@planu/cli 0.63.7 → 0.64.1

package/dist/tools/audit-trail-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-trail-handler.js","sourceRoot":"","sources":["../../src/tools/audit-trail-handler.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAGpG,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE/E,oDAAoD;AACpD,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,kBAAkB,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IAC1D,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CACf,WAAW,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,EACnE,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,aAAa,CAAC,QAAQ,EAAE;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QACF,oBAAoB,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK;QACtC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,kBAAkB,WAAW,CAAC,OAAO,GAAG,CAAC;IAE7C,MAAM,KAAK,GAAa;QACtB,eAAe,IAAI,CAAC,SAAS,EAAE;QAC/B,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,mBAAmB,cAAc,EAAE;QAC/D,WAAW,CAAC,SAAS;YACnB,CAAC,CAAC,kBAAkB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG;YACxF,CAAC,CAAC,EAAE;QACN,EAAE;KACH,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAE1B,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,UAAU,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE;QACpD,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,cAAc,EAAE,WAAW;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA8B;IAE9B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,UAAU,CACf,WAAW,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,EACnE,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,UAAU,CACf,WAAW,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,EACnF,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAErF,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACvD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,IAAI,GAAG;QACX,mBAAmB,WAAW,CAAC,aAAa,EAAE;QAC9C,cAAc,WAAW,CAAC,WAAW,EAAE;QACvC,SAAS,WAAW,CAAC,MAAM,EAAE;QAC7B,oBAAoB,UAAU,EAAE;QAChC,iBAAiB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;QAC9C,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;QAC9D,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3D,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;KAC/D;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,UAAU,CACf,aAAa,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,2EAA2E;QAC3E,uDAAuD;KACxD,CAAC,EACF,WAAiD,CAClD,CAAC;AACJ,CAAC"}

package/dist/tools/auto-update-spec.d.ts

@@ -0,0 +1,3 @@
+import type { AutoUpdateSpecInput, ToolResult } from '../types/index.js';
+export declare function handleAutoUpdateSpec(args: AutoUpdateSpecInput): Promise<ToolResult>;
+//# sourceMappingURL=auto-update-spec.d.ts.map

package/dist/tools/auto-update-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update-spec.d.ts","sourceRoot":"","sources":["../../src/tools/auto-update-spec.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAsBzE,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBzF"}

package/dist/tools/auto-update-spec.js

@@ -0,0 +1,43 @@
+// tools/auto-update-spec.ts — auto_update_spec handler (SPEC-170)
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { specStore } from '../storage/index.js';
+import { autoUpdateSpecFromCode } from '../engine/living-spec/auto-updater.js';
+import { stripFrontmatter } from '../engine/frontmatter-parser.js';
+import { readSpecContent as readRawSpecContent } from '../engine/spec-reader.js';
+import { jsonResult, errJson } from './response-helpers.js';
+const execFileAsync = promisify(execFile);
+/**
+ * Compute git diff for the current working directory.
+ * Returns empty string when git is unavailable or produces no diff.
+ * Uses async execFile to avoid blocking the event loop during the git call.
+ */
+async function computeGitDiff() {
+    try {
+        const { stdout } = await execFileAsync('git', ['diff', 'HEAD'], {
+            encoding: 'utf-8',
+            timeout: 10_000,
+        });
+        return stdout;
+    }
+    catch {
+        return '';
+    }
+}
+export async function handleAutoUpdateSpec(args) {
+    const { projectId, specId, codeDiff, autoApply = false } = args;
+    // 1. Load spec metadata
+    const spec = await specStore.getSpec(projectId, specId);
+    if (!spec) {
+        return errJson({ message: `Spec ${specId} not found in project ${projectId}` });
+    }
+    // 2. Resolve diff — use provided diff or fall back to git diff
+    const resolvedDiff = codeDiff ?? (await computeGitDiff());
+    // 3. Read spec file content for AC extraction (strip YAML frontmatter)
+    const raw = await readRawSpecContent(spec.specPath);
+    const specContent = raw !== null ? stripFrontmatter(raw) : '';
+    // 4. Run auto-updater
+    const result = autoUpdateSpecFromCode(specId, resolvedDiff, specContent, autoApply);
+    return jsonResult({ ...result, message: result.summary });
+}
+//# sourceMappingURL=auto-update-spec.js.map

package/dist/tools/auto-update-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update-spec.js","sourceRoot":"","sources":["../../src/tools/auto-update-spec.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;GAIG;AACH,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;YAC9D,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAyB;IAClE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IAEhE,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,MAAM,yBAAyB,SAAS,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,+DAA+D;IAC/D,MAAM,YAAY,GAAG,QAAQ,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IAE1D,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9D,sBAAsB;IACtB,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAEpF,OAAO,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/tools/branch-spec.d.ts

@@ -0,0 +1,3 @@
+import type { ToolResult, BranchSpecInput } from '../types/index.js';
+export declare function handleBranchSpec(args: BranchSpecInput): Promise<ToolResult>;
+//# sourceMappingURL=branch-spec.d.ts.map

package/dist/tools/branch-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-spec.d.ts","sourceRoot":"","sources":["../../src/tools/branch-spec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAUrE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAoEjF"}

package/dist/tools/branch-spec.js

@@ -0,0 +1,68 @@
+// tools/branch-spec.ts — Handler for the branch_spec tool
+import { projectDataDir } from '../storage/index.js';
+import { readSpecContent } from '../engine/spec-reader.js';
+import { createBranch, listBranches, loadBranch, getLatestVersionTag, } from '../engine/spec-versioning/index.js';
+export async function handleBranchSpec(args) {
+    const { projectId, specId, branchName, fromVersion, specPath } = args;
+    const dataDir = projectDataDir(projectId);
+    // Check if branch already exists
+    const existing = await loadBranch(dataDir, specId, branchName);
+    if (existing !== null) {
+        const branches = await listBranches(dataDir, specId);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: [
+                        `Branch "${branchName}" already exists for spec ${specId}.`,
+                        ``,
+                        `Existing branches:`,
+                        ...branches.map((b) => `  - ${b.name} (created ${b.createdAt}, from ${b.fromVersion})`),
+                    ].join('\n'),
+                },
+            ],
+            isError: true,
+        };
+    }
+    const content = (await readSpecContent(specPath)) ??
+        `# ${specId} — branch: ${branchName}\n(content not provided)`;
+    const latestTag = fromVersion ?? (await getLatestVersionTag(dataDir, specId)) ?? 'unversioned';
+    try {
+        const branch = await createBranch(dataDir, {
+            projectId,
+            specId,
+            branchName,
+            fromVersion: latestTag,
+            content,
+        });
+        const allBranches = await listBranches(dataDir, specId);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: [
+                        `Branch created successfully.`,
+                        ``,
+                        `Spec: ${specId}`,
+                        `Branch: ${branch.name}`,
+                        `Created at: ${branch.createdAt}`,
+                        `Based on: ${branch.fromVersion}`,
+                        ``,
+                        `All branches for this spec (${allBranches.length}):`,
+                        ...allBranches.map((b) => `  - ${b.name}`),
+                        ``,
+                        `To merge back: use merge_spec_branch with branchName="${branchName}"`,
+                    ].join('\n'),
+                },
+            ],
+        };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{ type: 'text', text: `Error: ${msg}` }],
+            isError: true,
+        };
+    }
+}
+//# sourceMappingURL=branch-spec.js.map

package/dist/tools/branch-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-spec.js","sourceRoot":"","sources":["../../src/tools/branch-spec.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAG1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAqB;IAC1D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE1C,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,UAAU,6BAA6B,MAAM,GAAG;wBAC3D,EAAE;wBACF,oBAAoB;wBACpB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,SAAS,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;qBACxF,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACjC,KAAK,MAAM,cAAc,UAAU,0BAA0B,CAAC;IAEhE,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,aAAa,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;YACzC,SAAS;YACT,MAAM;YACN,UAAU;YACV,WAAW,EAAE,SAAS;YACtB,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,8BAA8B;wBAC9B,EAAE;wBACF,SAAS,MAAM,EAAE;wBACjB,WAAW,MAAM,CAAC,IAAI,EAAE;wBACxB,eAAe,MAAM,CAAC,SAAS,EAAE;wBACjC,aAAa,MAAM,CAAC,WAAW,EAAE;wBACjC,EAAE;wBACF,+BAA+B,WAAW,CAAC,MAAM,IAAI;wBACrD,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC1C,EAAE;wBACF,yDAAyD,UAAU,GAAG;qBACvE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tools/configure-auth-handler.d.ts

@@ -0,0 +1,15 @@
+import type { ConfigureAuthInput, ToolResult } from '../types/index.js';
+import { loadAuthConfig } from '../engine/auth/index.js';
+/**
+ * Handle the configure_auth tool call.
+ * Validates input, saves configuration, and returns a PKCE challenge
+ * so the caller can initiate the authorization code flow immediately.
+ */
+export declare function handleConfigureAuth(args: ConfigureAuthInput): Promise<ToolResult>;
+/**
+ * Reset auth config state — for testing only.
+ */
+export declare function resetAuthConfig(): void;
+/** Re-export for external callers that need the current config. */
+export { loadAuthConfig };
+//# sourceMappingURL=configure-auth-handler.d.ts.map

package/dist/tools/configure-auth-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-auth-handler.d.ts","sourceRoot":"","sources":["../../src/tools/configure-auth-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAc,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAEL,cAAc,EAGf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CA8BvF;AAiFD;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/tools/configure-auth-handler.js

@@ -0,0 +1,113 @@
+// tools/configure-auth-handler.ts — Handler for configure_auth tool (SPEC-161)
+// Persists OAuth 2.1 provider config. Never persists tokens.
+import { saveAuthConfig, loadAuthConfig, resetAuthConfigCache, generatePkceChallenge, } from '../engine/auth/index.js';
+/**
+ * Handle the configure_auth tool call.
+ * Validates input, saves configuration, and returns a PKCE challenge
+ * so the caller can initiate the authorization code flow immediately.
+ */
+export async function handleConfigureAuth(args) {
+    if (!args.introspectionUrl && !args.jwksUrl) {
+        return errorResult('Either introspectionUrl or jwksUrl must be provided for token validation. ' +
+            'Use introspectionUrl for opaque tokens or jwksUrl for JWT tokens.');
+    }
+    const config = {
+        clientId: args.clientId,
+        authorizationUrl: args.authorizationUrl,
+        tokenUrl: args.tokenUrl,
+        introspectionUrl: args.introspectionUrl,
+        jwksUrl: args.jwksUrl,
+        scopes: args.scopes,
+        scopeMappings: args.scopeMappings ?? {},
+        updatedAt: new Date().toISOString(),
+    };
+    try {
+        await saveAuthConfig(config);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return errorResult(`Failed to save auth config: ${message}`);
+    }
+    const pkce = generatePkceChallenge();
+    const lines = buildSuccessOutput(config, pkce.codeChallenge, pkce.codeVerifier);
+    return { content: [{ type: 'text', text: lines.join('\n') }] };
+}
+/**
+ * Build human-readable output for a successful configure_auth call.
+ * Includes the PKCE challenge and next-step authorization URL.
+ */
+function buildSuccessOutput(config, codeChallenge, codeVerifier) {
+    const authUrl = buildAuthorizationUrl(config, codeChallenge);
+    return [
+        '# OAuth 2.1 Authentication Configured',
+        '',
+        `Client ID     : ${config.clientId}`,
+        `Authorization : ${config.authorizationUrl}`,
+        `Token URL     : ${config.tokenUrl}`,
+        config.introspectionUrl ? `Introspection : ${config.introspectionUrl}` : '',
+        config.jwksUrl ? `JWKS URI      : ${config.jwksUrl}` : '',
+        `Scopes        : ${config.scopes.join(', ')}`,
+        '',
+        '## PKCE Authorization Flow',
+        '',
+        'Store the code verifier securely — you will need it at the token exchange step.',
+        '(Retrieve the full verifier programmatically; it is masked here for security.)',
+        '',
+        // Security: never expose the full verifier in tool output — an LLM conversation
+        // may be logged or shared. The caller should store it via a secure channel, not
+        // by copy-pasting from this text output.
+        `Code Verifier  : ${maskSecret(codeVerifier)}`,
+        `Code Challenge : ${codeChallenge}`,
+        `Method         : S256`,
+        '',
+        '## Next Step — Open this URL to authorize:',
+        '',
+        authUrl,
+        '',
+        'After authorization, exchange the code with:',
+        `POST ${config.tokenUrl}`,
+        `  grant_type=authorization_code`,
+        `  code=<received_code>`,
+        `  code_verifier=<stored_verifier>`,
+        `  client_id=${config.clientId}`,
+        '',
+        'The MCP server will now validate Bearer tokens on each request (hosted mode).',
+        'Local stdio connections remain unaffected.',
+    ].filter((line) => line !== '');
+}
+/** Build the authorization URL with PKCE and scope parameters. */
+function buildAuthorizationUrl(config, codeChallenge) {
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: config.clientId,
+        scope: config.scopes.join(' '),
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return `${config.authorizationUrl}?${params.toString()}`;
+}
+/**
+ * Mask a secret value for display: show first 4 + last 4 chars only.
+ * The full value should be retrieved programmatically, never from tool output.
+ */
+function maskSecret(value) {
+    if (value.length <= 8) {
+        return '****';
+    }
+    return `${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function errorResult(message) {
+    return {
+        content: [{ type: 'text', text: `Error configuring auth: ${message}` }],
+        isError: true,
+    };
+}
+/**
+ * Reset auth config state — for testing only.
+ */
+export function resetAuthConfig() {
+    resetAuthConfigCache();
+}
+/** Re-export for external callers that need the current config. */
+export { loadAuthConfig };
+//# sourceMappingURL=configure-auth-handler.js.map

package/dist/tools/configure-auth-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-auth-handler.js","sourceRoot":"","sources":["../../src/tools/configure-auth-handler.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6DAA6D;AAG7D,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,WAAW,CAChB,4EAA4E;YAC1E,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAe;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;QACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,WAAW,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAkB,EAClB,aAAqB,EACrB,YAAoB;IAEpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE7D,OAAO;QACL,uCAAuC;QACvC,EAAE;QACF,mBAAmB,MAAM,CAAC,QAAQ,EAAE;QACpC,mBAAmB,MAAM,CAAC,gBAAgB,EAAE;QAC5C,mBAAmB,MAAM,CAAC,QAAQ,EAAE;QACpC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3E,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7C,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,iFAAiF;QACjF,gFAAgF;QAChF,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,yCAAyC;QACzC,oBAAoB,UAAU,CAAC,YAAY,CAAC,EAAE;QAC9C,oBAAoB,aAAa,EAAE;QACnC,uBAAuB;QACvB,EAAE;QACF,4CAA4C;QAC5C,EAAE;QACF,OAAO;QACP,EAAE;QACF,8CAA8C;QAC9C,QAAQ,MAAM,CAAC,QAAQ,EAAE;QACzB,iCAAiC;QACjC,wBAAwB;QACxB,mCAAmC;QACnC,eAAe,MAAM,CAAC,QAAQ,EAAE;QAChC,EAAE;QACF,+EAA+E;QAC/E,4CAA4C;KAC7C,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,SAAS,qBAAqB,CAAC,MAAkB,EAAE,aAAqB;IACtE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC;QACvE,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/tools/configure-observability.d.ts

@@ -0,0 +1,14 @@
+import type { ToolResult } from '../types/index.js';
+import type { ConfigureObservabilityInput } from '../types/observability.js';
+/**
+ * Configures the OpenTelemetry exporter.
+ * Merges provided fields into the active config and reinitializes the tracer.
+ * Idempotent: calling with the same values produces no observable side effects.
+ */
+export declare function handleConfigureObservability(args: ConfigureObservabilityInput): Promise<ToolResult>;
+/**
+ * Returns the current observability configuration as a ToolResult.
+ * Used by a read-only status check.
+ */
+export declare function handleObservabilityStatus(): ToolResult;
+//# sourceMappingURL=configure-observability.d.ts.map

package/dist/tools/configure-observability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-observability.d.ts","sourceRoot":"","sources":["../../src/tools/configure-observability.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAI7E;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,UAAU,CAAC,CAqErB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,UAAU,CAgBtD"}

package/dist/tools/configure-observability.js

@@ -0,0 +1,96 @@
+// tools/configure-observability.ts — Handler for configure_observability tool (SPEC-165)
+import { getOtelConfig, setOtelConfig } from '../engine/observability/config.js';
+import { initTracer } from '../engine/observability/tracer.js';
+/**
+ * Configures the OpenTelemetry exporter.
+ * Merges provided fields into the active config and reinitializes the tracer.
+ * Idempotent: calling with the same values produces no observable side effects.
+ */
+export async function handleConfigureObservability(args) {
+    const { enabled, endpoint, samplingRate, resourceAttributes, serviceName } = args;
+    // Build the partial update — only include defined fields
+    const partial = {};
+    if (enabled !== undefined) {
+        partial.enabled = enabled;
+    }
+    if (endpoint !== undefined) {
+        partial.endpoint = endpoint;
+    }
+    if (samplingRate !== undefined) {
+        partial.samplingRate = samplingRate;
+    }
+    if (resourceAttributes !== undefined) {
+        partial.resourceAttributes = resourceAttributes;
+    }
+    if (serviceName !== undefined) {
+        partial.serviceName = serviceName;
+    }
+    let newConfig;
+    try {
+        newConfig = setOtelConfig(partial);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Failed to update observability config: ${message}. Ensure samplingRate is between 0 and 1.`,
+                },
+            ],
+            isError: true,
+        };
+    }
+    // Reinitialize the tracer with the new config
+    await initTracer(newConfig);
+    const status = newConfig.enabled
+        ? `enabled — exporting to ${newConfig.endpoint ?? '(no endpoint set)'}`
+        : 'disabled (no-op mode)';
+    return {
+        content: [
+            {
+                type: 'text',
+                text: [
+                    `Observability configured successfully.`,
+                    ``,
+                    `Status: ${status}`,
+                    `Service: ${newConfig.serviceName}`,
+                    `Sampling rate: ${newConfig.samplingRate}`,
+                    newConfig.serviceVersion ? `Version: ${newConfig.serviceVersion}` : null,
+                    newConfig.resourceAttributes && Object.keys(newConfig.resourceAttributes).length > 0
+                        ? `Resource attributes: ${JSON.stringify(newConfig.resourceAttributes)}`
+                        : null,
+                    ``,
+                    newConfig.enabled
+                        ? `Traces will be exported via OTLP to ${newConfig.endpoint}. ` +
+                            `Note: @opentelemetry/api must be installed as a peer dependency for actual export.`
+                        : `To enable tracing, set enabled: true and provide an endpoint URL (e.g. http://localhost:4318).`,
+                ]
+                    .filter((line) => line !== null)
+                    .join('\n'),
+            },
+        ],
+    };
+}
+/**
+ * Returns the current observability configuration as a ToolResult.
+ * Used by a read-only status check.
+ */
+export function handleObservabilityStatus() {
+    const config = getOtelConfig();
+    return {
+        content: [
+            {
+                type: 'text',
+                text: [
+                    `Observability status:`,
+                    `  enabled: ${config.enabled}`,
+                    `  endpoint: ${config.endpoint ?? '(none)'}`,
+                    `  samplingRate: ${config.samplingRate}`,
+                    `  serviceName: ${config.serviceName}`,
+                ].join('\n'),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=configure-observability.js.map

package/dist/tools/configure-observability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-observability.js","sourceRoot":"","sources":["../../src/tools/configure-observability.ts"],"names":[],"mappings":"AAAA,yFAAyF;AAIzF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAElF,yDAAyD;IACzD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;IACtC,CAAC;IACD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAClD,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACpC,CAAC;IAED,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,OAA8C,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,0CAA0C,OAAO,2CAA2C;iBACnG;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO;QAC9B,CAAC,CAAC,0BAA0B,SAAS,CAAC,QAAQ,IAAI,mBAAmB,EAAE;QACvE,CAAC,CAAC,uBAAuB,CAAC;IAE5B,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,wCAAwC;oBACxC,EAAE;oBACF,WAAW,MAAM,EAAE;oBACnB,YAAY,SAAS,CAAC,WAAW,EAAE;oBACnC,kBAAkB,SAAS,CAAC,YAAY,EAAE;oBAC1C,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI;oBACxE,SAAS,CAAC,kBAAkB,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC;wBAClF,CAAC,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE;wBACxE,CAAC,CAAC,IAAI;oBACR,EAAE;oBACF,SAAS,CAAC,OAAO;wBACf,CAAC,CAAC,uCAAuC,SAAS,CAAC,QAAQ,IAAI;4BAC7D,oFAAoF;wBACtF,CAAC,CAAC,gGAAgG;iBACrG;qBACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;qBAC/B,IAAI,CAAC,IAAI,CAAC;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,uBAAuB;oBACvB,cAAc,MAAM,CAAC,OAAO,EAAE;oBAC9B,eAAe,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE;oBAC5C,mBAAmB,MAAM,CAAC,YAAY,EAAE;oBACxC,kBAAkB,MAAM,CAAC,WAAW,EAAE;iBACvC,CAAC,IAAI,CAAC,IAAI,CAAC;aACb;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/configure-roles-handler.d.ts

@@ -0,0 +1,4 @@
+import type { ToolResult, ConfigureRolesInput } from '../types/index.js';
+export declare function handleConfigureRoles(args: ConfigureRolesInput): Promise<ToolResult>;
+export declare function handleGetRbacStatus(projectId: string): Promise<ToolResult>;
+//# sourceMappingURL=configure-roles-handler.d.ts.map

package/dist/tools/configure-roles-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-roles-handler.d.ts","sourceRoot":"","sources":["../../src/tools/configure-roles-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGzE,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBzF;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAmBhF"}

package/dist/tools/configure-roles-handler.js

@@ -0,0 +1,36 @@
+// tools/configure-roles-handler.ts — Handler for configure_roles tool (SPEC-166)
+import { setRbacEnabled, getRbacConfig } from '../storage/rbac-store.js';
+export async function handleConfigureRoles(args) {
+    const config = await setRbacEnabled(args.projectId, args.enabled);
+    const assignmentCount = config.assignments.length;
+    const status = args.enabled ? 'enabled' : 'disabled';
+    const lines = [
+        `RBAC ${status} for project ${args.projectId}.`,
+        `Current assignments: ${String(assignmentCount)}`,
+    ];
+    if (!args.enabled) {
+        lines.push('All operations are now allowed (single-user mode).');
+    }
+    else if (assignmentCount === 0) {
+        lines.push('No role assignments yet — use assign_role to grant users access.');
+    }
+    return { content: [{ type: 'text', text: lines.join('\n') }] };
+}
+export async function handleGetRbacStatus(projectId) {
+    const config = await getRbacConfig(projectId);
+    const lines = [
+        `RBAC status for project ${projectId}:`,
+        `  Enabled: ${String(config.enabled)}`,
+        `  Assignments: ${String(config.assignments.length)}`,
+    ];
+    if (config.assignments.length > 0) {
+        lines.push('');
+        lines.push('Assignments:');
+        for (const a of config.assignments) {
+            const scope = a.specId ? ` (spec: ${a.specId})` : ' (project-level)';
+            lines.push(`  - ${a.userId} → ${a.role}${scope}`);
+        }
+    }
+    return { content: [{ type: 'text', text: lines.join('\n') }] };
+}
+//# sourceMappingURL=configure-roles-handler.js.map

package/dist/tools/configure-roles-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure-roles-handler.js","sourceRoot":"","sources":["../../src/tools/configure-roles-handler.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAGjF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAyB;IAClE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;IAElD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,MAAM,KAAK,GAAG;QACZ,QAAQ,MAAM,gBAAgB,IAAI,CAAC,SAAS,GAAG;QAC/C,wBAAwB,MAAM,CAAC,eAAe,CAAC,EAAE;KAClD,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACnE,CAAC;SAAM,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG;QACZ,2BAA2B,SAAS,GAAG;QACvC,cAAc,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACtC,kBAAkB,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE;KACtD,CAAC;IAEF,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/tools/create-spec-hu/ac-adapters/architecture-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ProjectKnowledge } from '../../../types/index.js';
+/**
+ * Returns AC lines specific to the project's primary architecture pattern.
+ * Returns an empty array for unknown or unrecognized patterns — no generic ACs.
+ */
+export declare function generateArchitectureAcs(knowledge: ProjectKnowledge): string[];
+//# sourceMappingURL=architecture-adapter.d.ts.map

package/dist/tools/create-spec-hu/ac-adapters/architecture-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecture-adapter.d.ts","sourceRoot":"","sources":["../../../../src/tools/create-spec-hu/ac-adapters/architecture-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAyH7E"}

package/dist/tools/create-spec-hu/ac-adapters/architecture-adapter.js

@@ -0,0 +1,114 @@
+// tools/create-spec-hu/ac-adapters/architecture-adapter.ts
+// Generates specialized ACs based on the detected primary architecture pattern.
+/**
+ * Returns AC lines specific to the project's primary architecture pattern.
+ * Returns an empty array for unknown or unrecognized patterns — no generic ACs.
+ */
+export function generateArchitectureAcs(knowledge) {
+    const pattern = knowledge.architecture.primary;
+    switch (pattern) {
+        case 'hexagonal':
+        case 'clean-architecture':
+        case 'onion':
+            return [
+                '- [ ] Port interface defined in types/, adapter implements it without leaking infrastructure details',
+                '- [ ] No direct imports from outer layers (infrastructure/tools) into inner layers (domain/use-cases)',
+                '- [ ] Use case function has single responsibility and delegates I/O to injected port',
+            ];
+        case 'microservices':
+            return [
+                '- [ ] Service boundary clearly defined — no direct DB access across service boundaries',
+                '- [ ] API contract versioned (e.g. /v1/ prefix or Accept-Version header)',
+                '- [ ] Circuit breaker or timeout configured for all external service calls',
+            ];
+        case 'event-driven':
+        case 'event-sourcing':
+            return [
+                '- [ ] Event schema defined and validated with Zod or JSON Schema before publish',
+                '- [ ] Dead letter queue (or equivalent) configured to capture failed event processing',
+                '- [ ] Event handler is idempotent: processing the same event twice produces no side effects',
+            ];
+        case 'serverless':
+            return [
+                '- [ ] Cold start time documented in performance notes (target: <500ms p95)',
+                '- [ ] Function timeout explicitly configured — not relying on platform default',
+                '- [ ] Execution is stateless: no in-memory state assumed to persist between invocations',
+            ];
+        case 'monolith':
+        case 'modular-monolith':
+        case 'layered':
+            return [
+                '- [ ] Module boundary respected: no circular dependencies between feature modules',
+                '- [ ] New feature behind a feature flag to enable safe incremental rollout',
+            ];
+        case 'cqrs':
+            return [
+                '- [ ] Command handler and query handler are in separate functions/classes',
+                '- [ ] Command returns void or an ID — not the updated read model',
+                '- [ ] Read model projection stays eventually consistent within documented SLA',
+            ];
+        case 'saga':
+            return [
+                '- [ ] Each saga step is compensatable — compensating transaction defined for rollback',
+                '- [ ] Saga state persisted between steps (not held in memory)',
+                '- [ ] Timeout/failure path tested: partial saga completion leaves system in consistent state',
+            ];
+        case 'vertical-slice':
+            return [
+                '- [ ] Feature slice contains all layers (handler, business logic, data access) in one directory',
+                '- [ ] No shared mutable state between slices',
+                '- [ ] Cross-slice communication goes through defined contracts, not direct imports',
+            ];
+        case 'reactive':
+            return [
+                '- [ ] Backpressure handled: producer does not overwhelm consumer under load',
+                '- [ ] Stream errors handled and propagated without crashing the pipeline',
+                '- [ ] Subscriptions unsubscribed on component/service teardown',
+            ];
+        case 'ddd':
+            return [
+                '- [ ] Domain entity enforces invariants in constructor — invalid state not representable',
+                '- [ ] Aggregate root is the only entry point for mutations within its boundary',
+                '- [ ] Domain events emitted for meaningful state transitions (not CRUD verbs)',
+            ];
+        case 'bff':
+        case 'api-gateway':
+            return [
+                '- [ ] BFF/gateway does not contain business logic — it only aggregates and transforms',
+                '- [ ] Downstream service failures return a graceful fallback, not a 500',
+                '- [ ] Authentication/authorization enforced at gateway layer before forwarding',
+            ];
+        case 'graphql-federation':
+            return [
+                '- [ ] Subgraph schema extends the federated type correctly (no key conflicts)',
+                '- [ ] Resolver does not over-fetch — only requested fields queried from data source',
+                '- [ ] Federation composition validated in CI (rover subgraph check or equivalent)',
+            ];
+        case 'actor-model':
+        case 'temporal':
+            return [
+                '- [ ] Actor/workflow state machine has finite, documented state transitions',
+                '- [ ] Failure compensation logic (retry / compensate) defined for each activity',
+                '- [ ] Determinism enforced: no random, time, or I/O calls inside workflow/actor code',
+            ];
+        // Frontend/rendering patterns — no specialized backend ACs generated
+        case 'microfrontends':
+        case 'jamstack':
+        case 'islands':
+        case 'spa':
+        case 'mpa':
+        case 'ssr':
+        case 'ssg':
+        case 'isr':
+        case 'monorepo':
+        case 'multi-repo':
+        case 'cell-based':
+        case 'data-mesh':
+        case 'composable':
+        case 'custom':
+            return [];
+        default:
+            return [];
+    }
+}
+//# sourceMappingURL=architecture-adapter.js.map

package/dist/tools/create-spec-hu/ac-adapters/architecture-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecture-adapter.js","sourceRoot":"","sources":["../../../../src/tools/create-spec-hu/ac-adapters/architecture-adapter.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,gFAAgF;AAKhF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA2B;IACjE,MAAM,OAAO,GAAwB,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC;IAEpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW,CAAC;QACjB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO;gBACL,sGAAsG;gBACtG,uGAAuG;gBACvG,sFAAsF;aACvF,CAAC;QAEJ,KAAK,eAAe;YAClB,OAAO;gBACL,wFAAwF;gBACxF,0EAA0E;gBAC1E,4EAA4E;aAC7E,CAAC;QAEJ,KAAK,cAAc,CAAC;QACpB,KAAK,gBAAgB;YACnB,OAAO;gBACL,iFAAiF;gBACjF,uFAAuF;gBACvF,6FAA6F;aAC9F,CAAC;QAEJ,KAAK,YAAY;YACf,OAAO;gBACL,4EAA4E;gBAC5E,gFAAgF;gBAChF,yFAAyF;aAC1F,CAAC;QAEJ,KAAK,UAAU,CAAC;QAChB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO;gBACL,mFAAmF;gBACnF,4EAA4E;aAC7E,CAAC;QAEJ,KAAK,MAAM;YACT,OAAO;gBACL,2EAA2E;gBAC3E,kEAAkE;gBAClE,+EAA+E;aAChF,CAAC;QAEJ,KAAK,MAAM;YACT,OAAO;gBACL,uFAAuF;gBACvF,+DAA+D;gBAC/D,8FAA8F;aAC/F,CAAC;QAEJ,KAAK,gBAAgB;YACnB,OAAO;gBACL,iGAAiG;gBACjG,8CAA8C;gBAC9C,oFAAoF;aACrF,CAAC;QAEJ,KAAK,UAAU;YACb,OAAO;gBACL,6EAA6E;gBAC7E,0EAA0E;gBAC1E,gEAAgE;aACjE,CAAC;QAEJ,KAAK,KAAK;YACR,OAAO;gBACL,0FAA0F;gBAC1F,gFAAgF;gBAChF,+EAA+E;aAChF,CAAC;QAEJ,KAAK,KAAK,CAAC;QACX,KAAK,aAAa;YAChB,OAAO;gBACL,uFAAuF;gBACvF,yEAAyE;gBACzE,gFAAgF;aACjF,CAAC;QAEJ,KAAK,oBAAoB;YACvB,OAAO;gBACL,+EAA+E;gBAC/E,qFAAqF;gBACrF,mFAAmF;aACpF,CAAC;QAEJ,KAAK,aAAa,CAAC;QACnB,KAAK,UAAU;YACb,OAAO;gBACL,6EAA6E;gBAC7E,iFAAiF;gBACjF,sFAAsF;aACvF,CAAC;QAEJ,qEAAqE;QACrE,KAAK,gBAAgB,CAAC;QACtB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QAEZ;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/tools/create-spec-hu/ac-adapters/database-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { ProjectKnowledge } from '../../../types/index.js';
+/**
+ * Returns AC lines specific to the project's database engine.
+ * Returns an empty array when no database is detected.
+ */
+export declare function generateDatabaseAcs(knowledge: ProjectKnowledge): string[];
+//# sourceMappingURL=database-adapter.d.ts.map

package/dist/tools/create-spec-hu/ac-adapters/database-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-adapter.d.ts","sourceRoot":"","sources":["../../../../src/tools/create-spec-hu/ac-adapters/database-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAwChE;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA4BzE"}