract Contract can't be used to create content directly.\n4. Optionally choose a **Parent Contract**. Every field the parent\n   declares is inherited automatically and shown read-only under\n   \"Inherited fields\" on the **Fields** tab — you can't redefine or hide an\n   inherited field, only add new ones of your own.\n5. Switch to the **Fields** tab (the default tab). The fields are a list on the left and the\n   selected field's settings are on the right. Select **Add field** and choose a type from the\n   searchable list (each type says what it is for); the new field opens for you to name. Then fill in\n   its Name and Id, change its type with **Change…**, and turn its modifiers on or off (see below).\n   Repeat for every field the Contract needs; drag a row by its handle to reorder it (or, from the\n   keyboard, use the **Move up** and **Move down** buttons on the field, or focus the handle, press\n   Space to pick it up, use the arrow keys to move it, and Space again to drop it), or select\n   **Delete field** to remove one. Fields inherited from a parent are collected under their own\n   heading, collapsed; select one to see its settings, read-only. A row with an unresolved error shows\n   a warning mark, and a failed save selects the first field that needs attention — or, for an error on\n   the General tab (Name, Id, Parent Contract), switches you back to that tab.\n6. A bar at the bottom counts your **unsaved changes** (select it to see each one in words: \"Added the\n   field Heading\", \"Turned on Mandatory for Body\") and says how saving will land. A change that would\n   make existing Components fail validation shows **Breaking change** *before* you save; saving it\n   asks you to confirm and names each reason, because it creates a new *version* (see \"Versions\"\n   below). **Discard** puts every edit back. Select **Save changes** (or **Create Contract** for a new\n   one) — the bar is visible from every tab.\n\n### Asking the assistant to draft one\n\nIf your organization has the assistant turned on, you can describe a Contract instead of building it field\nby field. On the New Contract form, open the assistant (the magenta ebitex-mark icon in the header, beside\n**?**) and ask — for example, \"Create me a Contract for a CTA Banner\". It proposes a Contract as a\n**Suggested** card listing the name and each field with its type. Nothing is saved until you select\n**Accept**, which fills in the form and saves it the same way **Create Contract** does; **Dismiss** discards\nit. Either way you can keep editing afterwards. See [Getting help](../general/getting-help.md).\n\n## Field types and modifiers\n\nEvery field has a **Field type** (Text, Number, Boolean, Date, Link,\nComponent, Blob, Presentation, Rich Text, or Category — Short Text, Long Text,\nURL, Reference, Nested, and Experience Reference are deprecated and no longer\noffered for new fields, though any field already using one keeps working\nunchanged; see \"Text fields\" and \"Component fields\" below) plus up to five\nindependent modifiers, each shown as a toggle whose label changes with\nits state:\n\n- **Mandatory / Optional** — required, or not. For a Contextual field,\n  this only applies where the field is actually used, not on the\n  Component itself (see \"Contextual fields\" in\n  [Authoring Components](components.md)).\n- **Multiple / Single** — a list of values instead of one.\n- **Localized / Same in every locale** — a default value plus per-locale\n  overrides.\n- **Contextual / On the Component** — the value lives where the field is\n  *used*, not on the Component that declares it — useful for something\n  like a \"theme\" that should vary by where content is placed, not by the\n  content itself.\n- **Personalized / Same for every audience** — audience-conditioned\n  variant alternatives — see\n  [Personalizing content by audience](content-personalization.md).\n\nSome field types add an extra toggle of their own alongside these five —\nfor example, Text and Rich Text both show an **Allow\ntoken injection** toggle, since it's specific to text-bearing fields\nrather than something every field type needs.\n\nEach field type has its own extra settings, shown once you pick a type —\nfor example, Text has an optional pattern plus\nlength limits, all grouped together under **Validation** (a label you\nselect to expand, staying expanded automatically whenever something\ninside still needs your attention), Component lets you restrict which\nContracts are allowed (and, optionally, which of the two modes below), and\nBlob lets you restrict file types and maximum size.\n\n### Date fields\n\nA **Date** field has one extra setting, **Include time** — off shows and\nedits just a calendar date; on adds a time of day too. Either way, the\ndate/time you enter is shown in your own local time zone, and switching\nthis setting on or off later is a normal (additive) change, not something\nthat requires a new version.\n\n### Text fields\n\n**Text** is the one plain-text type. Turn on **Multiple lines** in its\nsettings and the editor becomes a larger box that keeps line breaks;\nleave it off for a single line such as a title. Either way the stored\nvalue is the same plain string, so switching the setting later never\nchanges or loses anything already written.\n\n**Short Text** and **Long Text** are the two types Text replaces. A field\nthat already uses one keeps working, but a new field cannot take it. To\nmove an existing field over, open it and choose **Convert to Text**: its\nsettings carry over unchanged (a Long Text field also becomes **Multiple\nlines**), every value already written is kept as it is, and the change\ndoes not by itself create a new Contract version.\n\n### Restricting a field to a fixed list of values\n\nText, Number, and Date fields can be restricted to a\nfixed set of **Allowed values** in their settings — useful for something\nlike a status field that should only ever be \"Draft,\" \"In review,\" or\n\"Published,\" rather than any free-text string. Leave it empty to allow\nany value.\n\nHow the field is edited then depends on whether it also allows multiple\nvalues and how many options you listed: a small list of single-value\noptions shows as buttons to pick one of; a longer list shows as a\ndropdown; combined with **Multiple**, a small list shows as checkboxes and\na longer one as a searchable picker. Narrowing this list later (removing a\nvalue that was previously allowed) is a breaking change, since an\nexisting Component might already hold it; adding a new value is additive.\n\n### Picking options from another system\n\nInstead of typing a fixed list of Allowed values, a Text field can\nname a **Choice source** — an activated plugin that supplies the option\nlist live, kept automatically in sync with whatever it's connected to.\nThe first one, **ebitex Forms**, lists your organization's own published\nForms, so you can pick a form by name rather than typing its id — useful\nfor a field like \"which form should appear on this page.\" A field can use\neither Allowed values or a Choice source, never both.\n\nOnce a Choice source plugin is activated (in your organization's Settings)\nand picked in a field's settings, editing a Component with that field\nlooks exactly like a normal fixed-list field: buttons, a dropdown,\ncheckboxes, or a searchable picker, depending on how many options there\nare. If the source is temporarily unavailable — a misconfigured\nconnection, for example — you'll see a short message explaining that, and\nthe field falls back to a plain text box so you can still see and edit\nwhatever value is already saved; nothing else on the page is blocked from\nsaving while that happens.\n\n### Giving a field a default value\n\nMost field types — anything other than Component, Presentation, Rich\nText, and Category, which all point at other content rather than holding\na plain value — can be given a **Default value** in their expanded row.\nOnce set, every brand-new Component created from this Contract starts\nwith that value already filled in, instead of empty; editing or clearing\nthe default afterward never changes a Component that already exists. For a\nContextual field, its default becomes the Component's own fallback value —\nused whenever a specific placement doesn't override it.\n\n## Component fields\n\nA **Component** field holds a reference to another Component, an inline\n(embedded) value, or either — decided by whoever is *filling in* the field,\nnot fixed when you design the Contract:\n\n- **Linked** — points at another Component elsewhere in your organization;\n  the two stay separate, and deleting a Component that's linked elsewhere\n  is blocked until the link is removed first. Covers both picking an\n  existing Component and creating a brand-new one to link to.\n- **Inline** — embeds another Component's content directly inside; there's\n  no separate entity to manage, it's just part of the same document. Best\n  for content that only ever makes sense as part of its parent (for\n  example, an article's author details).\n\nIf you want to guarantee only one of these for a given field — say, a\n\"related articles\" field that should always link to a reusable Component,\nnever an inline one-off — the field's settings offer **Allowed value\nmodes**, a checklist of the two options above (at least one must stay\nchecked). Leaving both checked (the default) lets whoever fills in the\nfield choose either way each time. Either way, **allowedContractIds** lets\nyou restrict which Contracts are allowed — leave it empty to allow any\nContract (including descendants of one you do list).\n\nExisting Contracts may still have the older, separate **Reference** and\n**Nested** field types — a Reference field is equivalent to a Component\nfield restricted to Linked only, and a Nested field to one restricted to\nInline only. They keep working exactly as before; a new field just uses\nComponent instead.\n\n## Giving a Contract a title field\n\nContent built from a Contract needs a human label — the name shown in a site's\nnavigation menu, in a breadcrumb trail, and beside each item in a listing.\n**Title field** on the **General** tab is where you choose which field that\nlabel comes from.\n\nIt is a picker, not something you type. Choose a field; if the field you chose\nholds a nested block, a second dropdown appears so you can choose the field\ninside it — up to four levels deep. Only fields a title can actually come from\nare offered: text fields as the final choice, and nested blocks as the steps in\nbetween.\n\n**Set it once, on the most general Contract that has the field.** The choice is\ninherited, so if your \"Web page\" Contract declares its `title` field, every\nContract that extends it — Article, Landing page, and so on — uses the same one\nwith nothing more to set up. A Contract that needs a different field can choose\nits own, which takes over. When a Contract inherits its title field, the picker\nshows it read-only and names the Contract it came from, with **Override** to\nchoose a different one and **Clear** to remove it.\n\nA few notes on what to expect:\n\n- **It applies from the next publish.** Choosing a title field doesn't change\n  anything already published — each Component picks it up when it is next\n  published.\n- **Editing the title text is a Component publish.** Change the wording and\n  republish that Component, and its label updates everywhere it appears. You do\n  not need to republish the pages that use it.\n- **If it can't be resolved, the page's own name is used instead** — its\n  internal name from Composer. That happens when no Contract in the chain\n  declares a title field, when the field named no longer exists, or when the\n  content isn't published. Nothing breaks; you just see the internal name, which\n  is a good hint that the title field needs attention.\n- **A localizable title field is worth choosing.** One value covers every\n  locale, and each visitor sees theirs.\n\nIf the same piece of content appears in more than one place and should be named\ndifferently at each, make the title field **contextual** — then each page that\nuses it supplies its own wording. Bear in mind that a contextual title belongs to\nthe page, so changing it means republishing that page rather than the content.\n\n## Editing fields as a tree\n\nSome content refers to more of the same kind of content: a dog has a sire and a\ndam who are dogs too, a product is built from parts that are products, a person\nreports to a person. Building that with one picker per field means creating the\nfurthest ancestor first and working back towards the one you actually wanted.\n\n**Editing layout**, pinned under the fields on the **Fields** tab, changes that. Choose\n**Edit as a tree** and the Component editor draws those fields as one tree, where you fill in any\nslot directly. It only changes how the fields are edited. The fields, their validation and what is\npublished are exactly as before, and it creates no new Contract version, so a change to just the\nlayout is saved without a version bump. A preview beside the settings draws the chart or outline you\nhave chosen, using your own field names, and the fields in the tree carry an **In tree** chip.\nRenaming a field in the tree updates the layout, and removing it, or changing it to a type a tree\ncan't use, takes it out of the layout.\n\nTo set it up:\n\n1. Give the Contract the fields that point at itself: two or more single-value\n   Component fields (a sire and a dam), or one list field (parts). Each should\n   allow the Contract, or a Contract that extends it.\n2. On **Fields**, select **Editing layout**, then choose **Edit as a tree**.\n3. Tick the fields that make up the tree and choose how many generations (or\n   levels) to show.\n4. Choose whether the same Component may appear more than once.\n\n**Repeats.** *Allow across branches* lets one Component sit in several places, as\nin line-breeding or a part used in two assemblies. *Never* means each Component\nmay appear once in the whole tree, which suits an org chart or a taxonomy. If\nyou switch to *Never* on content that already repeats, the repeats are kept and\nnothing is rewritten; only a new repeat is refused. Either way, something can\nnever contain itself.\n\n**Inheritance.** Like the title field, the choice is inherited. Set it once on the\ngeneral Contract (a \"Pedigree dog\") and every Contract that extends it, such as\n\"Dog\" and \"Bitch\", edits as a tree. A Contract can choose its own, or choose\n*Ordinary fields (do not inherit the tree)* to opt out.\n\nIf the fields you tick no longer exist or no longer fit, the editor simply shows\nthe ordinary fields, so a Contract is never left uneditable.\n\n## Links to your site\n\nA Component has no page of its own, so nothing in Content takes you from a\nComponent to the page on your site that shows it. **External links** on the\n**General** tab adds that. Each link is a button in the Component editor that\nopens the page for the Component you are looking at, for example a dog's\nprintable pedigree or a blog post on the live site.\n\nTo add one:\n\n1. On **General**, under **External links**, choose **Declare links**.\n2. Give the link a **Label**, the words on the button.\n3. Write the **URL template**. It starts with `{origin}`, `https://` or\n   `http://`, and can use the Component's own details:\n   - `{id}` and `{externalId}`: the Component's id and external id.\n   - `{field:name}`: the value of one of its fields. A field inside an inline\n     value is written with dots, such as `{field:owner.name}`.\n   - `{key:sire}`: the **key** of the record a reference field points at, for\n     a page that is addressed by that key. A litter can link to a pedigree\n     page with `{origin}/pedigree?sire={key:sire}&dam={key:dam}`. A reference\n     with nothing chosen, or a value written in by hand rather than chosen\n     from the records, leaves its place empty, so a litter with an outside dam\n     still links; the link is switched off only when none of the `{key:}`\n     fields has a value.\n   - `{origin}`: the address of the **Site** you choose, always followed by a\n     `/`. It is how one Contract can point at the right host in every\n     environment.\n4. Choose the **Site** (when you used `{origin}`) and whether the link is\n   **Enabled** always or **Once published**.\n\nA live example under the form shows the link built from one of this Contract's\nown Components, so you can see it before you save. You can add up to five links.\n\n**What authors see.** A link that works opens in a new tab. A link that cannot\nwork is greyed and says why beside it: *Publish this Component first* for a\ndraft, *Needs a value for \"name\"* when a field it uses is empty, or that the Site\nhas no host yet. A Component with unpublished changes still has a live page, so\nits link works and says it shows the published version.\n\n**Safe by design.** A value from a field can never change where a link points:\nvalues are encoded into one part of the address, and the template's scheme and\nhost cannot use fields at all.\n\n**Nothing else changes.** Links are only shown in the editor. They create no new\nContract version, change no Component and appear in nothing your site receives.\nLike the tree, they are inherited: a Contract can declare its own, or choose\n*No links (do not inherit)*.\n\n## Versions\n\nEvery save is classified automatically:\n\n- **Additive** changes (adding an optional field, loosening a limit, …)\n  update the Contract's current version in place.\n- **Breaking** changes (removing a field, adding a *mandatory* field,\n  tightening a limit, …) create a new version, leaving the old one intact\n  so Components already pinned to it keep working.\n\nThe **History** tab on a Contract's page lists every version and\nwhat fields it resolved to. Existing Components aren't forced to update\nwhen a Contract changes — see \"The upgrade badge\" in\n[Authoring Components](components.md) for how that friction is surfaced\nand resolved.\n"
     },
     {
         "slug": "deployment-keys",

package/dist/resources/helpCorpus.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpCorpus.generated.js","sourceRoot":"","sources":["../../src/resources/helpCorpus.generated.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AAIpG,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,0CAA0C;QACnD,MAAM,EAAE,knWAAknW;KAC3nW;IACD;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,wnGAAwnG;KACjoG;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,sBAAsB;QAC/B,MAAM,EAAE,qwyBAAqwyB;KAC9wyB;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,MAAM,EAAE,06nBAA06nB;KACn7nB;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,0BAA0B;QACnC,MAAM,EAAE,6oLAA6oL;KACtpL;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,2zqBAA2zqB;KACp0qB;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,sBAAsB;QAC/B,MAAM,EAAE,o1qBAAo1qB;KAC71qB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,qCAAqC;QAC9C,MAAM,EAAE,q3FAAq3F;KAC93F;IACD;QACE,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,4BAA4B;QACrC,MAAM,EAAE,ksRAAksR;KAC3sR;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,44MAA44M;KACr5M;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,22GAA22G;KACp3G;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,moQAAmoQ;KAC5oQ;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,+9XAA+9X;KACx+X;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,u5mBAAu5mB;KACh6mB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,0uHAA0uH;KACnvH;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EAAE,+iFAA+iF;KACxjF;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,u9JAAu9J;KACh+J;IACD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,y9FAAy9F;KACl+F;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,upIAAupI;KAChqI;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,ugNAAugN;KAChhN;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,0oSAA0oS;KACnpS;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,i4YAAi4Y;KAC14Y;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,g2EAAg2E;KACz2E;IACD;QACE,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,i7FAAi7F;KAC17F;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EAAE,g8KAAg8K;KACz8K;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,yvJAAyvJ;KAClwJ;CACF,CAAA"}
+{"version":3,"file":"helpCorpus.generated.js","sourceRoot":"","sources":["../../src/resources/helpCorpus.generated.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AAIpG,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,0CAA0C;QACnD,MAAM,EAAE,gyYAAgyY;KACzyY;IACD;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,wnGAAwnG;KACjoG;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,sBAAsB;QAC/B,MAAM,EAAE,qwyBAAqwyB;KAC9wyB;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,MAAM,EAAE,06nBAA06nB;KACn7nB;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,0BAA0B;QACnC,MAAM,EAAE,0iNAA0iN;KACnjN;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,2zqBAA2zqB;KACp0qB;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,sBAAsB;QAC/B,MAAM,EAAE,o1qBAAo1qB;KAC71qB;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,qCAAqC;QAC9C,MAAM,EAAE,q3FAAq3F;KAC93F;IACD;QACE,MAAM,EAAE,yBAAyB;QACjC,OAAO,EAAE,4BAA4B;QACrC,MAAM,EAAE,ksRAAksR;KAC3sR;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,44MAA44M;KACr5M;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,4CAA4C;QACrD,MAAM,EAAE,22GAA22G;KACp3G;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,moQAAmoQ;KAC5oQ;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,+9XAA+9X;KACx+X;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,onoBAAonoB;KAC7noB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,0uHAA0uH;KACnvH;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EAAE,+iFAA+iF;KACxjF;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,u9JAAu9J;KACh+J;IACD;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,y9FAAy9F;KACl+F;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,mBAAmB;QAC5B,MAAM,EAAE,upIAAupI;KAChqI;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,ugNAAugN;KAChhN;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,0oSAA0oS;KACnpS;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,i4YAAi4Y;KAC14Y;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,g2EAAg2E;KACz2E;IACD;QACE,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,i7FAAi7F;KAC17F;IACD;QACE,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,mCAAmC;QAC5C,MAAM,EAAE,g8KAAg8K;KACz8K;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,yvJAAyvJ;KAClwJ;CACF,CAAA"}

package/dist/session.d.ts

@@ -27,12 +27,22 @@ export type WhoAmI = {
     roleName: string | null;
     keyName: string | null;
     scopes: string[];
+    /**
+     * What the acting role may do, as opposed to what the key's scopes allow. Absent from an API that
+     * predates it, which is why every reader treats a missing list as "not told" rather than "none".
+     */
+    permissions?: string[];
 };
 export type Session = {
     who: WhoAmI;
     /** True when the operator forced read-only regardless of what the key could do. */
     readOnlyRequested: boolean;
     has(scope: string): boolean;
+    /**
+     * True only when the API reported the role's permissions and this one is not among them. An API
+     * that reported none cannot say, so the request is sent and the server decides.
+     */
+    lacksPermission(permission: string): boolean;
     /** One line naming where a write just landed, appended to every write result. */
     contextLine(): string;
 };

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAGhD;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,UAAU,4BAA4B,CAAA;AACnD,eAAO,MAAM,WAAW,6BAA6B,CAAA;AACrD,eAAO,MAAM,aAAa,+BAA+B,CAAA;AACzD,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,MAAM,MAAM,MAAM,GAAG;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,mFAAmF;IACnF,iBAAiB,EAAE,OAAO,CAAA;IAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B,iFAAiF;IACjF,WAAW,IAAI,MAAM,CAAA;CACtB,CAAA;AAED,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,OAAO,CAAC,CAmBlB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAGhD;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,UAAU,4BAA4B,CAAA;AACnD,eAAO,MAAM,WAAW,6BAA6B,CAAA;AACrD,eAAO,MAAM,aAAa,+BAA+B,CAAA;AACzD,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAE7D,MAAM,MAAM,MAAM,GAAG;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,OAAO,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,mFAAmF;IACnF,iBAAiB,EAAE,OAAO,CAAA;IAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAC3B;;;OAGG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5C,iFAAiF;IACjF,WAAW,IAAI,MAAM,CAAA;CACtB,CAAA;AAED,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,iBAAiB,EAAE,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,OAAO,CAAC,CAqBlB"}

package/dist/session.js

@@ -29,12 +29,14 @@ export async function resolveSession(client, options) {
         throw new StartupError(startupMessage(error, client.baseUrl));
     }
     const scopes = new Set(who.scopes ?? []);
+    const permissions = Array.isArray(who.permissions) ? new Set(who.permissions) : null;
     return {
         who,
         readOnlyRequested: options.readOnlyRequested,
         // A forced read-only session reports every write scope as absent, so tool registration —
         // which asks this and nothing else — needs no second concept of "but the operator said no".
         has: (scope) => (options.readOnlyRequested && isWriteScope(scope) ? false : scopes.has(scope)),
+        lacksPermission: (permission) => permissions !== null && !permissions.has(permission),
         contextLine: () => `[${who.organizationName ?? who.organizationId} · ${who.environmentName ?? who.environmentId} · as ${who.roleName ?? 'unknown role'}]`,
     };
 }

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,yBAAyB,CAAA;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAA;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAA;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAsB7D,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,OAAuC;IAEvC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAW,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IAExC,OAAO;QACL,GAAG;QACH,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,yFAAyF;QACzF,4FAA4F;QAC5F,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9F,WAAW,EAAE,GAAG,EAAE,CAChB,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,MAAM,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,SAAS,GAAG,CAAC,QAAQ,IAAI,cAAc,GAAG;KACzI,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,eAAe,CAAA;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe;IACrD,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,EAAE,CAAC;QACxC,OAAO,CACL,iDAAiD,OAAO,KAAK;YAC7D,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,kDAAkD,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,cAAc,IAAI,CAAA;IACvG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,OAAO,gFAAgF;YAC1F,2FAA2F;YAC3F,8EAA8E,CAC/E,CAAA;IACH,CAAC;IAED,+FAA+F;IAC/F,+EAA+E;IAC/E,OAAO,iDAAiD,KAAK,CAAC,OAAO,EAAE,CAAA;AACzE,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,yBAAyB,CAAA;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,0BAA0B,CAAA;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAA;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAA;AAgC7D,MAAM,OAAO,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,OAAuC;IAEvC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAW,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAEpF,OAAO;QACL,GAAG;QACH,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,yFAAyF;QACzF,4FAA4F;QAC5F,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9F,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QACrF,WAAW,EAAE,GAAG,EAAE,CAChB,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,cAAc,MAAM,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,SAAS,GAAG,CAAC,QAAQ,IAAI,cAAc,GAAG;KACzI,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,eAAe,CAAA;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe;IACrD,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,EAAE,CAAC;QACxC,OAAO,CACL,iDAAiD,OAAO,KAAK;YAC7D,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzD,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,kDAAkD,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,cAAc,IAAI,CAAA;IACvG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,OAAO,gFAAgF;YAC1F,2FAA2F;YAC3F,8EAA8E,CAC/E,CAAA;IACH,CAAC;IAED,+FAA+F;IAC/F,+EAA+E;IAC/E,OAAO,iDAAiD,KAAK,CAAC,OAAO,EAAE,CAAA;AACzE,CAAC"}

package/dist/tools/catalog.d.ts

@@ -43,6 +43,13 @@ export type ToolDescriptor = {
     /** Present only for `content_write` — see {@link CONTENT_WRITE_IMMEDIATE_KINDS}. */
     immediateKinds?: readonly EntityKind[];
 };
+/**
+ * The permission the acting role must hold, beside the key's scope, to write or delete a kind. A
+ * scope is the key's ceiling and a permission is the role's, so a key holding `authoring` can still
+ * be refused: a Contract needs `content.contracts.manage`, which Member does not hold. Held in step
+ * with the server's `ManagementToolCatalog.KindPermissions` by the same fixture as the tools.
+ */
+export declare const KIND_PERMISSIONS: Readonly<Partial<Record<EntityKind, string>>>;
 export declare const TOOL_CATALOG: readonly ToolDescriptor[];
 /** Whether `session` may see the named tool, per the catalogue's `requiredScope`. */
 export declare function sessionCanUse(session: {

package/dist/tools/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA;AAG9D;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAG,GAAY,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,+CAAgD,CAAA;AAE1F,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IAC7B,oFAAoF;IACpF,cAAc,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC,CAAA;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAqBxC,CAAA;AAQV,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjG"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA;AAG9D;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAG,GAAY,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,+CAAgD,CAAA;AAE1F,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IAC7B,oFAAoF;IACpF,cAAc,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAG1E,CAAA;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAqBxC,CAAA;AAQV,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGjG"}

package/dist/tools/catalog.js

@@ -35,6 +35,16 @@ export const AUTHENTICATED = '*';
  * and held in parity by `tool-catalogue.json`.
  */
 export const CONTENT_WRITE_IMMEDIATE_KINDS = ['component', 'node', 'nodePayload'];
+/**
+ * The permission the acting role must hold, beside the key's scope, to write or delete a kind. A
+ * scope is the key's ceiling and a permission is the role's, so a key holding `authoring` can still
+ * be refused: a Contract needs `content.contracts.manage`, which Member does not hold. Held in step
+ * with the server's `ManagementToolCatalog.KindPermissions` by the same fixture as the tools.
+ */
+export const KIND_PERMISSIONS = {
+    contract: 'content.contracts.manage',
+    template: 'content.templates.manage',
+};
 export const TOOL_CATALOG = [
     { name: 'content_whoami', requiredScope: AUTHENTICATED, readOnly: true },
     { name: 'content_describe', requiredScope: SCOPE_READ, readOnly: true },

package/dist/tools/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1E;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAU,CAAA;AAY1F,MAAM,CAAC,MAAM,YAAY,GAA8B;IACrD,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxE,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnE,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;IACzF,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/E;QACE,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,6BAA6B;KAC9C;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE;IAClG,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC1E,6FAA6F;IAC7F,8FAA8F;IAC9F,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;CAChE,CAAA;AAEV,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,8BAA8B,CAAC,CAAA;IAClG,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,OAAwC,EAAE,QAAgB;IACtF,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACjD,OAAO,aAAa,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AACtE,CAAC"}
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1E;;;;;;;;;;;;GAYG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAU,CAAA;AAY1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkD;IAC7E,QAAQ,EAAE,0BAA0B;IACpC,QAAQ,EAAE,0BAA0B;CACrC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAA8B;IACrD,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxE,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnE,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE;IACzF,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/E;QACE,IAAI,EAAE,eAAe;QACrB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,6BAA6B;KAC9C;IACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE;IAClG,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC1E,6FAA6F;IAC7F,8FAA8F;IAC9F,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;CAChE,CAAA;AAEV,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,8BAA8B,CAAC,CAAA;IAClG,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,OAAwC,EAAE,QAAgB;IACtF,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACjD,OAAO,aAAa,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AACtE,CAAC"}

package/dist/tools/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/tools/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAM5C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,kGAAkG;IAClG,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B;;;;;;;;OAQG;IACH,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CA6e3E"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/tools/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAExE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAM5C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,aAAa,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,kGAAkG;IAClG,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B;;;;;;;;OAQG;IACH,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAwBD,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAof3E"}

package/dist/tools/register.js

@@ -1,12 +1,31 @@
 import { z } from 'zod';
 import { query } from '../client.js';
-import { ContentApiError } from '../errors.js';
+import { ContentApiError, permissionHint } from '../errors.js';
 import { routesFor, withId, WRITABLE_KINDS } from '../routes.js';
-import { AUTHENTICATED, sessionCanUse, TOOL_CATALOG } from './catalog.js';
+import { AUTHENTICATED, KIND_PERMISSIONS, sessionCanUse, TOOL_CATALOG } from './catalog.js';
 import { decodeCursor, nextSearchCursor } from './cursor.js';
 import { fail, guard, ok } from './result.js';
 import { describeSession } from './whoami.js';
 const KIND = z.enum(WRITABLE_KINDS);
+/**
+ * Why a write or delete of this kind would be refused for the acting role, or null to send it.
+ *
+ * Refused here rather than sent: the role is known from `/whoami`, so the request can only come back
+ * `403`, and an agent that is told the permission and the remedy up front does not spend a turn
+ * learning it. The tool itself stays registered, because the key's other kinds are unaffected.
+ */
+function refusedForPermission(session, kind) {
+    const permission = KIND_PERMISSIONS[kind];
+    if (!permission || !session.lacksPermission(permission))
+        return null;
+    return `Not sent. ${permissionHint(permission)}`;
+}
+/** The kinds this role cannot write, for `content_whoami`, each with the permission it lacks. */
+function withheldKinds(session) {
+    return Object.entries(KIND_PERMISSIONS)
+        .filter(([, permission]) => permission && session.lacksPermission(permission))
+        .map(([kind, requires]) => ({ kind, requires: requires }));
+}
 export function registerTools(server, context) {
     const { client, session, target, serverVersion } = context;
     // Everything below is gated on a scope, and an absent tool is the point: an agent that cannot see
@@ -43,7 +62,7 @@ export function registerTools(server, context) {
         // openWorldHint is false here and true on every other tool: this one reaches no external
         // system at all, answering from the credential resolved when the server started.
         annotations: { readOnlyHint: true, openWorldHint: false },
-    }, async () => ok(describeSession(session, withheld, serverVersion)));
+    }, async () => ok(describeSession(session, withheld, serverVersion, withheldKinds(session))));
     if (canRead) {
         server.registerTool('content_describe', {
             title: 'Describe what can exist here',
@@ -204,6 +223,9 @@ export function registerTools(server, context) {
             annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         }, async ({ kind, id, payload }) => guard(async () => {
             const routes = routesFor(kind);
+            const refused = refusedForPermission(session, kind);
+            if (refused)
+                return fail(refused);
             if (!id) {
                 if (!routes.create) {
                     return fail(`${routes.label} cannot be created on its own; it is written by updating its owner.`);
@@ -235,6 +257,9 @@ export function registerTools(server, context) {
             if (!confirm)
                 return fail('Not deleted. Pass confirm: true to delete this permanently.');
             const routes = routesFor(kind);
+            const refused = refusedForPermission(session, kind);
+            if (refused)
+                return fail(refused);
             if (!routes.remove)
                 return fail(`${routes.label} cannot be deleted through this API.`);
             await client.request('DELETE', withId(routes.remove, id));

package/dist/tools/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/tools/register.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAA;AAmChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;AAEnC,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,OAAoB;IACnE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IAE1D,kGAAkG;IAClG,+FAA+F;IAC/F,sBAAsB;IACtB,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,iGAAiG;IACjG,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,QAAQ,GAAmB,YAAY,CAAC,MAAM,CAClD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CACnF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAEpE,4FAA4F;IAC5F,EAAE;IACF,qGAAqG;IACrG,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kDAAkD;IAClD,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,wFAAwF;YACxF,0CAA0C;QAC5C,WAAW,EAAE,EAAE;QACf,yFAAyF;QACzF,iFAAiF;QACjF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAClE,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,8BAA8B;YACrC,WAAW,EACT,sFAAsF;gBACtF,wFAAwF;gBACxF,wFAAwF;gBACxF,mDAAmD;YACrD,WAAW,EAAE;gBACX,OAAO,EAAE,CAAC;qBACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;qBACvD,QAAQ,EAAE;qBACV,QAAQ,CAAC,wBAAwB,CAAC;aACtC;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACpB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;YAC3E,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;YACnD,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;YACE,KAAK,EAAE,eAAe;YACtB,WAAW,EACT,kFAAkF;gBAClF,qFAAqF;gBACrF,qCAAqC;YACvC,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;gBAC7H,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;gBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;gBAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;gBAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;aAC9E;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACpD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,yFAAyF;YACzF,uFAAuF;YACvF,oFAAoF;YACpF,EAAE;YACF,wFAAwF;YACxF,6FAA6F;YAC7F,wFAAwF;YACxF,uFAAuF;YACvF,2FAA2F;YAC3F,yEAAyE;YACzE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACjC,OAAO,IAAI,CACT,oFAAoF;oBAClF,yEAAyE,CAC5E,CAAA;YACH,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,qFAAqF,CAAC,CAAA;gBACpG,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,IAAI,CACT,mFAAmF;wBACjF,oFAAoF;wBACpF,sBAAsB,CACzB,CAAA;gBACH,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,KAAK;gBACL,qFAAqF;gBACrF,qCAAqC;gBACrC,cAAc,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAClG,CAAA;gBAED,OAAO,EAAE,CACP,EAAE,GAAI,KAAiC,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAC9E,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAC5B,CAAA;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,IAAI,CACT,mFAAmF;oBACjF,sFAAsF;oBACtF,aAAa,CAChB,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YACrF,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;YACE,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,+EAA+E;gBAC/E,uFAAuF;gBACvF,2CAA2C;YAC7C,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CACrB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,IAAI,CACT,GAAG,MAAM,CAAC,KAAK,0DAA0D;oBACvE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,WAAW,CACd,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wFAAwF;gBACxF,uFAAuF;gBACvF,0FAA0F;gBAC1F,yFAAyF;gBACzF,yDAAyD;gBACzD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7D,OAAO,IAAI,CACT,GAAG,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,6CAA6C;wBACrF,iCAAiC,CACpC,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CACL,CAAA;QAED,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,6FAA6F;QAC7F,uEAAuE;QACvE,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,yFAAyF;gBACzF,uFAAuF;gBACvF,qFAAqF;gBACrF,mFAAmF;gBACnF,gFAAgF;gBAChF,qFAAqF;gBACrF,qFAAqF;gBACrF,4EAA4E;YAC9E,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,IAAI,EAAE,CACT,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kFAAkF;gBAClF,sFAAsF;gBACtF,qFAAqF;gBACrF,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7D,OAAO,IAAI,CACT,GAAG,MAAM,CAAC,OAAO,+DAA+D;wBAC9E,6EAA6E;wBAC7E,6CAA6C,CAChD,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;YACE,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,0FAA0F;gBAC1F,yFAAyF;gBACzF,2FAA2F;gBAC3F,gDAAgD;gBAChD,yFAAyF;gBACzF,0FAA0F;gBAC1F,2FAA2F;gBAC3F,+BAA+B;YACjC,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;aACzG;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACxG,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAE9B,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,qEAAqE,CAAC,CAAA;gBACnG,CAAC;gBAED,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YACxF,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,kCAAkC,CAAC,CAAA;YAChE,CAAC;YAED,yFAAyF;YACzF,6EAA6E;YAC7E,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,EACnF,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;QACH,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;YACE,KAAK,EAAE,kBAAkB;YACzB,WAAW,EACT,mFAAmF;gBACnF,mFAAmF;gBACnF,6DAA6D;YAC/D,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;aACjE;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACvG,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,sFAAsF;YACtF,wFAAwF;YACxF,oCAAoC;YACpC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAA;YAExF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,sCAAsC,CAAC,CAAA;YAEtF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;YACzD,OAAO,EAAE,CAAC,WAAW,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACpE,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;YACE,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,0FAA0F;gBAC1F,sFAAsF;gBACtF,0FAA0F;gBAC1F,oFAAoF;YACtF,WAAW,EAAE;gBACX,KAAK,EAAE,CAAC;qBACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;qBACxC,QAAQ,EAAE;qBACV,QAAQ,CAAC,yDAAyD,CAAC;gBACtE,KAAK,EAAE,CAAC;qBACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;qBACxC,QAAQ,EAAE;qBACV,QAAQ,CACP,sFAAsF;oBACpF,kDAAkD,CACrD;gBACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;aACjH;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACzG,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAChD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC,4DAA4D,CAAC,CAAA;YAC3E,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,EAC/E,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;YACH,CAAC;YAED,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;gBACvC,KAAK,EAAE,KAAM,CAAC,GAAG,CAAC,aAAa,CAAC;gBAChC,qBAAqB;aACtB,CAAC,EACF,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;QACH,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;YACE,KAAK,EAAE,aAAa;YACpB,WAAW,EACT,oFAAoF;gBACpF,sDAAsD;YACxD,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,EAAE,CACA,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,EAC7E,OAAO,CAAC,WAAW,EAAE,CACtB,CACF,CACJ,CAAA;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EACT,sFAAsF;gBACtF,wFAAwF;gBACxF,0FAA0F;gBAC1F,qFAAqF;gBACrF,gFAAgF;gBAChF,8EAA8E;gBAC9E,yFAAyF;gBACzF,iDAAiD;YACnD,WAAW,EAAE;gBACX,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;gBAC5D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;gBACxC,KAAK,EAAE,CAAC;qBACL,OAAO,EAAE;qBACT,QAAQ,EAAE;qBACV,QAAQ,CAAC,8EAA8E,CAAC;gBAC3F,0FAA0F;gBAC1F,wFAAwF;gBACxF,0FAA0F;gBAC1F,mFAAmF;gBACnF,2FAA2F;gBAC3F,sFAAsF;gBACtF,8EAA8E;gBAC9E,YAAY,EAAE,CAAC;qBACZ,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;qBACzC,QAAQ,EAAE;qBACV,QAAQ,CACP,wEAAwE;oBACtE,qFAAqF;oBACrF,mFAAmF;oBACnF,2EAA2E;oBAC3E,mFAAmF;oBACnF,qFAAqF;oBACrF,eAAe,CAClB;aACJ;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACxG,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CACzD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACrD,KAAK;gBACL,gBAAgB,EAAE,gBAAgB,IAAI,KAAK,KAAK,SAAS;aAC1D,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;YAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CACT,qFAAqF;oBACnF,uDAAuD,CAC1D,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,IAAI,YAAY,CAAA;YACzC,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAEzF,CAAA;YAED,mFAAmF;YACnF,oFAAoF;YACpF,6EAA6E;YAC7E,EAAE;YACF,yFAAyF;YACzF,2FAA2F;YAC3F,mFAAmF;YACnF,uFAAuF;YACvF,uDAAuD;YACvD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YAEtF,sFAAsF;YACtF,4FAA4F;YAC5F,6FAA6F;YAC7F,6EAA6E;YAC7E,EAAE;YACF,6FAA6F;YAC7F,wFAAwF;YACxF,6EAA6E;YAC7E,sFAAsF;YACtF,EAAE;YACF,0FAA0F;YAC1F,6FAA6F;YAC7F,mDAAmD;YACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CACT,sFAAsF;oBACpF,sFAAsF;oBACtF,6EAA6E,CAChF,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACxD,MAAM;gBACN,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAA;QACtE,CAAC,CAAC,CACL,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,OAAgB,EAAE,MAAe;IACpD,OAAO,UAAU,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,iDAAiD;QAC3E,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE/D,8FAA8F;IAC9F,qGAAqG;IACrG,gGAAgG;IAChG,uDAAuD;IACvD,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAC,MAAM,CACrE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CACjD,CAAA;IAED,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAA;AACnG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,aAAa,CAAC,IAA6B;IAClD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB;QAC3D,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;KAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/tools/register.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAwC,MAAM,aAAa,CAAA;AAmCnF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;AAEnC;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAgB,EAAE,IAAqC;IACnF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,aAAa,cAAc,CAAC,UAAU,CAAC,EAAE,CAAA;AAClD,CAAC;AAED,iGAAiG;AACjG,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAS,EAAE,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,OAAoB;IACnE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IAE1D,kGAAkG;IAClG,+FAA+F;IAC/F,sBAAsB;IACtB,EAAE;IACF,0FAA0F;IAC1F,2FAA2F;IAC3F,iGAAiG;IACjG,2FAA2F;IAC3F,2FAA2F;IAC3F,0FAA0F;IAC1F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAC1D,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAE9D,MAAM,QAAQ,GAAmB,YAAY,CAAC,MAAM,CAClD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,aAAa,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CACnF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAEpE,4FAA4F;IAC5F,EAAE;IACF,qGAAqG;IACrG,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,kDAAkD;IAClD,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,wFAAwF;YACxF,0CAA0C;QAC5C,WAAW,EAAE,EAAE;QACf,yFAAyF;QACzF,iFAAiF;QACjF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KAC1D,EACD,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAC1F,CAAA;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,8BAA8B;YACrC,WAAW,EACT,sFAAsF;gBACtF,wFAAwF;gBACxF,wFAAwF;gBACxF,mDAAmD;YACrD,WAAW,EAAE;gBACX,OAAO,EAAE,CAAC;qBACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;qBACvD,QAAQ,EAAE;qBACV,QAAQ,CAAC,wBAAwB,CAAC;aACtC;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CACpB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;YAC3E,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC5E,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1E,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;YACnD,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;YACE,KAAK,EAAE,eAAe;YACtB,WAAW,EACT,kFAAkF;gBAClF,qFAAqF;gBACrF,qCAAqC;YACvC,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;gBAC7H,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;gBAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;gBAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;gBAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;aAC9E;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACpD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,yFAAyF;YACzF,uFAAuF;YACvF,oFAAoF;YACpF,EAAE;YACF,wFAAwF;YACxF,6FAA6F;YAC7F,wFAAwF;YACxF,uFAAuF;YACvF,2FAA2F;YAC3F,yEAAyE;YACzE,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACjC,OAAO,IAAI,CACT,oFAAoF;oBAClF,yEAAyE,CAC5E,CAAA;YACH,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC/C,OAAO,IAAI,CAAC,qFAAqF,CAAC,CAAA;gBACpG,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,IAAI,CACT,mFAAmF;wBACjF,oFAAoF;wBACpF,sBAAsB,CACzB,CAAA;gBACH,CAAC;gBAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;gBACzD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,KAAK;gBACL,qFAAqF;gBACrF,qCAAqC;gBACrC,cAAc,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAClG,CAAA;gBAED,OAAO,EAAE,CACP,EAAE,GAAI,KAAiC,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAC9E,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAC5B,CAAA;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,IAAI,CACT,mFAAmF;oBACjF,sFAAsF;oBACtF,aAAa,CAChB,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YACrF,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;YACE,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,+EAA+E;gBAC/E,uFAAuF;gBACvF,2CAA2C;YAC7C,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3C,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CACrB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,IAAI,CACT,GAAG,MAAM,CAAC,KAAK,0DAA0D;oBACvE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,WAAW,CACd,CAAA;YACH,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wFAAwF;gBACxF,uFAAuF;gBACvF,0FAA0F;gBAC1F,yFAAyF;gBACzF,yDAAyD;gBACzD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7D,OAAO,IAAI,CACT,GAAG,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,6CAA6C;wBACrF,iCAAiC,CACpC,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CACL,CAAA;QAED,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,6FAA6F;QAC7F,uEAAuE;QACvE,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,6BAA6B;YACpC,WAAW,EACT,yFAAyF;gBACzF,uFAAuF;gBACvF,qFAAqF;gBACrF,mFAAmF;gBACnF,gFAAgF;gBAChF,qFAAqF;gBACrF,qFAAqF;gBACrF,4EAA4E;YAC9E,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,IAAI,EAAE,CACT,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kFAAkF;gBAClF,sFAAsF;gBACtF,qFAAqF;gBACrF,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7D,OAAO,IAAI,CACT,GAAG,MAAM,CAAC,OAAO,+DAA+D;wBAC9E,6EAA6E;wBAC7E,6CAA6C,CAChD,CAAA;gBACH,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;YACE,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,0FAA0F;gBAC1F,yFAAyF;gBACzF,2FAA2F;gBAC3F,gDAAgD;gBAChD,yFAAyF;gBACzF,0FAA0F;gBAC1F,2FAA2F;gBAC3F,+BAA+B;YACjC,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;aACzG;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACxG,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAE9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,qEAAqE,CAAC,CAAA;gBACnG,CAAC;gBAED,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;YACxF,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,kCAAkC,CAAC,CAAA;YAChE,CAAC;YAED,yFAAyF;YACzF,6EAA6E;YAC7E,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,EACnF,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;QACH,CAAC,CAAC,CACL,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;YACE,KAAK,EAAE,kBAAkB;YACzB,WAAW,EACT,mFAAmF;gBACnF,mFAAmF;gBACnF,6DAA6D;YAC/D,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;aACjE;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACvG,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,sFAAsF;YACtF,wFAAwF;YACxF,oCAAoC;YACpC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAA;YAExF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAE9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;YAEjC,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,sCAAsC,CAAC,CAAA;YAEtF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;YACzD,OAAO,EAAE,CAAC,WAAW,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACpE,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;YACE,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,0FAA0F;gBAC1F,sFAAsF;gBACtF,0FAA0F;gBAC1F,oFAAoF;YACtF,WAAW,EAAE;gBACX,KAAK,EAAE,CAAC;qBACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;qBACxC,QAAQ,EAAE;qBACV,QAAQ,CAAC,yDAAyD,CAAC;gBACtE,KAAK,EAAE,CAAC;qBACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;qBACxC,QAAQ,EAAE;qBACV,QAAQ,CACP,sFAAsF;oBACpF,kDAAkD,CACrD;gBACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;aACjH;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACzG,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAChD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC,4DAA4D,CAAC,CAAA;YAC3E,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,EAC/E,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;YACH,CAAC;YAED,OAAO,EAAE,CACP,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;gBACvC,KAAK,EAAE,KAAM,CAAC,GAAG,CAAC,aAAa,CAAC;gBAChC,qBAAqB;aACtB,CAAC,EACF,OAAO,CAAC,WAAW,EAAE,CACtB,CAAA;QACH,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;YACE,KAAK,EAAE,aAAa;YACpB,WAAW,EACT,oFAAoF;gBACpF,sDAAsD;YACxD,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;SACzD,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACxB,KAAK,CAAC,KAAK,IAAI,EAAE,CACf,EAAE,CACA,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC,EAC7E,OAAO,CAAC,WAAW,EAAE,CACtB,CACF,CACJ,CAAA;IACH,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EACT,sFAAsF;gBACtF,wFAAwF;gBACxF,0FAA0F;gBAC1F,qFAAqF;gBACrF,gFAAgF;gBAChF,8EAA8E;gBAC9E,yFAAyF;gBACzF,iDAAiD;YACnD,WAAW,EAAE;gBACX,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;gBAC5D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;gBACxC,KAAK,EAAE,CAAC;qBACL,OAAO,EAAE;qBACT,QAAQ,EAAE;qBACV,QAAQ,CAAC,8EAA8E,CAAC;gBAC3F,0FAA0F;gBAC1F,wFAAwF;gBACxF,0FAA0F;gBAC1F,mFAAmF;gBACnF,2FAA2F;gBAC3F,sFAAsF;gBACtF,8EAA8E;gBAC9E,YAAY,EAAE,CAAC;qBACZ,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;qBACzC,QAAQ,EAAE;qBACV,QAAQ,CACP,wEAAwE;oBACtE,qFAAqF;oBACrF,mFAAmF;oBACnF,2EAA2E;oBAC3E,mFAAmF;oBACnF,qFAAqF;oBACrF,eAAe,CAClB;aACJ;YACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;SACxG,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CACzD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACrD,KAAK;gBACL,gBAAgB,EAAE,gBAAgB,IAAI,KAAK,KAAK,SAAS;aAC1D,CAAC,CAAA;YAEF,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAA;YAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CACT,qFAAqF;oBACnF,uDAAuD,CAC1D,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,IAAI,YAAY,CAAA;YACzC,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAEzF,CAAA;YAED,mFAAmF;YACnF,oFAAoF;YACpF,6EAA6E;YAC7E,EAAE;YACF,yFAAyF;YACzF,2FAA2F;YAC3F,mFAAmF;YACnF,uFAAuF;YACvF,uDAAuD;YACvD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;YAEtF,sFAAsF;YACtF,4FAA4F;YAC5F,6FAA6F;YAC7F,6EAA6E;YAC7E,EAAE;YACF,6FAA6F;YAC7F,wFAAwF;YACxF,6EAA6E;YAC7E,sFAAsF;YACtF,EAAE;YACF,0FAA0F;YAC1F,6FAA6F;YAC7F,mDAAmD;YACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CACT,sFAAsF;oBACpF,sFAAsF;oBACtF,6EAA6E,CAChF,CAAA;YACH,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE;gBACxD,MAAM;gBACN,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAA;QACtE,CAAC,CAAC,CACL,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,OAAgB,EAAE,MAAe;IACpD,OAAO,UAAU,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,iDAAiD;QAC3E,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAA;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAE/D,8FAA8F;IAC9F,qGAAqG;IACrG,gGAAgG;IAChG,uDAAuD;IACvD,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;IAEnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAC,MAAM,CACrE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CACjD,CAAA;IAED,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAA;AACnG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,aAAa,CAAC,IAA6B;IAClD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB;QAC3D,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;KAC9B,CAAA;AACH,CAAC"}

package/dist/tools/whoami.d.ts

@@ -16,6 +16,11 @@ export type WithheldTool = {
     tool: string;
     requires: string;
 };
+/** One entity kind the acting role may not write, and the permission that would allow it. */
+export type WithheldKind = {
+    kind: string;
+    requires: string;
+};
 /**
  * The one genuinely new fact this tool reports.
  *
@@ -27,5 +32,5 @@ export type WithheldTool = {
  * state, and it goes stale the first time a tool moves scope — a failure this codebase has had twice
  * elsewhere, both times in the *reader* rather than the writer.
  */
-export declare function describeSession(session: Session, withheld: readonly WithheldTool[], serverVersion: string): Record<string, unknown>;
+export declare function describeSession(session: Session, withheld: readonly WithheldTool[], serverVersion: string, withheldKinds?: readonly WithheldKind[]): Record<string, unknown>;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/tools/whoami.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;;;;;;GAWG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,aAAa,EAAE,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzB"}
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAE5C;;;;;;;;;;;GAWG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,6FAA6F;AAC7F,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,aAAa,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,YAAY,EAAO,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BzB"}

package/dist/tools/whoami.js

@@ -9,7 +9,7 @@
  * state, and it goes stale the first time a tool moves scope — a failure this codebase has had twice
  * elsewhere, both times in the *reader* rather than the writer.
  */
-export function describeSession(session, withheld, serverVersion) {
+export function describeSession(session, withheld, serverVersion, withheldKinds = []) {
     const { who } = session;
     return {
         organization: { id: who.organizationId, name: who.organizationName, slug: who.organizationSlug },
@@ -24,6 +24,9 @@ export function describeSession(session, withheld, serverVersion) {
         readOnlyForced: session.readOnlyRequested,
         serverVersion,
         withheld,
+        // Kinds `content_write`/`content_delete` will refuse for this role, with the permission each
+        // needs. Separate from `withheld`: those tools stay available, since the key's other kinds work.
+        withheldKinds,
         // The sentence an agent needs *before* it misreads its first empty result. An empty list from
         // this server is always scoped, and saying so is cheaper than the duplicates an agent creates
         // after concluding that nothing exists.

package/dist/tools/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,QAAiC,EACjC,aAAqB;IAErB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAEvB,OAAO;QACL,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,EAAE;QAChG,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,eAAe,EAAE;QACjE,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,gGAAgG;QAChG,4CAA4C;QAC5C,cAAc,EAAE,OAAO,CAAC,iBAAiB;QACzC,aAAa;QACb,QAAQ;QACR,8FAA8F;QAC9F,8FAA8F;QAC9F,wCAAwC;QACxC,IAAI,EACF,4FAA4F;YAC5F,uDAAuD;KAC1D,CAAA;AACH,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/tools/whoami.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,QAAiC,EACjC,aAAqB,EACrB,gBAAyC,EAAE;IAE3C,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IAEvB,OAAO;QACL,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,gBAAgB,EAAE;QAChG,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,eAAe,EAAE;QACjE,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,gGAAgG;QAChG,4CAA4C;QAC5C,cAAc,EAAE,OAAO,CAAC,iBAAiB;QACzC,aAAa;QACb,QAAQ;QACR,6FAA6F;QAC7F,iGAAiG;QACjG,aAAa;QACb,8FAA8F;QAC9F,8FAA8F;QAC9F,wCAAwC;QACxC,IAAI,EACF,4FAA4F;YAC5F,uDAAuD;KAC1D,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ebitex/content-mcp",
-  "version": "0.5.198",
+  "version": "0.5.206",
   "description": "An MCP server for ebitex Content: build and publish a content model from an AI agent.",
   "license": "Apache-2.0",
   "homepage": "https://developers.ebitex.io/getting-started/content-as-code/",