@raytio/mcp-server 3.1.1 → 3.5.0

package/dist/capabilities/effective-capabilities.d.ts

@@ -99,10 +99,17 @@ export type WireCapabilityScope = (typeof WIRE_CAPABILITY_SCOPES)[number];
  * same semantic ("not a verified unbounded HRM grant — enforcement of
  * access is via ownership / ReBAC / row filters at call time").
  *
- * Internal-only rename to `ROW_BOUNDED` was deliberately deferred: no
- * tool currently declares a scope, so the alias keeps this WI a
- * one-file change (WI-0003661). Rename in a follow-up if the internal
- * vocabulary starts to feel misleading.
+ * Vocabulary decision (WI-0003678): the internal alias is permanent.
+ * WI-0003661 deferred the internal `OWN_RECORDS → ROW_BOUNDED` rename
+ * on the grounds that no tool declared a scope yet. WI-0003678 changed
+ * that — every tool in {@link Tool.capabilities} now declares
+ * requirements through the contract-derived {@link cap} helper, and
+ * OWN_RECORDS is the default scope that helper produces. Renaming at
+ * this point would touch every capability declaration for no wire-side
+ * benefit (the wire vocabulary is already `ROW_BOUNDED` in Persist and
+ * the transform on ingress hides that from the rest of the code path).
+ * Keep {@link CAPABILITY_SCOPES} as-is; do not add a `ROW_BOUNDED`
+ * alias inside MCP.
  */
 export declare const CAPABILITY_SCOPES: readonly ["ALL_RECORDS", "OWN_RECORDS"];
 export type CapabilityScope = (typeof CAPABILITY_SCOPES)[number];

package/dist/capabilities/effective-capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"effective-capabilities.d.ts","sourceRoot":"","sources":["../../src/capabilities/effective-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,wDAIzB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,yCAA0C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQjE;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;gCAuBzB,CAAC;AAEjB,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;yCAAwC,CAAC;AAEvF;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;gBAEzC,IAAI,EAAE,sBAAsB,EAAE;IAgB1C,oEAAoE;IACpE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;OAMG;IACH,MAAM,CACJ,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,eAAe,GAAG,SAAS;IAW9B;;;;;OAKG;IACH,SAAS,CAAC,WAAW,EAAE,qBAAqB,GAAG,OAAO;CAWvD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED,yCAAyC;AACzC,eAAO,MAAM,+BAA+B,8CACC,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,wBAAwB,CAAC,CAmBnC"}
+{"version":3,"file":"effective-capabilities.d.ts","sourceRoot":"","sources":["../../src/capabilities/effective-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,wDAIzB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,yCAA0C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQjE;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;gCAuBzB,CAAC;AAEjB,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;yCAAwC,CAAC;AAEvF;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBAAa,wBAAwB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;gBAEzC,IAAI,EAAE,sBAAsB,EAAE;IAgB1C,oEAAoE;IACpE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;;;;;OAMG;IACH,MAAM,CACJ,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,eAAe,GAAG,SAAS;IAW9B;;;;;OAKG;IACH,SAAS,CAAC,WAAW,EAAE,qBAAqB,GAAG,OAAO;CAWvD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACpB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED,yCAAyC;AACzC,eAAO,MAAM,+BAA+B,8CACC,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,wBAAwB,CAAC,CAmBnC"}

package/dist/capabilities/effective-capabilities.js

@@ -101,10 +101,17 @@ export const WIRE_CAPABILITY_SCOPES = [
  * same semantic ("not a verified unbounded HRM grant — enforcement of
  * access is via ownership / ReBAC / row filters at call time").
  *
- * Internal-only rename to `ROW_BOUNDED` was deliberately deferred: no
- * tool currently declares a scope, so the alias keeps this WI a
- * one-file change (WI-0003661). Rename in a follow-up if the internal
- * vocabulary starts to feel misleading.
+ * Vocabulary decision (WI-0003678): the internal alias is permanent.
+ * WI-0003661 deferred the internal `OWN_RECORDS → ROW_BOUNDED` rename
+ * on the grounds that no tool declared a scope yet. WI-0003678 changed
+ * that — every tool in {@link Tool.capabilities} now declares
+ * requirements through the contract-derived {@link cap} helper, and
+ * OWN_RECORDS is the default scope that helper produces. Renaming at
+ * this point would touch every capability declaration for no wire-side
+ * benefit (the wire vocabulary is already `ROW_BOUNDED` in Persist and
+ * the transform on ingress hides that from the rest of the code path).
+ * Keep {@link CAPABILITY_SCOPES} as-is; do not add a `ROW_BOUNDED`
+ * alias inside MCP.
  */
 export const CAPABILITY_SCOPES = ['ALL_RECORDS', 'OWN_RECORDS'];
 const wireScopeSchema = z

package/dist/capabilities/effective-capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"effective-capabilities.js","sourceRoot":"","sources":["../../src/capabilities/effective-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,aAAa;IACb,aAAa;IACb,aAAa;CACL,CAAC;AAGX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAU,CAAC;AAGzE,MAAM,eAAe,GAAG,CAAC;KACtB,IAAI,CAAC,sBAAsB,CAAC;KAC5B,SAAS,CAAC,CAAC,IAAI,EAAmB,EAAE,CACnC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,uDAAuD,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,KAAK,EAAE,eAAe;IACtB,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAmCvF;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;;OAMG;IACc,KAAK,CAA+B;IAErD,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,4DAA4D;YAC5D,kEAAkE;YAClE,2CAA2C;YAC3C,IAAI,QAAQ,KAAK,aAAa;gBAAE,SAAS;YACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,aAAqB,EACrB,YAAoB,EACpB,SAAiB;QAEjB,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,WAAkC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CACtB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,YAAY,EACxB,WAAW,CAAC,SAAS,CACtB,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,aAAa,CAAC;QAChD,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,KAAK,aAAa,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACX;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,+BAA+B,GAC1C,2CAA2C,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAA0B;IAE1B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAU,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,sCAAuC,KAAe,CAAC,OAAO,EAAE,EAChE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAwB,CAChC,sDAAsD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"effective-capabilities.js","sourceRoot":"","sources":["../../src/capabilities/effective-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,aAAa;IACb,aAAa;IACb,aAAa;CACL,CAAC;AAGX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAU,CAAC;AAGzE,MAAM,eAAe,GAAG,CAAC;KACtB,IAAI,CAAC,sBAAsB,CAAC;KAC5B,SAAS,CAAC,CAAC,IAAI,EAAmB,EAAE,CACnC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC9C,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,uDAAuD,CAAC;IACpE,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,KAAK,EAAE,eAAe;IACtB,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAmCvF;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;;OAMG;IACc,KAAK,CAA+B;IAErD,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,4DAA4D;YAC5D,kEAAkE;YAClE,2CAA2C;YAC3C,IAAI,QAAQ,KAAK,aAAa;gBAAE,SAAS;YACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CACJ,aAAqB,EACrB,YAAoB,EACpB,SAAiB;QAEjB,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,WAAkC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CACtB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,YAAY,EACxB,WAAW,CAAC,SAAS,CACtB,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,aAAa,CAAC;QAChD,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,KAAK,aAAa,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACX;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,+BAA+B,GAC1C,2CAA2C,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAA0B;IAE1B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAU,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,sCAAuC,KAAe,CAAC,OAAO,EAAE,EAChE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAwB,CAChC,sDAAsD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/capabilities/tool-capability.d.ts

@@ -0,0 +1,52 @@
+import { CapabilityRequirement, CapabilityScope } from './effective-capabilities.js';
+interface ContractPermission {
+    resourceGroup: string;
+    resourceName: string;
+    operations: ReadonlySet<string>;
+}
+/**
+ * Capability requirements for the 6 RPC endpoints MCP calls. RPCs do not
+ * have a `table` entry in the pinned contract, so a matching capability
+ * MUST be declared by hand here and referenced via {@link rpcCap}. A tool
+ * calling an RPC not listed here fails the completeness test.
+ */
+export declare const RPC_CAPABILITIES: Readonly<Record<string, readonly ContractPermission[]>>;
+/** All operations that MCP knows how to map from an HTTP verb. */
+export declare const HTTP_VERBS: string[];
+/** Convert an HTTP verb (lower-case) into the Persist operation code. */
+export declare function verbToOperation(verb: string): string;
+/**
+ * Return a {@link CapabilityRequirement} for a tool that calls
+ * `/db/v1/<table>` with the given operation.
+ *
+ * Fails fast on:
+ *  - unknown table (typo, dropped from contract, forgot to sync);
+ *  - operation not in the contract's `operations` list for that resource
+ *    (e.g. declaring UPDATE on a view that is SELECT-only);
+ *  - invalid scope (guarded by {@link CAPABILITY_SCOPES}).
+ *
+ * @param table     PostgREST endpoint segment (e.g. `ppm_work_items`).
+ * @param operation One of `SELECT|INSERT|UPDATE|DELETE`, case-insensitive.
+ *                  Also accepts the HTTP verb (`get`/`post`/`patch`/`delete`).
+ * @param scope     Defaults to `OWN_RECORDS`. Only set to `ALL_RECORDS`
+ *                  when the tool genuinely needs cross-record reach
+ *                  (tenant-wide list/summary tools). See the WI-0003678
+ *                  scope-guidance block.
+ */
+export declare function cap(table: string, operation: string, scope?: CapabilityScope): CapabilityRequirement;
+/**
+ * Return the capability requirement(s) for a tool that calls
+ * `/db/v1/rpc/<name>`. Every RPC MCP surfaces MUST have an entry in
+ * {@link RPC_CAPABILITIES}; a missing entry throws.
+ */
+export declare function rpcCap(name: string, scope?: CapabilityScope): CapabilityRequirement[];
+/**
+ * Test-only: is this table known to the helper (via contract or override)?
+ * The completeness test uses this to detect drift between the tool source
+ * and the pinned contract without shelling out through {@link cap}.
+ */
+export declare function isKnownTable(table: string): boolean;
+/** Test-only: names of all RPCs the helper knows a capability for. */
+export declare function knownRpcs(): readonly string[];
+export {};
+//# sourceMappingURL=tool-capability.d.ts.map

package/dist/capabilities/tool-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-capability.d.ts","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,EACrB,eAAe,EAChB,MAAM,6BAA6B,CAAC;AAsBrC,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACjC;AAyDD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAoDpF,CAAC;AAUF,kEAAkE;AAClE,eAAO,MAAM,UAAU,UAA0B,CAAC;AAElD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASpD;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,GAAG,CACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,eAA+B,GACrC,qBAAqB,CAuBvB;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,eAA+B,GACrC,qBAAqB,EAAE,CAqBzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,sEAAsE;AACtE,wBAAgB,SAAS,IAAI,SAAS,MAAM,EAAE,CAE7C"}

package/dist/capabilities/tool-capability.js

@@ -0,0 +1,238 @@
+import { loadPersistResourceContract } from '../contracts/persist-resource-contract.js';
+import { CAPABILITY_SCOPES, } from './effective-capabilities.js';
+/**
+ * Contract-derived helper for declaring `Tool.capabilities` (WI-0003678).
+ *
+ * The pinned Persist resource contract (`contracts/persist/mcp_resource_contract.json`)
+ * already carries the resource-group / resource-name / operations tuple for
+ * every table MCP is allowed to surface. Rather than hand-writing those tuples
+ * in every tool file (a 748-call surface across 188 tools with predictable
+ * copy-paste drift), a tool calls {@link cap} with the table and operation it
+ * touches — the helper resolves the tuple at module load, and typos or dropped
+ * tables produce a hard error immediately.
+ *
+ * The completeness test (`src/tools/capability-completeness.test.ts`) scans
+ * every tool source for `/db/v1/<table>` literals and enforces that each is
+ * covered by a declared capability. Without that test, missing declarations
+ * fail open — the tool stays advertised even though it will short-circuit on
+ * dispatch.
+ */
+const contract = loadPersistResourceContract();
+const TABLE_TO_PERMISSION = (() => {
+    const map = new Map();
+    for (const resource of contract.resources) {
+        map.set(resource.table, {
+            resourceGroup: resource.permission.resource_group,
+            resourceName: resource.permission.resource_name,
+            operations: new Set(resource.permission.operations.map((o) => o.toUpperCase())),
+        });
+    }
+    return map;
+})();
+/**
+ * Overrides for tables that are deliberately EXCLUDED from the pinned
+ * resource contract (credentials-sensitive, internal permission tables,
+ * platform infrastructure) but that legitimate MCP tools still need to
+ * declare capabilities against.
+ *
+ * Every entry is a documented, reviewed exception — anything not in the
+ * pinned contract and not listed here will throw at module load. Do not
+ * add entries speculatively: an entry here means "MCP tools call this
+ * endpoint and we accept the sensitivity trade-off". Removing a tool that
+ * used one of these should remove the entry too.
+ *
+ * Verified against Persist naming convention (`<module>_<plural_snake>` →
+ * `<MODULE>.<PLURAL_SNAKE_UPPER>`), consistent across all in-contract
+ * resources in the same module. See wrm/, fnd/ sections of the contract.
+ */
+const CONTRACT_OVERRIDES = new Map([
+    [
+        'wrm_worker_credentials',
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'WORKER_CREDENTIALS',
+            operations: new Set(['INSERT', 'SELECT', 'UPDATE']),
+        },
+    ],
+    [
+        'wrm_credential_requests',
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'CREDENTIAL_REQUESTS',
+            operations: new Set(['INSERT', 'SELECT', 'UPDATE']),
+        },
+    ],
+    [
+        'fnd_notifications',
+        {
+            resourceGroup: 'FND',
+            resourceName: 'NOTIFICATIONS',
+            operations: new Set(['INSERT', 'SELECT', 'UPDATE']),
+        },
+    ],
+]);
+/**
+ * Capability requirements for the 6 RPC endpoints MCP calls. RPCs do not
+ * have a `table` entry in the pinned contract, so a matching capability
+ * MUST be declared by hand here and referenced via {@link rpcCap}. A tool
+ * calling an RPC not listed here fails the completeness test.
+ */
+export const RPC_CAPABILITIES = {
+    ppm_instantiate_epic_template: [
+        {
+            resourceGroup: 'PPM',
+            resourceName: 'EPIC_TEMPLATES',
+            operations: new Set(['SELECT']),
+        },
+        {
+            resourceGroup: 'PPM',
+            resourceName: 'WORK_ITEMS',
+            operations: new Set(['INSERT']),
+        },
+    ],
+    wrm_knowledge_chunk_search: [
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'KNOWLEDGE_CHUNKS',
+            operations: new Set(['SELECT']),
+        },
+    ],
+    wrm_context_aware_memory_search: [
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'ROLE_MEMORIES',
+            operations: new Set(['SELECT']),
+        },
+    ],
+    wrm_semantic_memory_search: [
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'ROLE_MEMORIES',
+            operations: new Set(['SELECT']),
+        },
+    ],
+    wrm_update_memory_access: [
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'ROLE_MEMORIES',
+            operations: new Set(['UPDATE']),
+        },
+    ],
+    // fnd_authz_user_groups — advertised in the WI as a supported RPC; no
+    // current tool file calls it, but keep the row so a future consumer can
+    // reference it via `rpcCap('fnd_authz_user_groups')` without touching
+    // the helper. Verified as a semantic authz RPC per Persist docs.
+    fnd_authz_user_groups: [
+        {
+            resourceGroup: 'FND',
+            resourceName: 'USER_GROUPS',
+            operations: new Set(['SELECT']),
+        },
+    ],
+};
+const VERB_TO_OP = {
+    get: 'SELECT',
+    post: 'INSERT',
+    patch: 'UPDATE',
+    put: 'UPDATE',
+    delete: 'DELETE',
+};
+/** All operations that MCP knows how to map from an HTTP verb. */
+export const HTTP_VERBS = Object.keys(VERB_TO_OP);
+/** Convert an HTTP verb (lower-case) into the Persist operation code. */
+export function verbToOperation(verb) {
+    const op = VERB_TO_OP[verb.toLowerCase()];
+    if (!op) {
+        throw new Error(`Unknown HTTP verb "${verb}" — cannot map to a Persist operation. ` +
+            'Update VERB_TO_OP in src/capabilities/tool-capability.ts.');
+    }
+    return op;
+}
+function resolveTable(table) {
+    const fromContract = TABLE_TO_PERMISSION.get(table);
+    if (fromContract)
+        return fromContract;
+    const fromOverride = CONTRACT_OVERRIDES.get(table);
+    if (fromOverride)
+        return fromOverride;
+    throw new Error(`cap(): unknown table "${table}". The pinned Persist contract does not ` +
+        'declare a permission for it and no override is registered. Either the ' +
+        'table has been renamed / removed upstream (re-sync the contract with ' +
+        '`npm run contract:sync-resource`), or add a documented override in ' +
+        'src/capabilities/tool-capability.ts if MCP legitimately needs to hit ' +
+        'a resource excluded from the surface.');
+}
+/**
+ * Return a {@link CapabilityRequirement} for a tool that calls
+ * `/db/v1/<table>` with the given operation.
+ *
+ * Fails fast on:
+ *  - unknown table (typo, dropped from contract, forgot to sync);
+ *  - operation not in the contract's `operations` list for that resource
+ *    (e.g. declaring UPDATE on a view that is SELECT-only);
+ *  - invalid scope (guarded by {@link CAPABILITY_SCOPES}).
+ *
+ * @param table     PostgREST endpoint segment (e.g. `ppm_work_items`).
+ * @param operation One of `SELECT|INSERT|UPDATE|DELETE`, case-insensitive.
+ *                  Also accepts the HTTP verb (`get`/`post`/`patch`/`delete`).
+ * @param scope     Defaults to `OWN_RECORDS`. Only set to `ALL_RECORDS`
+ *                  when the tool genuinely needs cross-record reach
+ *                  (tenant-wide list/summary tools). See the WI-0003678
+ *                  scope-guidance block.
+ */
+export function cap(table, operation, scope = 'OWN_RECORDS') {
+    const permission = resolveTable(table);
+    const opUpper = VERB_TO_OP[operation.toLowerCase()] ?? operation.toUpperCase();
+    if (!permission.operations.has(opUpper)) {
+        throw new Error(`cap("${table}", "${operation}"): operation ${opUpper} is not in the ` +
+            `contract's permitted operations for ${permission.resourceGroup}.${permission.resourceName} ` +
+            `(supported: ${[...permission.operations].sort().join(', ')}). ` +
+            'Pick a different endpoint or fix the tool.');
+    }
+    if (!CAPABILITY_SCOPES.includes(scope)) {
+        throw new Error(`cap("${table}", "${operation}"): invalid scope "${scope}" — ` +
+            `must be one of ${CAPABILITY_SCOPES.join(', ')}.`);
+    }
+    return {
+        resourceGroup: permission.resourceGroup,
+        resourceName: permission.resourceName,
+        operation: opUpper,
+        scope,
+    };
+}
+/**
+ * Return the capability requirement(s) for a tool that calls
+ * `/db/v1/rpc/<name>`. Every RPC MCP surfaces MUST have an entry in
+ * {@link RPC_CAPABILITIES}; a missing entry throws.
+ */
+export function rpcCap(name, scope = 'OWN_RECORDS') {
+    const perms = RPC_CAPABILITIES[name];
+    if (!perms) {
+        throw new Error(`rpcCap(): unknown RPC "${name}". Add a documented entry to ` +
+            'RPC_CAPABILITIES in src/capabilities/tool-capability.ts before ' +
+            'referencing it from a tool.');
+    }
+    // Expand every operation in each entry. Taking only the first
+    // (`[...p.operations][0]`) silently dropped the rest, so a multi-op
+    // entry would under-declare and the tool would be advertised more
+    // permissively than it can actually execute.
+    return perms.flatMap((p) => [...p.operations].map((operation) => ({
+        resourceGroup: p.resourceGroup,
+        resourceName: p.resourceName,
+        operation,
+        scope,
+    })));
+}
+/**
+ * Test-only: is this table known to the helper (via contract or override)?
+ * The completeness test uses this to detect drift between the tool source
+ * and the pinned contract without shelling out through {@link cap}.
+ */
+export function isKnownTable(table) {
+    return TABLE_TO_PERMISSION.has(table) || CONTRACT_OVERRIDES.has(table);
+}
+/** Test-only: names of all RPCs the helper knows a capability for. */
+export function knownRpcs() {
+    return Object.keys(RPC_CAPABILITIES);
+}
+//# sourceMappingURL=tool-capability.js.map

package/dist/capabilities/tool-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-capability.js","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAQ/C,MAAM,mBAAmB,GAA4C,CAAC,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE;YACtB,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,cAAc;YACjD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa;YAC/C,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,kBAAkB,GAA4C,IAAI,GAAG,CAAC;IAC1E;QACE,wBAAwB;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,oBAAoB;YAClC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,yBAAyB;QACzB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,mBAAmB;QACnB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA4D;IACvF,6BAA6B,EAAE;QAC7B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,gBAAgB;YAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;QACD;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,kBAAkB;YAChC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,+BAA+B,EAAE;QAC/B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,wBAAwB,EAAE;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,qBAAqB,EAAE;QACrB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,GAAqC;IACnD,GAAG,EAAE,QAAQ;IACb,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,yCAAyC;YACjE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,0CAA0C;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uCAAuC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,GAAG,CACjB,KAAa,EACb,SAAiB,EACjB,QAAyB,aAAa;IAEtC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,iBAAiB,OAAO,iBAAiB;YACpE,uCAAuC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,GAAG;YAC7F,eAAe,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,sBAAsB,KAAK,MAAM;YAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,OAAO;QAClB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,QAAyB,aAAa;IAEtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,+BAA+B;YAC3D,iEAAiE;YACjE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS;QACT,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACvC,CAAC"}

package/dist/generated-reads/catalogue.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Assemble the full set of generated read tools from a pinned Persist
+ * resource contract. Consumers pass the contract loaded by
+ * {@link loadPersistResourceContract}; this module hands back a
+ * deterministic, filterable list of {@link Tool} objects ready to be
+ * exposed alongside hand-written tools.
+ *
+ * Safety filters applied by default (WI-0003501):
+ *
+ *  - Resources without a `list` or `read` operation are skipped — the
+ *    resource may exist only for write-only side-effect paths.
+ *  - Resources with `sensitivity` other than `normal` are skipped.
+ *    Callers who genuinely need them must set `includeSensitive: true`
+ *    on the filter; the resource-tools factory will still redact any
+ *    credential-shaped columns from every response.
+ *  - Resources that declare `side_effects` are ALWAYS skipped — there
+ *    is no opt-in. Generic CRUD around a state-transition or
+ *    notification path is a category error; dedicated tools with
+ *    explicit confirmation/idempotency semantics are required.
+ *
+ * Composite-primary-key resources still get describe + list; only the
+ * get-by-id tool is skipped.
+ */
+import type { PersistResource, PersistResourceContract } from '../contracts/persist-resource-contract.js';
+import { Tool } from '../tools/registry.js';
+import { ExclusionReason } from './guardrails.js';
+export interface CatalogueFilter {
+    /** Only emit tools for these modules. Case-insensitive; empty = all. */
+    modules?: string[];
+    /** Additional predicate — return `true` to include the resource. */
+    include?: (resource: PersistResource) => boolean;
+    /**
+     * When `true`, resources marked `sensitive`/`restricted` become
+     * eligible. Sensitive-field redaction still applies — the caller
+     * gains access to the resource's non-secret columns only. Default
+     * `false`.
+     *
+     * Side-effecting resources are NEVER made eligible by this flag —
+     * dedicated tools remain the only supported path for them.
+     */
+    includeSensitive?: boolean;
+}
+/**
+ * Result of one resource's exclusion, exposed on the report so
+ * operators and doc generators can explain "why is `foo_list` not in
+ * the surface?" without re-implementing the guardrails.
+ */
+export interface CatalogueExclusion {
+    resourceId: string;
+    module: string;
+    reasons: ExclusionReason[];
+}
+/** Report returned alongside the generated tool list. */
+export interface CatalogueReport {
+    tools: Tool[];
+    excluded: CatalogueExclusion[];
+}
+/**
+ * Deterministic, sorted list of generated read tools drawn from the
+ * pinned contract. Sorting is by (module, resource_id, tool_name) so
+ * `docs/tools.md` regeneration is reproducible.
+ *
+ * Sensitive and side-effecting resources are filtered out by default —
+ * see {@link CatalogueFilter} for the opt-in that lifts the sensitivity
+ * bar (nothing lifts the side-effect bar).
+ */
+export declare function buildGeneratedReadCatalogue(contract: PersistResourceContract, filter?: CatalogueFilter): Tool[];
+/**
+ * Same as {@link buildGeneratedReadCatalogue}, but also returns the list
+ * of resources the guardrails excluded and why. Used by tests and the
+ * doc generator to prove that the safety filter is doing its job — a
+ * silent skip is indistinguishable from a bug.
+ */
+export declare function buildGeneratedReadCatalogueReport(contract: PersistResourceContract, filter?: CatalogueFilter): CatalogueReport;
+/**
+ * Group the generated read tools by module. Modules with no eligible
+ * resources are omitted from the returned record.
+ */
+export declare function groupGeneratedReadsByModule(contract: PersistResourceContract, filter?: CatalogueFilter): Record<string, Tool[]>;
+//# sourceMappingURL=catalogue.d.ts.map

package/dist/generated-reads/catalogue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.d.ts","sourceRoot":"","sources":["../../src/generated-reads/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAK5C,OAAO,EAEL,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,oEAAoE;IACpE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC;IACjD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAmBD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,uBAAuB,EACjC,MAAM,GAAE,eAAoB,GAC3B,IAAI,EAAE,CAER;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,uBAAuB,EACjC,MAAM,GAAE,eAAoB,GAC3B,eAAe,CAkCjB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,uBAAuB,EACjC,MAAM,GAAE,eAAoB,GAC3B,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAqBxB"}

package/dist/generated-reads/catalogue.js

@@ -0,0 +1,127 @@
+/**
+ * Assemble the full set of generated read tools from a pinned Persist
+ * resource contract. Consumers pass the contract loaded by
+ * {@link loadPersistResourceContract}; this module hands back a
+ * deterministic, filterable list of {@link Tool} objects ready to be
+ * exposed alongside hand-written tools.
+ *
+ * Safety filters applied by default (WI-0003501):
+ *
+ *  - Resources without a `list` or `read` operation are skipped — the
+ *    resource may exist only for write-only side-effect paths.
+ *  - Resources with `sensitivity` other than `normal` are skipped.
+ *    Callers who genuinely need them must set `includeSensitive: true`
+ *    on the filter; the resource-tools factory will still redact any
+ *    credential-shaped columns from every response.
+ *  - Resources that declare `side_effects` are ALWAYS skipped — there
+ *    is no opt-in. Generic CRUD around a state-transition or
+ *    notification path is a category error; dedicated tools with
+ *    explicit confirmation/idempotency semantics are required.
+ *
+ * Composite-primary-key resources still get describe + list; only the
+ * get-by-id tool is skipped.
+ */
+import { buildResourceTools, } from './resource-tools.js';
+import { evaluateResourceEligibility, } from './guardrails.js';
+function moduleMatches(resource, filter) {
+    if (!filter.modules || filter.modules.length === 0)
+        return true;
+    const wanted = new Set(filter.modules.map((m) => m.toLowerCase()));
+    return wanted.has(resource.module.toLowerCase());
+}
+function predicateMatches(resource, filter) {
+    if (!filter.include)
+        return true;
+    return filter.include(resource);
+}
+function collectTools(triple) {
+    const out = [triple.describe, triple.list];
+    if (triple.get)
+        out.push(triple.get);
+    return out;
+}
+/**
+ * Deterministic, sorted list of generated read tools drawn from the
+ * pinned contract. Sorting is by (module, resource_id, tool_name) so
+ * `docs/tools.md` regeneration is reproducible.
+ *
+ * Sensitive and side-effecting resources are filtered out by default —
+ * see {@link CatalogueFilter} for the opt-in that lifts the sensitivity
+ * bar (nothing lifts the side-effect bar).
+ */
+export function buildGeneratedReadCatalogue(contract, filter = {}) {
+    return buildGeneratedReadCatalogueReport(contract, filter).tools;
+}
+/**
+ * Same as {@link buildGeneratedReadCatalogue}, but also returns the list
+ * of resources the guardrails excluded and why. Used by tests and the
+ * doc generator to prove that the safety filter is doing its job — a
+ * silent skip is indistinguishable from a bug.
+ */
+export function buildGeneratedReadCatalogueReport(contract, filter = {}) {
+    const chosen = [];
+    const excluded = [];
+    for (const resource of contract.resources) {
+        if (!moduleMatches(resource, filter))
+            continue;
+        const decision = evaluateResourceEligibility(resource, {
+            includeSensitive: filter.includeSensitive,
+        });
+        if (!decision.eligible) {
+            excluded.push({
+                resourceId: resource.resource_id,
+                module: resource.module,
+                reasons: decision.reasons,
+            });
+            continue;
+        }
+        if (!predicateMatches(resource, filter))
+            continue;
+        chosen.push(resource);
+    }
+    chosen.sort((a, b) => {
+        const byModule = a.module.localeCompare(b.module);
+        if (byModule !== 0)
+            return byModule;
+        return a.resource_id.localeCompare(b.resource_id);
+    });
+    excluded.sort((a, b) => {
+        const byModule = a.module.localeCompare(b.module);
+        if (byModule !== 0)
+            return byModule;
+        return a.resourceId.localeCompare(b.resourceId);
+    });
+    const tools = [];
+    for (const resource of chosen) {
+        tools.push(...collectTools(buildResourceTools(resource)));
+    }
+    return { tools, excluded };
+}
+/**
+ * Group the generated read tools by module. Modules with no eligible
+ * resources are omitted from the returned record.
+ */
+export function groupGeneratedReadsByModule(contract, filter = {}) {
+    const grouped = {};
+    const all = buildGeneratedReadCatalogue(contract, filter);
+    const byName = new Map();
+    for (const resource of contract.resources)
+        byName.set(resource.resource_id, resource);
+    for (const tool of all) {
+        // Recover the module from the resource_id prefix embedded in the
+        // tool name: `<resource_id>_(describe|list|get)`.
+        const suffixes = ['_describe', '_list', '_get'];
+        let resourceId = null;
+        for (const suffix of suffixes) {
+            if (tool.name.endsWith(suffix)) {
+                resourceId = tool.name.slice(0, -suffix.length);
+                break;
+            }
+        }
+        const resource = resourceId ? byName.get(resourceId) : undefined;
+        const module = resource?.module ?? 'unknown';
+        (grouped[module] ??= []).push(tool);
+    }
+    return grouped;
+}
+//# sourceMappingURL=catalogue.js.map

package/dist/generated-reads/catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.js","sourceRoot":"","sources":["../../src/generated-reads/catalogue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,OAAO,EACL,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,2BAA2B,GAE5B,MAAM,iBAAiB,CAAC;AAoCzB,SAAS,aAAa,CAAC,QAAyB,EAAE,MAAuB;IACvE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAyB,EAAE,MAAuB;IAC1E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B;IAClD,MAAM,GAAG,GAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAiC,EACjC,SAA0B,EAAE;IAE5B,OAAO,iCAAiC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAAiC,EACjC,SAA0B,EAAE;IAE5B,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,SAAS;QAC/C,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE;YACrD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,UAAU,EAAE,QAAQ,CAAC,WAAW;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,SAAS;QAClD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACpC,OAAO,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACpC,OAAO,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAiC,EACjC,SAA0B,EAAE;IAE5B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtF,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,iEAAiE;QACjE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;QACzD,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM;YACR,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,SAAS,CAAC;QAC7C,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}