@nimbus-dev/connectors 0.2.1 → 0.2.2

package/connectors/teams/src/tools.ts

@@ -0,0 +1,283 @@
+import { z } from "zod";
+import type { ConsentServer } from "../../../shared/consent-kit.ts";
+import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import {
+  fetchBearerAuthorizedJson,
+  resolveUrlWithBase,
+} from "../../../shared/fetch-bearer-json.ts";
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  type McpListResult,
+  mcpJsonResultIfOk,
+  requireProcessEnv,
+} from "../../../shared/mcp-tool-kit.ts";
+import { teamsBotSendActivity } from "./bot-send.ts";
+
+const GRAPH = "https://graph.microsoft.com/v1.0";
+
+async function graphRequest(
+  token: string,
+  pathOrUrl: string,
+  init?: RequestInit,
+): Promise<{ ok: boolean; status: number; json: unknown; text: string }> {
+  const url = resolveUrlWithBase(GRAPH, pathOrUrl);
+  return fetchBearerAuthorizedJson(url, token, init);
+}
+
+async function teamsPagedGraph(
+  token: string,
+  nextLink: string | undefined,
+  initialPath: string,
+): Promise<{ ok: boolean; status: number; json: unknown; text: string }> {
+  const path = nextLink !== undefined && nextLink !== "" ? nextLink : initialPath;
+  return graphRequest(token, path);
+}
+
+function graphListResult(r: {
+  ok: boolean;
+  status: number;
+  json: unknown;
+  text: string;
+}): McpListResult {
+  return mcpJsonResultIfOk("Graph", r, 200);
+}
+
+/** POST one message to a Graph `…/messages` collection — a team channel's or a chat's. */
+async function postGraphMessage(
+  token: string,
+  messagesPath: string,
+  content: string,
+  contentType: "text" | "html" = "text",
+): Promise<{ ok: boolean; status: number; json: unknown; text: string }> {
+  return graphRequest(token, messagesPath, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      body: {
+        contentType: contentType === "html" ? "html" : "text",
+        content,
+      },
+    }),
+  });
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const TEAMS_TOOL_NAMES = [
+  "teams_team_list",
+  "teams_channel_list",
+  "teams_channel_messages",
+  "teams_chat_list",
+  "teams_chat_messages",
+  "teams_message_post",
+  "teams_message_post_chat",
+  "teams_user_info",
+  "teams_chat_post",
+] as const;
+
+export function registerTeamsTools(
+  server: ConsentServer & { tool: (...args: never) => unknown },
+): void {
+  const registerSimpleTool = createRegisterSimpleTool(server);
+
+  const reg = createZodToolRegistrar(registerSimpleTool);
+
+  /**
+   * Every MUTATING teams tool goes through here. Outside the gateway this adds the
+   * consent gate, the write-scope allow-list, the mutation budget and the audit record; inside
+   * the gateway it is a pass-through, because executor.ts (I2) is the gate there.
+   */
+  const registerWriteTool = createWriteToolRegistrar(server, {
+    connector: "teams",
+    scopeEnv: "NIMBUS_MCP_TEAMS_WRITE_SCOPE",
+    scopeKinds: ["channel", "chat"],
+  });
+
+  const teamsTeamListSchema = z.object({
+    top: z.number().int().min(1).max(100).optional(),
+    nextLink: z.url().optional(),
+  });
+
+  reg(
+    "teams_team_list",
+    "List Microsoft Teams the signed-in user has joined (pagination via nextLink).",
+    teamsTeamListSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const initial = `/me/joinedTeams?$top=${String(parsed.top ?? 50)}`;
+      const r = await teamsPagedGraph(token, parsed.nextLink, initial);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsChannelListSchema = z.object({
+    teamId: z.string().min(1),
+    top: z.number().int().min(1).max(100).optional(),
+    nextLink: z.url().optional(),
+  });
+
+  reg(
+    "teams_channel_list",
+    "List channels in a team (standard + private the app can read).",
+    teamsChannelListSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const tid = encodeURIComponent(parsed.teamId);
+      const initial = `/teams/${tid}/channels?$top=${String(parsed.top ?? 50)}`;
+      const r = await teamsPagedGraph(token, parsed.nextLink, initial);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsChannelMessagesSchema = z.object({
+    teamId: z.string().min(1),
+    channelId: z.string().min(1),
+    top: z.number().int().min(1).max(50).optional(),
+    nextLink: z.url().optional(),
+  });
+
+  reg(
+    "teams_channel_messages",
+    "List recent messages in a team channel (not delta; for interactive reads).",
+    teamsChannelMessagesSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const tid = encodeURIComponent(parsed.teamId);
+      const cid = encodeURIComponent(parsed.channelId);
+      const initial = `/teams/${tid}/channels/${cid}/messages?$top=${String(parsed.top ?? 25)}`;
+      const r = await teamsPagedGraph(token, parsed.nextLink, initial);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsChatListSchema = z.object({
+    top: z.number().int().min(1).max(50).optional(),
+    nextLink: z.url().optional(),
+  });
+
+  reg(
+    "teams_chat_list",
+    "List 1:1 and group chats for the signed-in user.",
+    teamsChatListSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const initial = `/me/chats?$top=${String(parsed.top ?? 25)}`;
+      const r = await teamsPagedGraph(token, parsed.nextLink, initial);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsChatMessagesSchema = z.object({
+    chatId: z.string().min(1),
+    top: z.number().int().min(1).max(50).optional(),
+    nextLink: z.url().optional(),
+  });
+
+  reg(
+    "teams_chat_messages",
+    "List messages in a chat.",
+    teamsChatMessagesSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const id = encodeURIComponent(parsed.chatId);
+      const initial = `/chats/${id}/messages?$top=${String(parsed.top ?? 25)}`;
+      const r = await teamsPagedGraph(token, parsed.nextLink, initial);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsMessagePostSchema = z.object({
+    teamId: z.string().min(1),
+    channelId: z.string().min(1),
+    body: z.string().min(1),
+    contentType: z.enum(["text", "html"]).optional(),
+  });
+
+  registerWriteTool(
+    "teams_message_post",
+    {
+      mutates: "teams.message.post",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "channel", value: `${p.teamId}/${p.channelId}` }),
+    },
+    "Post a message to a team channel.",
+    teamsMessagePostSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const tid = encodeURIComponent(parsed.teamId);
+      const cid = encodeURIComponent(parsed.channelId);
+      const path = `/teams/${tid}/channels/${cid}/messages`;
+      const r = await postGraphMessage(token, path, parsed.body, parsed.contentType);
+      return graphListResult(r);
+    },
+  );
+
+  const teamsMessagePostChatSchema = z.object({
+    chatId: z.string().min(1),
+    body: z.string().min(1),
+    contentType: z.enum(["text", "html"]).optional(),
+  });
+
+  // A WRITE: it posts a message. It was registered as a read, which in standalone mode offered it
+  // to every client with no consent prompt, scope check, budget or audit record.
+  registerWriteTool(
+    "teams_message_post_chat",
+    {
+      mutates: "teams.message.postChat",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "chat", value: p.chatId }),
+    },
+    "Post a message to a chat.",
+    teamsMessagePostChatSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const id = encodeURIComponent(parsed.chatId);
+      const r = await postGraphMessage(
+        token,
+        `/chats/${id}/messages`,
+        parsed.body,
+        parsed.contentType,
+      );
+      return graphListResult(r);
+    },
+  );
+
+  // --- ChatOps operational tools (Slice 5) -------------------------------------------------------
+  // `teams_chat_post` uses bot app credentials (Bot Framework), distinct from the user Graph token.
+  // Only `chatops/reply-dispatcher.ts` + `chatops/transport/` reference `teams_chat_post` (static D17).
+
+  const teamsUserInfoSchema = z.object({ userId: z.string().min(1) });
+  reg(
+    "teams_user_info",
+    "Fetch a Teams/AAD user (incl. mail/userPrincipalName) by id (ChatOps identity mapping).",
+    teamsUserInfoSchema,
+    async (parsed) => {
+      const token = requireProcessEnv("MICROSOFT_OAUTH_ACCESS_TOKEN");
+      const r = await teamsPagedGraph(
+        token,
+        undefined,
+        `/users/${encodeURIComponent(parsed.userId)}`,
+      );
+      return graphListResult(r);
+    },
+  );
+
+  const teamsChatPostSchema = z.object({
+    conversationId: z.string().min(1),
+    text: z.string().min(1),
+  });
+  registerWriteTool(
+    "teams_chat_post",
+    {
+      mutates: "teams.chat.post",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "chat", value: p.conversationId }),
+    },
+    "Post an operational bot message to a Teams conversation (ChatOps reply surface; bot app creds).",
+    teamsChatPostSchema,
+    async (parsed) => {
+      const r = await teamsBotSendActivity(parsed.conversationId, parsed.text);
+      return graphListResult(r);
+    },
+  );
+}

package/connectors/testflight/src/server.ts

@@ -1,74 +1,6 @@
-import { signAppStoreConnectJwt } from "@nimbus-dev/sdk";
-import { z } from "zod";
-import { matchesResult } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { jwtParamsFromEnv } from "./jwt.ts";
-import { filterTestflightBuilds } from "./search-filter.ts";
-
-const APPSTORECONNECT_API = "https://api.appstoreconnect.apple.com";
-
-function authHeader(): Record<string, string> {
-  const token = signAppStoreConnectJwt(jwtParamsFromEnv());
-  return { Authorization: `Bearer ${token}`, Accept: "application/json" };
-}
-
-async function appstoreGet(path: string): Promise<unknown> {
-  const res = await fetch(`${APPSTORECONNECT_API}${path}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`App Store Connect ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
-
-function buildsPath(appId: string, limit: number): string {
-  return `/v1/builds?filter[app]=${encodeURIComponent(appId)}&sort=-uploadedDate&limit=${String(limit)}`;
-}
+import { registerTestflightTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-testflight", (reg) => {
-  reg(
-    "testflight_list",
-    "List TestFlight resources via the App Store Connect API. When `appId` is omitted, returns the user's accessible apps via `GET /v1/apps`. When `appId` is provided, returns that app's most-recent builds via `GET /v1/builds?filter[app]=<id>&sort=-uploadedDate` (limit optional).",
-    z.object({
-      appId: z.string().min(1).optional(),
-      limit: z.number().int().min(1).max(200).optional(),
-    }),
-    async (p) => {
-      if (p.appId === undefined) {
-        return jsonResult(await appstoreGet("/v1/apps"));
-      }
-      return jsonResult(await appstoreGet(buildsPath(p.appId, p.limit ?? 50)));
-    },
-  );
-
-  reg(
-    "testflight_get",
-    "Fetch a single TestFlight resource. When `buildId` is provided, returns the build via `GET /v1/builds/<buildId>`. When omitted, returns the app via `GET /v1/apps/<appId>`.",
-    z.object({
-      appId: z.string().min(1),
-      buildId: z.string().min(1).optional(),
-    }),
-    async (p) => {
-      if (p.buildId === undefined) {
-        return jsonResult(await appstoreGet(`/v1/apps/${encodeURIComponent(p.appId)}`));
-      }
-      return jsonResult(await appstoreGet(`/v1/builds/${encodeURIComponent(p.buildId)}`));
-    },
-  );
-
-  reg(
-    "testflight_search",
-    "Substring search across a TestFlight app's recent builds. Matches the query against each build's `version`, `processingState`, `minOsVersion`, and `id` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    z.object({
-      appId: z.string().min(1),
-      query: z.string().min(1),
-      limit: z.number().int().min(1).max(200).optional(),
-    }),
-    async (p) => {
-      const root = await appstoreGet(buildsPath(p.appId, 200));
-      const data = (root as { data?: unknown[] } | null)?.data;
-      return matchesResult(data, filterTestflightBuilds, p);
-    },
-  );
+  registerTestflightTools(reg);
 });

package/connectors/testflight/src/tools.ts

@@ -0,0 +1,79 @@
+import { signAppStoreConnectJwt } from "@nimbus-dev/sdk";
+import { z } from "zod";
+import { createJsonGetter } from "../../../shared/env-json-api.ts";
+import { matchesResult } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { jwtParamsFromEnv } from "./jwt.ts";
+import { filterTestflightBuilds } from "./search-filter.ts";
+
+const APPSTORECONNECT_API = "https://api.appstoreconnect.apple.com";
+
+function authHeader(): Record<string, string> {
+  const token = signAppStoreConnectJwt(jwtParamsFromEnv());
+  return { Authorization: `Bearer ${token}`, Accept: "application/json" };
+}
+
+const appstoreGet = createJsonGetter({
+  base: APPSTORECONNECT_API,
+  label: "App Store Connect",
+  headers: authHeader,
+});
+
+function buildsPath(appId: string, limit: number): string {
+  return `/v1/builds?filter[app]=${encodeURIComponent(appId)}&sort=-uploadedDate&limit=${String(limit)}`;
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const TESTFLIGHT_TOOL_NAMES = [
+  "testflight_list",
+  "testflight_get",
+  "testflight_search",
+] as const;
+
+export function registerTestflightTools(reg: ZodToolRegistrar): void {
+  reg(
+    "testflight_list",
+    "List TestFlight resources via the App Store Connect API. When `appId` is omitted, returns the user's accessible apps via `GET /v1/apps`. When `appId` is provided, returns that app's most-recent builds via `GET /v1/builds?filter[app]=<id>&sort=-uploadedDate` (limit optional).",
+    z.object({
+      appId: z.string().min(1).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      if (p.appId === undefined) {
+        return jsonResult(await appstoreGet("/v1/apps"));
+      }
+      return jsonResult(await appstoreGet(buildsPath(p.appId, p.limit ?? 50)));
+    },
+  );
+
+  reg(
+    "testflight_get",
+    "Fetch a single TestFlight resource. When `buildId` is provided, returns the build via `GET /v1/builds/<buildId>`. When omitted, returns the app via `GET /v1/apps/<appId>`.",
+    z.object({
+      appId: z.string().min(1),
+      buildId: z.string().min(1).optional(),
+    }),
+    async (p) => {
+      if (p.buildId === undefined) {
+        return jsonResult(await appstoreGet(`/v1/apps/${encodeURIComponent(p.appId)}`));
+      }
+      return jsonResult(await appstoreGet(`/v1/builds/${encodeURIComponent(p.buildId)}`));
+    },
+  );
+
+  reg(
+    "testflight_search",
+    "Substring search across a TestFlight app's recent builds. Matches the query against each build's `version`, `processingState`, `minOsVersion`, and `id` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      appId: z.string().min(1),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      const root = await appstoreGet(buildsPath(p.appId, 200));
+      const data = (root as { data?: unknown[] } | null)?.data;
+      return matchesResult(data, filterTestflightBuilds, p);
+    },
+  );
+}

package/connectors/vercel/src/search-filter.ts

@@ -1,21 +1,13 @@
 import {
   asObjectish,
   makeQueryFilter,
+  nestedString,
   type SearchMatchOptions,
   stringField,
 } from "../../../shared/search-filter.ts";
 
 export type VercelSearchMatchOptions = SearchMatchOptions;
 
-function commitMessage(row: Record<string, unknown>): string {
-  const meta = row["meta"];
-  if (meta === null || typeof meta !== "object" || Array.isArray(meta)) {
-    return "";
-  }
-  const v = (meta as Record<string, unknown>)["githubCommitMessage"];
-  return typeof v === "string" ? v : "";
-}
-
 function fieldsOf(item: unknown): readonly string[] | null {
   const row = asObjectish(item);
   if (row === undefined) {
@@ -27,7 +19,7 @@ function fieldsOf(item: unknown): readonly string[] | null {
     stringField(row, "state"),
     stringField(row, "target"),
     stringField(row, "url"),
-    commitMessage(row),
+    nestedString(row, ["meta", "githubCommitMessage"]),
   ];
 }
 

package/connectors/vercel/src/server.ts

@@ -1,79 +1,6 @@
-import { z } from "zod";
-import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
-import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
-import { filterVercelDeployments } from "./search-filter.ts";
-
-const BASE = "https://api.vercel.com";
-
-function token(): string {
-  const t = process.env["VERCEL_TOKEN"]?.trim();
-  if (t === undefined || t === "") {
-    throw new Error("VERCEL_TOKEN is not set");
-  }
-  return t;
-}
-
-function teamId(): string | undefined {
-  const v = process.env["VERCEL_TEAM_ID"]?.trim();
-  return v === undefined || v === "" ? undefined : v;
-}
-
-function authHeader(): Record<string, string> {
-  return { Authorization: `Bearer ${token()}`, Accept: "application/json" };
-}
-
-function withTeam(path: string): string {
-  const team = teamId();
-  if (team === undefined) {
-    return path;
-  }
-  const sep = path.includes("?") ? "&" : "?";
-  return `${path}${sep}teamId=${encodeURIComponent(team)}`;
-}
-
-async function vercelGet(path: string): Promise<unknown> {
-  const res = await fetch(`${BASE}${withTeam(path)}`, { headers: authHeader() });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Vercel ${String(res.status)}: ${text.slice(0, 400)}`);
-  }
-  return JSON.parse(text) as unknown;
-}
+import { registerVercelTools } from "./tools.ts";
 
 await runReadOnlyMcpConnector("nimbus-vercel", (reg) => {
-  reg(
-    "vercel_list",
-    "List recent Vercel deployments (`GET /v6/deployments`), most-recent-first, capped at `limit` (default 100). Returns the `{ deployments, pagination }` envelope.",
-    z.object({
-      limit: z.number().int().min(1).max(100).optional(),
-    }),
-    async (p) => {
-      const search = new URLSearchParams({ limit: String(p.limit ?? 100) });
-      return jsonResult(await vercelGet(`/v6/deployments?${search.toString()}`));
-    },
-  );
-
-  reg(
-    "vercel_get",
-    "Fetch one Vercel deployment by its id or *.vercel.app URL (`GET /v13/deployments/{idOrUrl}`). Returns the deployment object directly. Throws when no match is found.",
-    z.object({
-      idOrUrl: z.string().min(1),
-    }),
-    async (p) => {
-      return jsonResult(await vercelGet(`/v13/deployments/${encodeURIComponent(p.idOrUrl)}`));
-    },
-  );
-
-  reg(
-    "vercel_search",
-    "Substring search across recent Vercel deployments. Matches the query against uid, project name, state, target, the *.vercel.app host, and the git commit message (case-insensitive). Returns a `{ matches: [...] }` envelope.",
-    searchToolInputSchema(100),
-    async (p) => {
-      const search = new URLSearchParams({ limit: "100" });
-      const root = await vercelGet(`/v6/deployments?${search.toString()}`);
-      const deployments = (root as { deployments?: unknown[] } | null)?.deployments;
-      return matchesResult(deployments, filterVercelDeployments, p);
-    },
-  );
+  registerVercelTools(reg);
 });

package/connectors/vercel/src/tools.ts

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { createJsonGetter, envAuthHeaders } from "../../../shared/env-json-api.ts";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterVercelDeployments } from "./search-filter.ts";
+
+const BASE = "https://api.vercel.com";
+
+function teamId(): string | undefined {
+  const v = process.env["VERCEL_TEAM_ID"]?.trim();
+  return v === undefined || v === "" ? undefined : v;
+}
+
+function withTeam(path: string): string {
+  const team = teamId();
+  if (team === undefined) {
+    return path;
+  }
+  const sep = path.includes("?") ? "&" : "?";
+  return `${path}${sep}teamId=${encodeURIComponent(team)}`;
+}
+
+const getJson = createJsonGetter({
+  base: BASE,
+  label: "Vercel",
+  headers: envAuthHeaders({ env: "VERCEL_TOKEN" }),
+});
+
+/** Every request is scoped to `VERCEL_TEAM_ID` when one is configured. */
+async function vercelGet(path: string): Promise<unknown> {
+  return getJson(withTeam(path));
+}
+
+/** Tool names exposed by this connector — for contract/introspection tests. */
+export const VERCEL_TOOL_NAMES = ["vercel_get", "vercel_list", "vercel_search"] as const;
+
+export function registerVercelTools(reg: ZodToolRegistrar): void {
+  reg(
+    "vercel_list",
+    "List recent Vercel deployments (`GET /v6/deployments`), most-recent-first, capped at `limit` (default 100). Returns the `{ deployments, pagination }` envelope.",
+    z.object({
+      limit: z.number().int().min(1).max(100).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ limit: String(p.limit ?? 100) });
+      return jsonResult(await vercelGet(`/v6/deployments?${search.toString()}`));
+    },
+  );
+
+  reg(
+    "vercel_get",
+    "Fetch one Vercel deployment by its id or *.vercel.app URL (`GET /v13/deployments/{idOrUrl}`). Returns the deployment object directly. Throws when no match is found.",
+    z.object({
+      idOrUrl: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await vercelGet(`/v13/deployments/${encodeURIComponent(p.idOrUrl)}`));
+    },
+  );
+
+  reg(
+    "vercel_search",
+    "Substring search across recent Vercel deployments. Matches the query against uid, project name, state, target, the *.vercel.app host, and the git commit message (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const search = new URLSearchParams({ limit: "100" });
+      const root = await vercelGet(`/v6/deployments?${search.toString()}`);
+      const deployments = (root as { deployments?: unknown[] } | null)?.deployments;
+      return matchesResult(deployments, filterVercelDeployments, p);
+    },
+  );
+}