@open-everywhere/core 0.1.0

package/dist/agent/ops/server.js

@@ -0,0 +1,414 @@
+// The ops / quickstart MCP server — the OUTSIDE-IN plane that stands an OpenEverywhere
+// instance up (vs agent/control/, which manages a RUNNING instance). Ships with the
+// repo: registered in the project .mcp.json + a quickstart-open-everywhere skill in
+// .claude/skills/, so an adopter clones, boots their agent in the checkout, and says
+// what they want; the agent uses these tools + the skill to go zero → running.
+//
+// Deterministic, checkable actions live here (preflight checks, scaffold config, the
+// tailored plan); the procedural runbook (provision Neon/Vercel, deploy) lives in the
+// skill and is run by the agent's own shell WITH the user's consent — the ops server
+// never executes infra blindly. Local OS trust (it's the operator's machine), no auth.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { join, resolve, dirname, basename } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { quickstartPlan, mergeEnv, credentialKeyStatus, CREDENTIAL_KEY_ENV_NAME, CREDENTIAL_KEY_BYTES } from "./quickstart.js";
+import { preflightAsync } from "./probes.js";
+import { registeredDeploymentIdentity, deploymentOrg } from "../identity/deployment-identity.js";
+import { DEPLOY_HOST_PLACEHOLDER, normalizeDeployHost, surfaceAppManifest, surfaceAppManifestSurfaces } from "./surface-manifest.js";
+// SECRETS (OPE-408 phase 1): `secret_set` / `secret_list` / `secret_rm` are the MCP skin over
+// agent/credentials/operator-secrets.ts — the SAME functions the `oe secret` CLI calls, so there is
+// one implementation and two doors. They are here, on the OUTSIDE-IN plane, and deliberately NOT on
+// the control plane: this server runs as a local process under the operator's own environment
+// (DATABASE_URL + OE_CREDENTIAL_ENCRYPTION_KEY), which is the whole trust root — so an operator-side
+// agent can provision a deployment that has no comm surface configured yet, and the DEPLOYED agent
+// never holds a secret verb. Write-only, absolutely: there is no `secret_get`, and `secret_list`
+// returns names + provenance only.
+export const OPS_TOOL_NAMES = [
+    "preflight",
+    "quickstart",
+    "surface_manifest",
+    "scaffold_env",
+    "scaffold_credential_key",
+    "secret_set",
+    "secret_list",
+    "secret_rm",
+];
+// The adopter's project (where they launched their agent), not the plugin dir.
+function projectDir() {
+    return resolve(process.env.CLAUDE_PROJECT_DIR ?? process.cwd());
+}
+/** The env file a call names, RESOLVED — `..` segments and a relative path are normalised here, so
+ *  every later check sees one canonical path rather than the string the caller typed. */
+function envFilePath(path) {
+    return path === undefined ? join(projectDir(), ".env.local") : resolve(projectDir(), path);
+}
+// 🔴 THE ONE GATE EVERY WRITE IN THIS SERVER PASSES (OPE-973).
+//
+// Both writing tools take a caller-supplied `path` and hand it to `writeFileSync`. Without this
+// gate, `{ path: ".env.example" }` merges live secrets into a TRACKED file of a repository headed
+// for open source, and `{ path: "../elsewhere/.env" }` writes them outside the project entirely.
+// Nothing downstream catches either: this repository runs no secret scanner, and the runbook tells
+// the agent to open pull requests.
+//
+// Two conditions, and the first is why a prefix test is the wrong shape. `.gitignore` ignores
+// `.env*` and then NEGATES `.env.example` and `.env.e2e.example` back into the tree, so "the name
+// starts with .env" is not the same question as "git ignores it". The names are ENUMERATED, and
+// they are exactly the `.gitignore` rules that carry no negation.
+//
+// SCOPE: writes only. A read here returns a status, never a value — `preflight` reports `set` or
+// `missing` and nothing else — so an unconfined read leaks nothing, while an unconfined write puts
+// key material where it must never be. Confining the reads too would cost the `envPath` override
+// its purpose without closing anything.
+const WRITABLE_ENV_NAMES = /^\.env$|^\.env\.local$|^\.env\..+\.local$/;
+/** Why this target may not be written, or `undefined` when it may. */
+function envTargetRefusal(file) {
+    const dir = dirname(file);
+    if (dir !== projectDir()) {
+        return `refusing to write to "${file}" — it resolves outside the project root (${projectDir()}). The target must sit at the project root.`;
+    }
+    const base = basename(file);
+    if (!WRITABLE_ENV_NAMES.test(base)) {
+        return (`refusing to write to "${base}" — the target must be .env, .env.local or .env.<name>.local, the names this repository never ` +
+            "tracks. A .env.example (or any other name) is a TRACKED file.");
+    }
+    return undefined;
+}
+/** Parse a .env file into a record (KEY=VALUE; comments/blanks skipped). */
+function loadEnvFile(path) {
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    for (const line of readFileSync(path, "utf-8").split("\n")) {
+        const m = /^\s*([A-Z0-9_]+)=(.*)$/.exec(line);
+        if (m)
+            out[m[1]] = m[2];
+    }
+    return out;
+}
+/** The env preflight/plan should see: the project's .env.local OVER the process env. */
+function mergedEnv(path) {
+    return { ...process.env, ...loadEnvFile(envFilePath(path)) };
+}
+function json(data) {
+    return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+// 🔴 THE SECRET TOOLS MAY NOT INFER A TENANT THIS PROCESS NEVER LEARNED (OPE-1956).
+//
+// `secret_set` promises its `org` defaults to "the org this deployment declares in
+// agent/identity/surfaces.ts". That file is APP tier, so a CORE module never imports it — this
+// server included. Only the boot that loads it puts the declaration in the process registry, which
+// is what `registeredDeploymentIdentity()` reads:
+//
+//   scripts/ops-mcp.ts            (the shipped `.mcp.json` entry) imports it ⇒ declared, promise holds.
+//   packages/core/scripts/ops-mcp.ts (`npm run ops`, core-only dev)  does not ⇒ the promise fails.
+//
+// On that second entry `deploymentOrg()` answered the shipped "default" and every secret row landed
+// under a tenant the running agent never queries — SILENTLY, with an `ok: true` reply. A wrong
+// partition is worse than a refusal here, because nothing downstream reads the rows to notice.
+//
+// Two ways out, and both keep the tools usable: name the tenant on the call (`org`), or run the
+// entry that loads the declaration. An app boot that declares NOTHING still registers the record,
+// so a genuinely "default" deployment is not refused — the question is whether the declaration was
+// LOADED, never what it says.
+//
+// 🔴 THE ANSWER IS TAKEN AT BOOT, AND THAT IS LOAD-BEARING. A later `org`-named call DOES register
+// a tenant: `connectStore` runs `declareOperatorOrg(org)`, which calls `registerDeploymentIdentity`
+// (scripts/operator-store-connect.ts), and that registration is sticky for the process. Reading the
+// registry per call would therefore disarm this guard after the first `org`-named call — on the
+// core entry, `secret_set { org: "acme" }` followed by a bare `secret_rm { name }` would delete
+// from "acme" with no refusal and no tenant named anywhere. So `buildOpsServer` captures the answer
+// ONCE, before any tool can run, and the captured value means exactly what the prose says: did an
+// APP BOOT declare an identity?
+const CORE_ENTRY_ORG_REFUSAL = 'refusing to resolve the default org: this process never loaded the deployment\'s declared identity (agent/identity/surfaces.ts), so the org would silently be the shipped "default" — and rows written under the wrong tenant are invisible to the running agent. Run the shipped ops entry instead (the "open-everywhere-ops" server in .mcp.json, `npx tsx scripts/ops-mcp.ts`), which loads it, or name the tenant explicitly with `org`.';
+/**
+ * The org a secret call's rows are REALLY keyed by. `operator-secrets.ts` keys them by the RAW
+ * `opts.org ?? deploymentOrg()`, so an echo taken from `deploymentOrg()` would name a DIFFERENT
+ * tenant whenever `seg()` would change the caller's spelling: `{ org: "Acme Corp" }` writes rows
+ * under "Acme Corp" while `deploymentOrg()` answers "Acme-Corp". An operator confirming the
+ * partition from the echo would confirm a tenant that holds no rows — this PR's own defect class.
+ * The truthiness test is the one each call site applies (`a.org ? { org: a.org } : {}`), so an
+ * empty string falls through to the declared org here exactly as it does there.
+ */
+function actingOrg(org) {
+    return org ? org : deploymentOrg();
+}
+/** What every secret tool's `org` input promises — one spelling, so no tool states a weaker rule. */
+const ORG_INPUT_DESCRIPTION = 'the org the rows are keyed by. The default is the org this deployment declares in agent/identity/surfaces.ts. A process that never LOADED that declaration at boot (the core-only `npm run ops` entry) has no default: the call is refused rather than keyed under the shipped "default". Every reply echoes the org it acted on.';
+export function buildOpsServer(deps = {}) {
+    const server = new McpServer({ name: "open-everywhere-ops", version: "0.1.0" });
+    // 🔴 CAPTURED AT BOOT, NEVER PER CALL — see CORE_ENTRY_ORG_REFUSAL above for why a per-call read
+    // disarms itself. The app-tier entry's side-effect import of `agent/identity/surfaces.ts` is
+    // evaluated before this function runs, so the capture sees it.
+    const identityDeclaredAtBoot = registeredDeploymentIdentity() !== undefined;
+    /** Why this call may not resolve the DEFAULT org, or `undefined` when it may. */
+    const defaultOrgRefusal = (org) => {
+        // 🔴 TRUTHINESS, NOT `!== undefined`. `{ org: "" }` NAMES no tenant: every call site below
+        // passes the value only when truthy (`a.org ? { org: a.org } : {}`) and `declareOperatorOrg`
+        // no-ops on a blank string, so an empty `org` resolves to the shipped "default" exactly as an
+        // absent one does. An `!== undefined` test let that call skip the refusal and key rows under
+        // "default" on the core entry — the precise outcome this guard exists to prevent. The test is
+        // now the same one `actingOrg` and the call sites apply, so the three cannot disagree.
+        if (org)
+            return undefined; // the CALL names the tenant — nothing is inferred
+        return identityDeclaredAtBoot ? undefined : CORE_ENTRY_ORG_REFUSAL;
+    };
+    const connectStore = deps.connectStore ??
+        (async (envPath, org) => {
+            const mod = await import("../../scripts/operator-store-connect.js");
+            // The MCP server is started by an agent and inherits neither the operator's shell nor their
+            // .env.local — so the root-of-trust ALLOWLIST (and nothing else) is lifted in first.
+            mod.loadRootOfTrustEnv(envPath);
+            // 🔴 DECLARE THE TENANT BEFORE THE STORE OPENS (OPE-1587). `connectOperatorStore()` runs
+            // `initOperationalSchema`, which files an `audit.integrity` row through `deploymentOrg()`.
+            // This server is a core module, so it never loads the app's `agent/identity/surfaces.ts`
+            // itself: on the CORE entry `deploymentOrg()` answers the shipped "default" until this line
+            // runs, while on the shipped app-tier entry that entry's own import already declared the org
+            // before this server was built. Connect first and, on
+            // a deployment declared as another tenant, that row WOULD land in a partition the running
+            // agent never queries — while the tool went on to write its rows under the org the CALL
+            // named. The declaration belongs in this closure rather than at each tool, so a tool added
+            // later cannot forget it. An absent `org` leaves the register alone, so a "default"
+            // deployment behaves exactly as before.
+            mod.declareOperatorOrg(org);
+            return await mod.connectOperatorStore();
+        });
+    server.registerTool("preflight", {
+        title: "Preflight check",
+        description: "Check the prerequisites for running/deploying Open Everywhere (node, model key, providers, durable DB, control-plane auth), plus the LIVE posture of each configured provider that registers a probe (a check env alone cannot answer, so it asks the vendor). Reads the project's .env.local. Read-only — reports what's set and how to fix what's missing.",
+        inputSchema: { envPath: z.string().optional() },
+    }, async (a) => json(await preflightAsync(mergedEnv(a.envPath))));
+    server.registerTool("quickstart", {
+        title: "Quickstart plan",
+        description: "Return the tailored, ordered zero→running plan for a goal, with each step marked done/todo from the current config. goal=local (eve dev), slack/github (add a surface), or deploy (hosted Vercel + Neon). Follow the steps — running commands with the user's consent (see the quickstart-open-everywhere skill).",
+        inputSchema: { goal: z.enum(["local", "slack", "github", "deploy"]).default("local"), envPath: z.string().optional() },
+    }, (a) => json(quickstartPlan(a.goal, mergedEnv(a.envPath))));
+    // THE STEP THAT STAYS HUMAN, HANDED OVER PROPERLY (OPE-1603). Every chat vendor reserves app
+    // creation for a workspace admin, so the agent's job is to give the operator the exact document.
+    // Read-only, and the only ops tool that returns a whole document: the manifest carries scopes,
+    // commands, shortcuts and request URLs, and an agent that retypes it from prose gets one wrong.
+    // `baseUrl` is REFUSED rather than pasted when it is not a host — Slack rejects a malformed
+    // request URL at verification time, which is the expensive place to learn it.
+    server.registerTool("surface_manifest", {
+        title: "Chat-app manifest",
+        description: `Return the paste-ready app manifest for a chat surface (e.g. slack), with baseUrl substituted for the ${DEPLOY_HOST_PLACEHOLDER} ` +
+            "placeholder in every request URL, plus the ordered clicks the operator makes in the vendor console and the values they " +
+            "bring back. Read-only. Creating the app needs workspace-admin rights, so this is the hand-over for a step you cannot do. " +
+            "Omit baseUrl before the first deploy: the manifest then keeps the placeholder, and placeholdersRemaining says how many " +
+            "the operator must still replace by hand.",
+        inputSchema: {
+            surface: z.string().describe("the surface goal, e.g. \"slack\""),
+            baseUrl: z.string().optional().describe("this deployment's public origin, e.g. https://oe.example.com (scheme optional)"),
+        },
+    }, (a) => {
+        const available = surfaceAppManifestSurfaces();
+        let host;
+        if (a.baseUrl !== undefined) {
+            host = normalizeDeployHost(a.baseUrl);
+            if (host === undefined) {
+                // 🔴 THE REFUSAL DOES NOT ECHO THE VALUE. The wrong input this arm catches is often a
+                // full webhook URL, and a Slack incoming-webhook URL IS the credential — its path is the
+                // shared secret. Quoting it back would put it in the agent's transcript and every MCP
+                // log, against this plane's own "never echo a secret" rule. The length is enough to tell
+                // a typo from a pasted URL.
+                return json({
+                    ok: false,
+                    surface: a.surface,
+                    note: `refusing to substitute the baseUrl you passed (${a.baseUrl.length} characters) — it is not a host. Pass this ` +
+                        "deployment's origin: letters, digits, dots and hyphens, with an optional :port and an optional scheme. Not a " +
+                        "path, and not a full webhook URL. The vendor rejects a malformed request URL at verification time.",
+                });
+            }
+        }
+        const resolved = surfaceAppManifest(a.surface, host === undefined ? {} : { host });
+        if (resolved === undefined) {
+            return json({
+                ok: false,
+                surface: a.surface,
+                available,
+                note: available.length === 0
+                    ? "no surface registered an app manifest in this process — the shipped entry is scripts/ops-mcp.ts, which registers the bundles before serving."
+                    : `no app manifest is registered for "${a.surface}". Registered: ${available.join(", ")}.`,
+            });
+        }
+        return json({ ok: true, available, ...resolved });
+    });
+    server.registerTool("scaffold_env", {
+        title: "Write .env.local config",
+        description: "Merge KEY=VALUE settings into the project's .env.local (updating in place, appending new keys, preserving comments). Use after " +
+            "gathering answers from preflight/quickstart. The target must sit at the project root and be named .env, .env.local or " +
+            ".env.<name>.local — the names this repository never tracks; any other name is refused, because these values are secrets and a " +
+            ".env.example is a tracked file.",
+        inputSchema: {
+            values: z.record(z.string(), z.string()).describe("env keys to set, e.g. { AI_GATEWAY_API_KEY: '...', OE_OPERATIONAL_PROVIDER: 'postgres' }"),
+            path: z.string().optional().describe("override the target file (default <project>/.env.local; must be a never-tracked env name at the project root)"),
+        },
+    }, (a) => {
+        const file = envFilePath(a.path);
+        // The same gate `scaffold_credential_key` passes. This tool carries the WORSE payload: it is
+        // the one the runbook feeds real vendor secrets, one call at a time.
+        const refusal = envTargetRefusal(file);
+        if (refusal)
+            return json({ ok: false, file, keysSet: [], note: refusal });
+        const existing = existsSync(file) ? readFileSync(file, "utf-8") : "";
+        const next = mergeEnv(existing, a.values);
+        writeFileSync(file, next.endsWith("\n") ? next : next + "\n", "utf-8");
+        return json({ ok: true, file, keysSet: Object.keys(a.values) });
+    });
+    // THE KEY THE SECRET TOOLS BELOW NEED, MINTED WITHOUT A SHELL (OPE-973). Before this, an agent
+    // standing a deployment up had to run `openssl rand -base64 32` in the operator's shell and hand
+    // the result to `scaffold_env` — which carries the deployment's master key through the model's
+    // context, and gets the encoding wrong often enough that the store fails closed at the first
+    // write. This tool generates it in-process and writes it straight to the file. It is the one
+    // place in this server that CREATES key material, so it is also the one that must never return
+    // it: the response carries a byte count, exactly as `secret_set` does.
+    server.registerTool("scaffold_credential_key", {
+        title: "Mint the credential store's encryption key",
+        description: `Generate the deployment's AES-256-GCM credential-store key (${CREDENTIAL_KEY_ENV_NAME}) straight into the project's .env.local. ` +
+            "The value is NEVER returned — the response reports the byte count only. Idempotent by default: an existing well-formed key is left " +
+            "alone, because a new key orphans every secret already stored under the old one (nothing can read those rows again). A key exported " +
+            "in the operator's shell is refused outright, even with `replace` — the environment wins over the file for the secret tools, so a " +
+            "file key would never take effect. Run it BEFORE secret_set. The same value must reach the deployment's own environment separately " +
+            "— .env.local does not ship.",
+        inputSchema: {
+            replace: z
+                .boolean()
+                .optional()
+                .describe("mint a new key even though one is set in the file — every secret already in the store becomes permanently unreadable"),
+            path: z.string().optional().describe("override the target file (default <project>/.env.local)"),
+        },
+    }, (a) => {
+        const file = envFilePath(a.path);
+        // The shared write gate — see envTargetRefusal above. This tool CREATES key material, so a
+        // target outside the project root or under a tracked name is refused before anything is
+        // generated.
+        const keyRefusal = envTargetRefusal(file);
+        if (keyRefusal)
+            return json({ ok: false, file, generated: false, note: keyRefusal });
+        const existing = existsSync(file) ? readFileSync(file, "utf-8") : "";
+        // 🔴 RESOLVE THE KEY THE WAY THE REST OF THIS SERVER DOES, not from the file alone. An
+        // operator whose shell already exports the key (direnv, `source .env`, a CI env pack) has a
+        // store full of rows encrypted under it. Reading only the file would call that "absent", mint
+        // a RIVAL key into .env.local, and hand it to `vercel env add` — after which the deployment
+        // holds a key that opens none of its own rows, while `secret_set` here keeps writing under
+        // the shell key (loadRootOfTrustEnv lets an exported var win). So: the file's key can be
+        // replaced deliberately; a key that lives only in the environment is refused outright,
+        // because a file key would never take effect for the secret tools anyway.
+        const inFile = credentialKeyStatus(loadEnvFile(file)[CREDENTIAL_KEY_ENV_NAME]);
+        const inProcess = credentialKeyStatus(process.env[CREDENTIAL_KEY_ENV_NAME]);
+        if (inFile === "absent" && inProcess !== "absent") {
+            return json({
+                ok: false,
+                file,
+                key: CREDENTIAL_KEY_ENV_NAME,
+                generated: false,
+                existing: inProcess,
+                source: "environment",
+                note: `${CREDENTIAL_KEY_ENV_NAME} is exported in this process's environment, not in ${file}. That value is the one the secret tools ` +
+                    "use, and it is the one the store's rows are encrypted under. Push THAT value to the deployment rather than minting a rival; " +
+                    "unset it and re-run only if you know the store holds nothing.",
+            });
+        }
+        if (inFile !== "absent" && a.replace !== true) {
+            return json({
+                ok: true,
+                file,
+                key: CREDENTIAL_KEY_ENV_NAME,
+                generated: false,
+                existing: inFile,
+                source: "file",
+                note: inFile === "ok"
+                    ? "a well-formed key is already set — left alone. Pass replace:true only when you accept that every secret already stored becomes unreadable."
+                    : `the key already set does not decode to a ${CREDENTIAL_KEY_BYTES}-byte key, so the store is failing closed. Pass replace:true to mint a new one.`,
+            });
+        }
+        const next = mergeEnv(existing, { [CREDENTIAL_KEY_ENV_NAME]: randomBytes(CREDENTIAL_KEY_BYTES).toString("base64") });
+        writeFileSync(file, next.endsWith("\n") ? next : next + "\n", "utf-8");
+        return json({
+            ok: true,
+            file,
+            key: CREDENTIAL_KEY_ENV_NAME,
+            bytes: CREDENTIAL_KEY_BYTES,
+            generated: true,
+            replaced: inFile !== "absent",
+            note: "The value was written to the file and is not in this response. To arm a hosted deployment, pipe it from the file into " +
+                `\`vercel env add ${CREDENTIAL_KEY_ENV_NAME} production\` rather than reading it back — nothing needs to see it.`,
+        });
+    });
+    server.registerTool("secret_set", {
+        title: "Store a secret in the deployment's credential store",
+        description: "Encrypt one or more secrets into this deployment's own credential store (AES-256-GCM, keyed by OE_CREDENTIAL_ENCRYPTION_KEY) so channels and connectors resolve them WITHOUT env vars. Write-only: no tool reads a value back, and the confirmation reports only the byte count. Needs DATABASE_URL + OE_CREDENTIAL_ENCRYPTION_KEY (from the environment or the project's .env.local).",
+        inputSchema: {
+            secrets: z
+                .record(z.string(), z.string())
+                .describe("name → value, e.g. { ACME_API_TOKEN: '<the token>' }. The name is the secretRef a credential points at."),
+            org: z.string().optional().describe(ORG_INPUT_DESCRIPTION),
+            envPath: z.string().optional(),
+        },
+    }, async (a) => {
+        const orgRefusal = defaultOrgRefusal(a.org);
+        if (orgRefusal)
+            return json({ ok: false, set: [], note: orgRefusal });
+        const store = await connectStore(envFilePath(a.envPath), a.org);
+        const { setOperatorSecret, SET_BY_OPS_MCP } = await import("../credentials/operator-secrets.js");
+        const set = [];
+        for (const [name, value] of Object.entries(a.secrets)) {
+            // One at a time, reporting what landed: each write is an independent idempotent upsert, so a
+            // failure mid-batch is re-runnable rather than something to unpick.
+            const r = await setOperatorSecret({ name, value, setBy: SET_BY_OPS_MCP, ...(a.org ? { org: a.org } : {}) });
+            set.push({ name: r.name, bytes: r.bytes, at: r.at, replaced: r.replaced });
+        }
+        return json({ ok: true, store: store.label, org: actingOrg(a.org), set, note: "Values are write-only — nothing can read them back out." });
+    });
+    server.registerTool("secret_list", {
+        title: "List stored secret NAMES",
+        description: "Names, who set them and when — NEVER values or any part of one. Use it to check what a deployment already holds before setting more.",
+        inputSchema: {
+            includeInternal: z.boolean().optional().describe("also list host-minted internal refs (hook:/oe-oauth:/notion-handshake:)"),
+            org: z.string().optional().describe(ORG_INPUT_DESCRIPTION),
+            envPath: z.string().optional(),
+        },
+    }, async (a) => {
+        const orgRefusal = defaultOrgRefusal(a.org);
+        if (orgRefusal)
+            return json({ ok: false, secrets: [], note: orgRefusal });
+        const store = await connectStore(envFilePath(a.envPath), a.org);
+        const { listOperatorSecrets } = await import("../credentials/operator-secrets.js");
+        const secrets = await listOperatorSecrets({ ...(a.includeInternal ? { includeInternal: true } : {}), ...(a.org ? { org: a.org } : {}) });
+        return json({ store: store.label, org: actingOrg(a.org), secrets });
+    });
+    server.registerTool("secret_rm", {
+        title: "Delete a stored secret",
+        description: "Remove one secret from the credential store. The ciphertext row is DELETED, not retired — anything still resolving that name fails closed afterwards, UNLESS the process that RESOLVES it holds an environment variable of the same name, which resolution falls back to by design. `envFallbackPresent` reports whether THIS ops process holds one — presence only, never any part of a value. It cannot see the deployment's own host, so check that host's variables too when the deployment runs elsewhere.",
+        inputSchema: { name: z.string(), org: z.string().optional().describe(ORG_INPUT_DESCRIPTION), envPath: z.string().optional() },
+    }, async (a) => {
+        const orgRefusal = defaultOrgRefusal(a.org);
+        if (orgRefusal)
+            return json({ ok: false, removed: [], note: orgRefusal });
+        const store = await connectStore(envFilePath(a.envPath), a.org);
+        const { removeOperatorSecret, operatorSecretEnvFallbackPresent } = await import("../credentials/operator-secrets.js");
+        const removed = await removeOperatorSecret(a.name, a.org ? { org: a.org } : {});
+        // 🔴 PRESENCE, NEVER THE VALUE (OPE-1956). `getOperatorSecret` falls back to an env var of the
+        // same name once the row is gone — the documented store-unreachable arm — so deleting the row
+        // is not by itself a retirement. The operator learns that HERE, at the moment the row goes,
+        // rather than from a resolution that quietly keeps working on a value they believe is gone.
+        const envFallbackPresent = operatorSecretEnvFallbackPresent(a.name);
+        const notes = [];
+        if (!removed)
+            notes.push(`no secret named "${a.name}" was stored.`);
+        if (envFallbackPresent) {
+            notes.push(`An environment variable named "${a.name}" is set in THIS ops process, so that name still resolves here — from the environment, not the store. Delete the variable too to retire the value. The deployment's own host may hold one as well; this reply cannot see it.`);
+        }
+        return json({
+            ok: removed,
+            store: store.label,
+            org: actingOrg(a.org),
+            removed: removed ? [a.name] : [],
+            envFallbackPresent,
+            ...(notes.length > 0 ? { note: notes.join(" ") } : {}),
+        });
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/agent/ops/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../agent/ops/server.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,oFAAoF;AACpF,oFAAoF;AACpF,qFAAqF;AACrF,+EAA+E;AAC/E,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,qFAAqF;AACrF,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC/H,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAErI,8FAA8F;AAC9F,oGAAoG;AACpG,oGAAoG;AACpG,8FAA8F;AAC9F,qGAAqG;AACrG,mGAAmG;AACnG,iGAAiG;AACjG,mCAAmC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,yBAAyB;IACzB,YAAY;IACZ,aAAa;IACb,WAAW;CACH,CAAC;AAEX,+EAA+E;AAC/E,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AACD;yFACyF;AACzF,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7F,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,mCAAmC;AACnC,EAAE;AACF,8FAA8F;AAC9F,kGAAkG;AAClG,gGAAgG;AAChG,kEAAkE;AAClE,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,wCAAwC;AACxC,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;AAEvE,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC;QACzB,OAAO,yBAAyB,IAAI,6CAA6C,UAAU,EAAE,6CAA6C,CAAC;IAC7I,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,CACL,yBAAyB,IAAI,gGAAgG;YAC7H,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAa;IAC9B,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,oFAAoF;AACpF,EAAE;AACF,mFAAmF;AACnF,+FAA+F;AAC/F,mGAAmG;AACnG,kDAAkD;AAClD,EAAE;AACF,wGAAwG;AACxG,mGAAmG;AACnG,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,+FAA+F;AAC/F,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,8BAA8B;AAC9B,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,oGAAoG;AACpG,gGAAgG;AAChG,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,gCAAgC;AAChC,MAAM,sBAAsB,GAC1B,8aAA8a,CAAC;AAEjb;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAuB;IACxC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;AACrC,CAAC;AAED,qGAAqG;AACrG,MAAM,qBAAqB,GACzB,mUAAmU,CAAC;AAatU,MAAM,UAAU,cAAc,CAAC,IAAI,GAAkB,EAAE;IACrD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,iGAAiG;IACjG,6FAA6F;IAC7F,+DAA+D;IAC/D,MAAM,sBAAsB,GAAG,4BAA4B,EAAE,KAAK,SAAS,CAAC;IAC5E,iFAAiF;IACjF,MAAM,iBAAiB,GAAG,CAAC,GAAuB,EAAsB,EAAE;QACxE,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,uFAAuF;QACvF,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,kDAAkD;QAC7E,OAAO,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACrE,CAAC,CAAC;IACF,MAAM,YAAY,GAChB,IAAI,CAAC,YAAY;QACjB,CAAC,KAAK,EAAE,OAAe,EAAE,GAAuB,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;YACpE,4FAA4F;YAC5F,qFAAqF;YACrF,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAChC,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,6FAA6F;YAC7F,sDAAsD;YACtD,0FAA0F;YAC1F,wFAAwF;YACxF,2FAA2F;YAC3F,oFAAoF;YACpF,wCAAwC;YACxC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,8VAA8V;QAC3W,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAChD,EACD,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC9D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,mTAAmT;QAChU,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KACvH,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAC1D,CAAC;IAEF,6FAA6F;IAC7F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,4FAA4F;IAC5F,8EAA8E;IAC9E,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,yGAAyG,uBAAuB,GAAG;YACnI,yHAAyH;YACzH,2HAA2H;YAC3H,yHAAyH;YACzH,0CAA0C;QAC5C,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAChE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;SAC1H;KACF,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,SAAS,GAAG,0BAA0B,EAAE,CAAC;QAC/C,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,sFAAsF;gBACtF,yFAAyF;gBACzF,sFAAsF;gBACtF,yFAAyF;gBACzF,4BAA4B;gBAC5B,OAAO,IAAI,CAAC;oBACV,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,IAAI,EACF,kDAAkD,CAAC,CAAC,OAAO,CAAC,MAAM,6CAA6C;wBAC/G,+GAA+G;wBAC/G,oGAAoG;iBACvG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;gBACV,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS;gBACT,IAAI,EACF,SAAS,CAAC,MAAM,KAAK,CAAC;oBACpB,CAAC,CAAC,8IAA8I;oBAChJ,CAAC,CAAC,sCAAsC,CAAC,CAAC,OAAO,kBAAkB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC/F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,iIAAiI;YACjI,wHAAwH;YACxH,gIAAgI;YAChI,iCAAiC;QACnC,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0FAA0F,CAAC;YAC7I,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+GAA+G,CAAC;SACtJ;KACF,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CACF,CAAC;IAEF,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,uEAAuE;IACvE,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,+DAA+D,uBAAuB,4CAA4C;YAClI,qIAAqI;YACrI,qIAAqI;YACrI,mIAAmI;YACnI,oIAAoI;YACpI,6BAA6B;QAC/B,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,sHAAsH,CAAC;YACnI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;SAChG;KACF,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjC,2FAA2F;QAC3F,wFAAwF;QACxF,aAAa;QACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,uFAAuF;QACvF,4FAA4F;QAC5F,8FAA8F;QAC9F,4FAA4F;QAC5F,2FAA2F;QAC3F,yFAAyF;QACzF,uFAAuF;QACvF,0EAA0E;QAC1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;gBACV,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,GAAG,EAAE,uBAAuB;gBAC5B,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,aAAa;gBACrB,IAAI,EACF,GAAG,uBAAuB,sDAAsD,IAAI,2CAA2C;oBAC/H,8HAA8H;oBAC9H,+DAA+D;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;gBACV,EAAE,EAAE,IAAI;gBACR,IAAI;gBACJ,GAAG,EAAE,uBAAuB;gBAC5B,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,MAAM;gBACd,IAAI,EACF,MAAM,KAAK,IAAI;oBACb,CAAC,CAAC,4IAA4I;oBAC9I,CAAC,CAAC,4CAA4C,oBAAoB,iFAAiF;aACxJ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrH,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;YACV,EAAE,EAAE,IAAI;YACR,IAAI;YACJ,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,oBAAoB;YAC3B,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,MAAM,KAAK,QAAQ;YAC7B,IAAI,EACF,wHAAwH;gBACxH,oBAAoB,uBAAuB,sEAAsE;SACpH,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EACT,wXAAwX;QAC1X,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;iBACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,CAAC,yGAAyG,CAAC;YACtH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC/B;KACF,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACjG,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,6FAA6F;YAC7F,oEAAoE;YACpE,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5G,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC7I,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,sIAAsI;QACnJ,WAAW,EAAE;YACX,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;YAC3H,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC1D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC/B;KACF,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzI,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,ifAAif;QACnf,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC9H,EACD,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACtH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChF,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,kBAAkB,GAAG,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC;QACpE,IAAI,kBAAkB,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CACR,kCAAkC,CAAC,CAAC,IAAI,8NAA8N,CACvQ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;YACV,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;YACrB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YAChC,kBAAkB;YAClB,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/agent/ops/surface-manifest.d.ts

@@ -0,0 +1,60 @@
+/** The token every registered template carries where the deployment's own host belongs. */
+export declare const DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
+/** What a provider bundle registers: its vendor document, plus the human steps around it. */
+export interface SurfaceAppManifestSource {
+    /** How the vendor console reads the document. */
+    readonly format: "json" | "yaml";
+    /** The console page the operator opens. */
+    readonly consoleUrl: string;
+    /** The ordered clicks, from opening the console to installing the app. */
+    readonly steps: readonly string[];
+    /** What the operator brings back, each phrased as "<the vendor's label> = <the env key>". */
+    readonly collect: readonly string[];
+    /** The document itself, carrying DEPLOY_HOST_PLACEHOLDER wherever this deployment's host belongs. */
+    readonly template: () => string;
+}
+/** One surface's manifest, resolved for a deployment. */
+export interface SurfaceAppManifest {
+    readonly surface: string;
+    readonly format: "json" | "yaml";
+    readonly consoleUrl: string;
+    readonly steps: readonly string[];
+    readonly collect: readonly string[];
+    /** The paste-ready document. */
+    readonly manifest: string;
+    /** The host substituted in, absent when the caller named none. */
+    readonly host?: string;
+    /** How many placeholders the document still carries. Non-zero means a human must still edit it. */
+    readonly placeholdersRemaining: number;
+}
+/** Register (or replace) a surface's chat-app manifest, keyed by surface name (e.g. "slack"). */
+export declare function registerSurfaceAppManifest(surface: string, source: SurfaceAppManifestSource): void;
+/** Test-only reset — drops every registered manifest. */
+export declare function _resetSurfaceAppManifestsForTest(): void;
+/** The surfaces that registered a manifest, sorted — the answer a caller gives for an unknown one. */
+export declare function surfaceAppManifestSurfaces(): string[];
+/**
+ * The deployment's host as a manifest URL needs it: no scheme, no trailing slash, nothing else.
+ * `undefined` when the value cannot be a host — the caller REFUSES rather than pasting a URL the
+ * vendor will reject at verification time, which is the expensive place to find out.
+ *
+ * 🔴 AN ALLOWLIST, NEVER A DENYLIST. The result is spliced into a document `JSON.stringify` has
+ * ALREADY escaped, so a character this function lets through reaches the vendor unescaped. Two
+ * failures a denylist misses: a backslash (`oe\bad.com`) becomes a JSON escape and silently
+ * resolves to a DIFFERENT host, and a double quote breaks the document into invalid JSON, which
+ * the operator meets as a paste error rather than as this function's clear refusal.
+ *
+ * So: letters, digits, dots and hyphens, with an optional `:port`. Everything else is refused,
+ * including a path, a query, a fragment and a userinfo `@`. An internationalised host must be
+ * given in punycode (`xn--…`), which is the form a URL carries anyway.
+ */
+export declare function normalizeDeployHost(raw: string): string | undefined;
+/**
+ * One surface's paste-ready manifest, or `undefined` when no bundle registered that surface.
+ * `host` is the value `normalizeDeployHost` returned; omit it to keep the placeholder in place for
+ * an operator who has not deployed yet.
+ */
+export declare function surfaceAppManifest(surface: string, opts?: {
+    readonly host?: string;
+}): SurfaceAppManifest | undefined;
+//# sourceMappingURL=surface-manifest.d.ts.map

package/dist/agent/ops/surface-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-manifest.d.ts","sourceRoot":"","sources":["../../../agent/ops/surface-manifest.ts"],"names":[],"mappings":"AAeA,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,2CAA2C;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,MAAM,MAAM,CAAC;CACjC;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAID,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAElG;AAED,yDAAyD;AACzD,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAED,sGAAsG;AACtG,wBAAgB,0BAA0B,IAAI,MAAM,EAAE,CAErD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOnE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,kBAAkB,GAAG,SAAS,CAiBzH"}

package/dist/agent/ops/surface-manifest.js

@@ -0,0 +1,79 @@
+// The chat-app manifest registry — the ops plane's half of the one setup step that stays human.
+//
+// Minting the chat app belongs to a person with workspace-admin rights (docs/deploy/
+// agent-driven-setup.md § 14). The agent's whole job at that step is to hand the operator the exact
+// document to paste, with this deployment's own host already in it. Before this registry the
+// document lived only inside the install wizard's Slack step, so an agent driving the ops MCP
+// server had to run the wizard interactively — which the quickstart skill tells it not to relay —
+// or rebuild the manifest from prose.
+//
+// THE SPLIT, AND WHY IT MATCHES registerQuickstartSurfaceGoal. A manifest is vendor knowledge, so
+// the provider bundle owns the document (boundary rule 6) and registers it here. Core owns the ONE
+// thing every surface shares: substituting the deployment's host into the template, and counting
+// what the substitution left behind. An UNREGISTERED surface returns nothing — the caller then says
+// which surfaces ARE registered rather than inventing a document a vendor would reject.
+/** The token every registered template carries where the deployment's own host belongs. */
+export const DEPLOY_HOST_PLACEHOLDER = "YOUR-DEPLOY-URL";
+const SOURCES = {};
+/** Register (or replace) a surface's chat-app manifest, keyed by surface name (e.g. "slack"). */
+export function registerSurfaceAppManifest(surface, source) {
+    SOURCES[surface] = source;
+}
+/** Test-only reset — drops every registered manifest. */
+export function _resetSurfaceAppManifestsForTest() {
+    for (const k of Object.keys(SOURCES))
+        delete SOURCES[k];
+}
+/** The surfaces that registered a manifest, sorted — the answer a caller gives for an unknown one. */
+export function surfaceAppManifestSurfaces() {
+    return Object.keys(SOURCES).sort();
+}
+/**
+ * The deployment's host as a manifest URL needs it: no scheme, no trailing slash, nothing else.
+ * `undefined` when the value cannot be a host — the caller REFUSES rather than pasting a URL the
+ * vendor will reject at verification time, which is the expensive place to find out.
+ *
+ * 🔴 AN ALLOWLIST, NEVER A DENYLIST. The result is spliced into a document `JSON.stringify` has
+ * ALREADY escaped, so a character this function lets through reaches the vendor unescaped. Two
+ * failures a denylist misses: a backslash (`oe\bad.com`) becomes a JSON escape and silently
+ * resolves to a DIFFERENT host, and a double quote breaks the document into invalid JSON, which
+ * the operator meets as a paste error rather than as this function's clear refusal.
+ *
+ * So: letters, digits, dots and hyphens, with an optional `:port`. Everything else is refused,
+ * including a path, a query, a fragment and a userinfo `@`. An internationalised host must be
+ * given in punycode (`xn--…`), which is the form a URL carries anyway.
+ */
+export function normalizeDeployHost(raw) {
+    const trimmed = raw
+        .trim()
+        .replace(/^https?:\/\//i, "")
+        .replace(/\/+$/, "");
+    if (!/^[A-Za-z0-9.-]+(:\d{1,5})?$/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+/**
+ * One surface's paste-ready manifest, or `undefined` when no bundle registered that surface.
+ * `host` is the value `normalizeDeployHost` returned; omit it to keep the placeholder in place for
+ * an operator who has not deployed yet.
+ */
+export function surfaceAppManifest(surface, opts = {}) {
+    const source = SOURCES[surface];
+    if (source === undefined)
+        return undefined;
+    const template = source.template();
+    // `split(…).join(…)` replaces EVERY occurrence with a literal — a manifest names the deployment's
+    // host once per request URL, and `String.replace` with a string pattern would swap only the first.
+    const manifest = opts.host === undefined ? template : template.split(DEPLOY_HOST_PLACEHOLDER).join(opts.host);
+    return {
+        surface,
+        format: source.format,
+        consoleUrl: source.consoleUrl,
+        steps: source.steps,
+        collect: source.collect,
+        manifest,
+        ...(opts.host === undefined ? {} : { host: opts.host }),
+        placeholdersRemaining: manifest.split(DEPLOY_HOST_PLACEHOLDER).length - 1,
+    };
+}
+//# sourceMappingURL=surface-manifest.js.map

package/dist/agent/ops/surface-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-manifest.js","sourceRoot":"","sources":["../../../agent/ops/surface-manifest.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,EAAE;AACF,qFAAqF;AACrF,oGAAoG;AACpG,6FAA6F;AAC7F,8FAA8F;AAC9F,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,oGAAoG;AACpG,wFAAwF;AAExF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AA+BzD,MAAM,OAAO,GAA6C,EAAE,CAAC;AAE7D,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,MAAgC;IAC1F,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,gCAAgC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,0BAA0B;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,OAAO,GAAG,GAAG;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,IAAI,GAA+B,EAAE;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACnC,kGAAkG;IAClG,mGAAmG;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9G,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC;KAC1E,CAAC;AACJ,CAAC"}

package/dist/agent/ops/two-role.d.ts

@@ -0,0 +1,26 @@
+/** The conventional non-owner runtime role name (docs/extending/database.md uses it verbatim). */
+export declare const RUNTIME_ROLE_NAME = "oe_runtime";
+/** The env var the OWNER/migration connection string is parked under once DATABASE_URL points at
+ *  the runtime role — re-run the owner boot from it after any schema-changing upgrade. */
+export declare const OWNER_URL_ENV = "OE_DB_OWNER_URL";
+/** A high-entropy password for the runtime role — printed ONCE to the operator, never written to a
+ *  tracked file. base64url so it drops into a connection string with no percent-encoding surprises. */
+export declare function generateRuntimePassword(bytes?: number): string;
+/**
+ * Derive the runtime-role connection URL from the OWNER url by swapping ONLY the credential pair —
+ * same host / database / query params, non-owner role. Throws on a non-postgres or unparseable URL
+ * (so the wizard can fall back to the single-role posture rather than write a broken DATABASE_URL).
+ */
+export declare function deriveRuntimeUrl(ownerUrl: string, role: string, password: string): string;
+/**
+ * The exact SQL the operator runs AS THE OWNER (after one owner boot has applied the schema) to
+ * stand up the runtime role: create it with the generated password, then the canonical grants
+ * (runtimeRoleGrantsSql — SELECT+INSERT-only on the append-only tables; on the mutable ones
+ * EXACTLY the verbs each table's code path issues, which is not the same set for every table
+ * (see MUTABLE_TABLE_VERBS); no DDL). Re-run the grants after any migration that adds a table —
+ * the re-run is also what TIGHTENS an existing role that was provisioned by an older build, since
+ * each grant is paired with a REVOKE of the verbs that table does not need. (The header of
+ * runtimeRoleGrantsSql explains why there is no ALTER DEFAULT PRIVILEGES.)
+ */
+export declare function twoRoleProvisioningSql(role: string, password: string): string[];
+//# sourceMappingURL=two-role.d.ts.map

package/dist/agent/ops/two-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-role.d.ts","sourceRoot":"","sources":["../../../agent/ops/two-role.ts"],"names":[],"mappings":"AAkBA,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;0FAC0F;AAC1F,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAE/C;uGACuG;AACvG,wBAAgB,uBAAuB,CAAC,KAAK,SAAK,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkBzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ/E"}