@fjall/ai-tools 2.34.0 → 3.0.0

package/dist/registry.js

@@ -38,7 +38,7 @@ export const AI_TOOL_REGISTRY = [
     spec("trigger_deployment", "Trigger a new deployment for an application. Verifies the application exists, has a connected AWS account and repository, and no active deployment is running. Creates a deployment record and enqueues it for processing.", triggerDeploymentSchema, "write", "admin"),
     spec("manage_secret", "Manage application secrets stored in AWS SSM Parameter Store. Supports: list (show secret names without values), set (create or update), and delete. Never exposes secret values — the get operation is intentionally excluded.", manageSecretSchema, "write", "admin"),
     spec("update_configuration", "Update an application's configuration — name, description, or config path. Only safe, non-security-sensitive fields can be changed. At least one field must be provided.", updateConfigurationSchema, "write", "admin"),
-    spec("manage_domain", "Manage custom domains for your applications. Currently supports listing connected environments/accounts. Add and remove operations direct users to the settings page for manual configuration.", manageDomainSchema, "read"),
+    spec("manage_domain", "Read-only domain management mirroring the CLI domain surface. Operations: list (declared domains with live zone and stack status), records_list (every live record with its ownership classification — declared/satellite/residue/unknown; unknown is never remediable, classification fails closed), sync_report (the same classification as a read-only report — this tool never deletes records), verify (DNS nameserver delegation check), and mutation_commands (the exact ceremony-gated CLI commands for deploy/sync --fix/destroy/delegate, which this tool never executes — destructive consent stays with the user).", manageDomainSchema, "read"),
     spec("provision_region", "Add an AWS region to the organisation and deploy infrastructure to it. Shows a consequence preview (affected accounts, deployment shape) before asking the user to confirm. Requires admin role.", provisionRegionSchema, "write", "admin"),
 ];
 /** Look up a tool spec by name. */

package/dist/schemas/manageDomain.d.ts

@@ -1,9 +1,25 @@
 import { z } from "zod";
+/**
+ * READ + SAFE surface only — mirrors the CLI agent surface's domain read
+ * verbs (`fjall domain list`, `fjall domain records list <zone>`,
+ * `fjall domain sync <zone>` report mode, `fjall domain verify <domain>`).
+ *
+ * Mutations are deliberately absent from the operation vocabulary: the
+ * destruction ceremony (named per-row consent, exit 4 = DESTRUCTION_WITHHELD)
+ * lives on the CLI surface, and an AI tool must never hold that consent
+ * power. `mutation_commands` returns the exact ceremony-gated CLI commands
+ * instead — the executor's counterpart of the CLI's exit-4 help text.
+ */
 export declare const manageDomainSchema: z.ZodObject<{
     operation: z.ZodEnum<{
         list: "list";
+        records_list: "records_list";
+        sync_report: "sync_report";
+        verify: "verify";
+        mutation_commands: "mutation_commands";
         add: "add";
         remove: "remove";
     }>;
+    domain: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ManageDomainInput = z.infer<typeof manageDomainSchema>;

package/dist/schemas/manageDomain.js

@@ -1,8 +1,48 @@
 import { z } from "zod";
+/**
+ * READ + SAFE surface only — mirrors the CLI agent surface's domain read
+ * verbs (`fjall domain list`, `fjall domain records list <zone>`,
+ * `fjall domain sync <zone>` report mode, `fjall domain verify <domain>`).
+ *
+ * Mutations are deliberately absent from the operation vocabulary: the
+ * destruction ceremony (named per-row consent, exit 4 = DESTRUCTION_WITHHELD)
+ * lives on the CLI surface, and an AI tool must never hold that consent
+ * power. `mutation_commands` returns the exact ceremony-gated CLI commands
+ * instead — the executor's counterpart of the CLI's exit-4 help text.
+ */
 export const manageDomainSchema = z
     .object({
     operation: z
-        .enum(["list", "add", "remove"])
-        .describe("list: show configured environments/accounts; add/remove: redirects to settings page"),
+        .enum([
+        "list",
+        "records_list",
+        "sync_report",
+        "verify",
+        "mutation_commands",
+        "add",
+        "remove",
+    ])
+        .describe("list: declared domains with live zone/stack status; " +
+        "records_list: every live record with its ownership classification " +
+        "(declared/satellite/residue/unknown — unknown is NEVER remediable; " +
+        "classification fails closed); sync_report: the same classification " +
+        "grouped per class as a read-only report (never deletes anything); " +
+        "verify: DNS nameserver delegation check; mutation_commands: the " +
+        "exact ceremony-gated CLI commands for the mutations this tool " +
+        "never performs. add/remove are deprecated aliases of " +
+        "mutation_commands."),
+    domain: z
+        .string()
+        .min(1)
+        .max(253)
+        .optional()
+        .describe("Domain (hosted zone) name — required for records_list, sync_report, " +
+        "and verify; optional context for mutation_commands"),
 })
-    .strict();
+    .strict()
+    .refine((data) => !((data.operation === "records_list" ||
+    data.operation === "sync_report" ||
+    data.operation === "verify") &&
+    data.domain === undefined), {
+    message: "domain is required for records_list, sync_report, and verify operations",
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/ai-tools",
-  "version": "2.34.0",
+  "version": "3.0.0",
   "description": "Shared AI tool schemas and registry for Fjall webapp and CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -51,5 +51,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "8c553fca8f9737d445061ea75cf6c6c7db0d24c9"
+  "gitHead": "848a386e3e2244401b76faabd02818c682d231e8"
 }