@fjall/ai-tools 3.7.0 → 3.8.1

package/dist/manageDomainCommands.js

@@ -41,7 +41,7 @@ export const MANAGE_DOMAIN_MUTATION_COMMANDS = [
     {
         command: `fjall domain sync ${ZONE_PLACEHOLDER} --fix`,
         purpose: "Delete residue records (the records sync_report classifies 'residue').",
-        ceremony: "Same consent shape: --remediate '<name>/<TYPE>[@<setIdentifier>]'=recreate. 'unknown' rows never appear on the ticket — classification fails closed; exit 4 means nothing was deleted.",
+        ceremony: "Same consent shape: --remediate '<name>/<TYPE>[@<setIdentifier>]'=recreate. 'unknown' rows never appear on the ticket — classification fails closed; exit 4 means nothing was deleted. A delegated child's NS row classifying 'unknown' is cured by setting \"account\" on its fjall-config.json domain entry, not by --fix.",
     },
     {
         command: `fjall domain delegate ${ZONE_PLACEHOLDER}`,

package/dist/registry.js

@@ -40,7 +40,7 @@ export const AI_TOOL_REGISTRY = [
     spec("trigger_deployment", "Trigger a new deployment for an application. Verifies the application exists, has a connected AWS account and repository, and no active deployment is running. Creates a deployment record and enqueues it for processing.", triggerDeploymentSchema, "write", "admin"),
     spec("manage_secret", "Manage application secrets stored in AWS SSM Parameter Store. Supports: list (show secret names without values), set (create or update), and delete. Never exposes secret values — the get operation is intentionally excluded.", manageSecretSchema, "write", "admin"),
     spec("update_configuration", "Update an application's configuration — name, description, or config path. Only safe, non-security-sensitive fields can be changed. At least one field must be provided.", updateConfigurationSchema, "write", "admin"),
-    spec("manage_domain", `Read-only domain management mirroring the CLI domain surface. Operations: list (declared domains with live zone and stack status), records_list (every live record with its ownership classification - declared/satellite/residue/unknown; unknown is never remediable, classification fails closed), sync_report (the same classification as a read-only report - this tool never deletes records), verify (DNS nameserver delegation check), and mutation_commands (the exact ceremony-gated CLI commands for ${MANAGE_DOMAIN_MUTATION_SUMMARY}, which this tool never executes - destructive consent stays with the user).`, manageDomainSchema, "read"),
+    spec("manage_domain", `Read-only domain management mirroring the CLI domain surface. Operations: list (declared domains with live zone and stack status), records_list (every live record with its ownership classification - declared/satellite/residue/unknown; satellite includes a delegated child's domain stack in another AWS account; unknown is never remediable, classification fails closed), sync_report (the same classification as a read-only report - this tool never deletes records), verify (DNS nameserver delegation check), and mutation_commands (the exact ceremony-gated CLI commands for ${MANAGE_DOMAIN_MUTATION_SUMMARY}, which this tool never executes - destructive consent stays with the user).`, manageDomainSchema, "read"),
     spec("provision_region", "Add an AWS region to the organisation and deploy infrastructure to it. Shows a consequence preview (affected accounts, deployment shape) before asking the user to confirm. Requires admin role.", provisionRegionSchema, "write", "admin"),
 ];
 /** Look up a tool spec by name. */

package/dist/schemas/manageDomain.js

@@ -24,8 +24,10 @@ export const manageDomainSchema = z
     ])
         .describe("list: declared domains with live zone/stack status; " +
         "records_list: every live record with its ownership classification " +
-        "(declared/satellite/residue/unknown — unknown is NEVER remediable; " +
-        "classification fails closed); sync_report: the same classification " +
+        "(declared/satellite/residue/unknown; satellite includes a " +
+        "delegated child's domain stack in another AWS account; unknown " +
+        "is NEVER remediable; classification fails closed); " +
+        "sync_report: the same classification " +
         "grouped per class as a read-only report (never deletes anything); " +
         "verify: DNS nameserver delegation check; mutation_commands: the " +
         "exact ceremony-gated CLI commands for the mutations this tool " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/ai-tools",
-  "version": "3.7.0",
+  "version": "3.8.1",
   "description": "Shared AI tool schemas and registry for Fjall webapp and CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -51,5 +51,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "2ee5e51bc6aa45e34ec70160b36ddf976371ccd5"
+  "gitHead": "c15e42f3d2047acbbe086518450c77ae68839e1d"
 }