@raytio/mcp-server 3.5.0 → 4.0.0

package/dist/capabilities/tool-capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-capability.d.ts","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,EACrB,eAAe,EAChB,MAAM,6BAA6B,CAAC;AAsBrC,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACjC;AAyDD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAoDpF,CAAC;AAUF,kEAAkE;AAClE,eAAO,MAAM,UAAU,UAA0B,CAAC;AAElD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASpD;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,GAAG,CACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,eAA+B,GACrC,qBAAqB,CAuBvB;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,eAA+B,GACrC,qBAAqB,EAAE,CAqBzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,sEAAsE;AACtE,wBAAgB,SAAS,IAAI,SAAS,MAAM,EAAE,CAE7C"}
+{"version":3,"file":"tool-capability.d.ts","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,EACrB,eAAe,EAChB,MAAM,6BAA6B,CAAC;AAsBrC,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACjC;AAoFD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAoDpF,CAAC;AAUF,kEAAkE;AAClE,eAAO,MAAM,UAAU,UAA0B,CAAC;AAElD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASpD;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,GAAG,CACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,eAA+B,GACrC,qBAAqB,CAuBvB;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,eAA+B,GACrC,qBAAqB,EAAE,CAqBzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,sEAAsE;AACtE,wBAAgB,SAAS,IAAI,SAAS,MAAM,EAAE,CAE7C"}

package/dist/capabilities/tool-capability.js

@@ -70,6 +70,33 @@ const CONTRACT_OVERRIDES = new Map([
             operations: new Set(['INSERT', 'SELECT', 'UPDATE']),
         },
     ],
+    // Interim: WI-0004859 will add EFFECTIVE_ASSIGNMENT_* to the Persist contract.
+    // Until it lands, map these views to WRM.WORKER_ROLE_ASSIGNMENTS#SELECT, which
+    // callers already hold — matching the permission WI-0004859 proposes.
+    [
+        'wrm_effective_assignment_model_prefs',
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'WORKER_ROLE_ASSIGNMENTS',
+            operations: new Set(['SELECT']),
+        },
+    ],
+    [
+        'wrm_effective_assignment_mcp_servers',
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'WORKER_ROLE_ASSIGNMENTS',
+            operations: new Set(['SELECT']),
+        },
+    ],
+    [
+        'wrm_effective_assignment_mcp_tools',
+        {
+            resourceGroup: 'WRM',
+            resourceName: 'WORKER_ROLE_ASSIGNMENTS',
+            operations: new Set(['SELECT']),
+        },
+    ],
 ]);
 /**
  * Capability requirements for the 6 RPC endpoints MCP calls. RPCs do not

package/dist/capabilities/tool-capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-capability.js","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAQ/C,MAAM,mBAAmB,GAA4C,CAAC,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE;YACtB,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,cAAc;YACjD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa;YAC/C,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,kBAAkB,GAA4C,IAAI,GAAG,CAAC;IAC1E;QACE,wBAAwB;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,oBAAoB;YAClC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,yBAAyB;QACzB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,mBAAmB;QACnB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA4D;IACvF,6BAA6B,EAAE;QAC7B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,gBAAgB;YAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;QACD;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,kBAAkB;YAChC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,+BAA+B,EAAE;QAC/B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,wBAAwB,EAAE;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,qBAAqB,EAAE;QACrB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,GAAqC;IACnD,GAAG,EAAE,QAAQ;IACb,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,yCAAyC;YACjE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,0CAA0C;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uCAAuC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,GAAG,CACjB,KAAa,EACb,SAAiB,EACjB,QAAyB,aAAa;IAEtC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,iBAAiB,OAAO,iBAAiB;YACpE,uCAAuC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,GAAG;YAC7F,eAAe,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,sBAAsB,KAAK,MAAM;YAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,OAAO;QAClB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,QAAyB,aAAa;IAEtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,+BAA+B;YAC3D,iEAAiE;YACjE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS;QACT,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"tool-capability.js","sourceRoot":"","sources":["../../src/capabilities/tool-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAQ/C,MAAM,mBAAmB,GAA4C,CAAC,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE;YACtB,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,cAAc;YACjD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa;YAC/C,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,MAAM,kBAAkB,GAA4C,IAAI,GAAG,CAAC;IAC1E;QACE,wBAAwB;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,oBAAoB;YAClC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,yBAAyB;QACzB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD;QACE,mBAAmB;QACnB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,sEAAsE;IACtE;QACE,sCAAsC;QACtC;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,yBAAyB;YACvC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD;QACE,sCAAsC;QACtC;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,yBAAyB;YACvC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD;QACE,oCAAoC;QACpC;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,yBAAyB;YACvC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA4D;IACvF,6BAA6B,EAAE;QAC7B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,gBAAgB;YAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;QACD;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,kBAAkB;YAChC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,+BAA+B,EAAE;QAC/B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,0BAA0B,EAAE;QAC1B;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,wBAAwB,EAAE;QACxB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,eAAe;YAC7B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;IACD,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,qBAAqB,EAAE;QACrB;YACE,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;SAChC;KACF;CACF,CAAC;AAEF,MAAM,UAAU,GAAqC;IACnD,GAAG,EAAE,QAAQ;IACb,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAElD,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,yCAAyC;YACjE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,0CAA0C;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uCAAuC,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,GAAG,CACjB,KAAa,EACb,SAAiB,EACjB,QAAyB,aAAa;IAEtC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,iBAAiB,OAAO,iBAAiB;YACpE,uCAAuC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,GAAG;YAC7F,eAAe,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,OAAO,SAAS,sBAAsB,KAAK,MAAM;YAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,OAAO;QAClB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,QAAyB,aAAa;IAEtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,+BAA+B;YAC3D,iEAAiE;YACjE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS;QACT,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACvC,CAAC"}

package/dist/tools/_shared/side-effect.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/**
+ * Shared side-effect helpers for MCP write tools.
+ *
+ * Every side-effecting tool — command dispatch, provisioning, external
+ * sync, outbound communication, permission grant — needs the same three
+ * primitives so the caller contract is predictable across modules:
+ *
+ *  - `confirm: true` on consequential paths so a model cannot invoke
+ *    them accidentally;
+ *  - a caller-supplied `reason` on state transitions that leave an
+ *    audit trail (revoke, unassign, cancel);
+ *  - an optional `idempotency_key` forwarded as an `Idempotency-Key`
+ *    header so retries converge on the original result rather than
+ *    creating a duplicate row / grant / message.
+ *
+ * The MCP server does not maintain its own dedupe cache — the
+ * canonical answer lives in Persist. This module keeps the input
+ * schema and header-injection logic in one place so every write path
+ * surfaces the same contract.
+ */
+export declare const idempotencyKeySchema: z.ZodOptional<z.ZodString>;
+/**
+ * Build the request headers for a side-effecting mutation. Passes
+ * through `Prefer: return=representation` (needed for PostgREST to
+ * echo the created/updated row) and adds `Idempotency-Key` when
+ * supplied.
+ */
+export declare function writeHeadersWithIdempotency(idempotencyKey: string | undefined): Record<string, string>;
+export declare const confirmFlagSchema: z.ZodLiteral<true>;
+export declare const reasonSchema: z.ZodString;
+//# sourceMappingURL=side-effect.d.ts.map

package/dist/tools/_shared/side-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"side-effect.d.ts","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,oBAAoB,4BAa9B,CAAC;AAEJ;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED,eAAO,MAAM,iBAAiB,oBAY3B,CAAC;AAEJ,eAAO,MAAM,YAAY,aAG2B,CAAC"}

package/dist/tools/_shared/side-effect.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+/**
+ * Shared side-effect helpers for MCP write tools.
+ *
+ * Every side-effecting tool — command dispatch, provisioning, external
+ * sync, outbound communication, permission grant — needs the same three
+ * primitives so the caller contract is predictable across modules:
+ *
+ *  - `confirm: true` on consequential paths so a model cannot invoke
+ *    them accidentally;
+ *  - a caller-supplied `reason` on state transitions that leave an
+ *    audit trail (revoke, unassign, cancel);
+ *  - an optional `idempotency_key` forwarded as an `Idempotency-Key`
+ *    header so retries converge on the original result rather than
+ *    creating a duplicate row / grant / message.
+ *
+ * The MCP server does not maintain its own dedupe cache — the
+ * canonical answer lives in Persist. This module keeps the input
+ * schema and header-injection logic in one place so every write path
+ * surfaces the same contract.
+ */
+export const idempotencyKeySchema = z
+    .string()
+    .min(8)
+    .max(128)
+    .regex(/^[A-Za-z0-9._~:-]+$/, 'idempotency_key must be a URL-safe token (letters, digits, `.`, `_`, `~`, `:`, `-`)')
+    .optional()
+    .describe('Optional caller-supplied idempotency key. Reusing the same key with equivalent ' +
+    'inputs converges to the original result rather than creating a duplicate. ' +
+    'Must be a URL-safe token of 8–128 characters.');
+/**
+ * Build the request headers for a side-effecting mutation. Passes
+ * through `Prefer: return=representation` (needed for PostgREST to
+ * echo the created/updated row) and adds `Idempotency-Key` when
+ * supplied.
+ */
+export function writeHeadersWithIdempotency(idempotencyKey) {
+    const headers = {
+        Prefer: 'return=representation',
+    };
+    if (idempotencyKey) {
+        headers['Idempotency-Key'] = idempotencyKey;
+    }
+    return headers;
+}
+export const confirmFlagSchema = z
+    .literal(true, {
+    errorMap: () => ({
+        message: 'confirm must be set to `true` to acknowledge that this is a side-effecting action ' +
+            'that changes durable state.',
+    }),
+})
+    .describe('Must be `true` to execute. Present so a model cannot accidentally grant a ' +
+    'permission, revoke a role, or transition a security session without an ' +
+    'explicit confirmation step.');
+export const reasonSchema = z
+    .string()
+    .min(4, 'reason must be at least 4 characters')
+    .max(500, 'reason must be at most 500 characters');
+//# sourceMappingURL=side-effect.js.map

package/dist/tools/_shared/side-effect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"side-effect.js","sourceRoot":"","sources":["../../../src/tools/_shared/side-effect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,qBAAqB,EACrB,qFAAqF,CACtF;KACA,QAAQ,EAAE;KACV,QAAQ,CACP,iFAAiF;IAC/E,4EAA4E;IAC5E,+CAA+C,CAClD,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,cAAkC;IAElC,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,uBAAuB;KAChC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,OAAO,CAAC,IAAI,EAAE;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EACL,oFAAoF;YAClF,6BAA6B;KAClC,CAAC;CACH,CAAC;KACD,QAAQ,CACP,4EAA4E;IAC1E,yEAAyE;IACzE,6BAA6B,CAChC,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,sCAAsC,CAAC;KAC9C,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC"}

package/dist/tools/domains.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAOrC;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,eAAO,MAAM,cAAc,EAAE,aAAa,EAoCzC,CAAC;AAwDF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAU9C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,CAepD"}
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAUrC;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,eAAO,MAAM,cAAc,EAAE,aAAa,EAyDzC,CAAC;AAwDF;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAgB9C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,CAepD"}

package/dist/tools/domains.js

@@ -3,6 +3,9 @@ import { ppmTools } from './ppm/index.js';
 import { prmTools } from './prm/index.js';
 import { sfaTools } from './sfa/index.js';
 import { wrmTools } from './wrm/index.js';
+import { fndReadOnlyTools, fndTools } from './fnd/index.js';
+import { hrmReadOnlyTools, hrmTools } from './hrm/index.js';
+import { secReadOnlyTools, secTools } from './sec/index.js';
 export const primaryDomains = [
     {
         id: 'dsm',
@@ -34,6 +37,24 @@ export const primaryDomains = [
         summary: 'Manage AI worker identities, model stacks, MCP tool registrations, roles, role memories, and agent run steps/artifacts.',
         tools: wrmTools,
     },
+    {
+        id: 'fnd',
+        title: 'FND — Foundation',
+        summary: 'Bounded reads for approved Foundation reference and configuration data — labels, entity labels, domains, locales, RUC enforcement, menus, notification topics, tenants, integration links, ETL templates, report templates, and documents (plus versions and attachments). Administrative, credentialed, and internal-permission FND tables remain excluded.',
+        tools: fndTools,
+    },
+    {
+        id: 'hrm',
+        title: 'HRM — Human Resources Management',
+        summary: 'Bounded reads plus explicit-schema mutations for user role assignments, role inheritance, role→policy attachments, and direct user→policy attachments. Every write requires confirm=true; revocations additionally require a caller-supplied reason. Authentication internals and role definitions remain read-only.',
+        tools: hrmTools,
+    },
+    {
+        id: 'sec',
+        title: 'SEC — Security',
+        summary: 'Dedicated semantic tools for the QR pairing session lifecycle (start / join / complete / cancel), plus bounded reads with secret redaction. Every write requires confirm=true; cancellation additionally requires a reason.',
+        tools: secTools,
+    },
 ];
 const PPM_READ_TOOL_NAMES = new Set([
     'ppm_work_item_get',
@@ -98,6 +119,12 @@ export const domainIndex = {
     'sfa-readonly': sfaTools.filter((t) => SFA_READ_TOOL_NAMES.has(t.name)),
     wrm: wrmTools,
     'wrm-readonly': wrmTools.filter((t) => WRM_READ_TOOL_NAMES.has(t.name)),
+    fnd: fndTools,
+    'fnd-readonly': fndReadOnlyTools,
+    hrm: hrmTools,
+    'hrm-readonly': hrmReadOnlyTools,
+    sec: secTools,
+    'sec-readonly': secReadOnlyTools,
 };
 /**
  * Resolve a comma-separated list of domain IDs to the corresponding set

package/dist/tools/domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAa1C,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,+BAA+B;QACtC,OAAO,EACL,+FAA+F;QACjG,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,oCAAoC;QAC3C,OAAO,EACL,oFAAoF;QACtF,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,qCAAqC;QAC5C,OAAO,EACL,6FAA6F;QAC/F,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,8BAA8B;QACrC,OAAO,EACL,2IAA2I;QAC7I,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EACL,yHAAyH;QAC3H,KAAK,EAAE,QAAQ;KAChB;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,yBAAyB;IACzB,+BAA+B;IAC/B,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,wBAAwB;CACzB,CAAC,CAAC;AAEH,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE,CACxD,IAAI,KAAK,gBAAgB;IACzB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAExB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,eAAe;IACf,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;IAC3B,uBAAuB;IACvB,4BAA4B;IAC5B,4BAA4B;IAC5B,iCAAiC;IACjC,wBAAwB;IACxB,mBAAmB;IACnB,4BAA4B;IAC5B,gCAAgC;CACjC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;CACxE,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,iBAAiB,SAAS,GAAG,CACxE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/tools/domains.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAa5D,MAAM,CAAC,MAAM,cAAc,GAAoB;IAC7C;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,+BAA+B;QACtC,OAAO,EACL,+FAA+F;QACjG,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,oCAAoC;QAC3C,OAAO,EACL,oFAAoF;QACtF,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,qCAAqC;QAC5C,OAAO,EACL,6FAA6F;QAC/F,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,8BAA8B;QACrC,OAAO,EACL,2IAA2I;QAC7I,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EACL,yHAAyH;QAC3H,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,kBAAkB;QACzB,OAAO,EACL,8VAA8V;QAChW,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,kCAAkC;QACzC,OAAO,EACL,sTAAsT;QACxT,KAAK,EAAE,QAAQ;KAChB;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,gBAAgB;QACvB,OAAO,EACL,6NAA6N;QAC/N,KAAK,EAAE,QAAQ;KAChB;CACF,CAAC;AAEF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,yBAAyB;IACzB,+BAA+B;IAC/B,0BAA0B;IAC1B,mBAAmB;IACnB,kBAAkB;IAClB,wBAAwB;CACzB,CAAC,CAAC;AAEH,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE,CACxD,IAAI,KAAK,gBAAgB;IACzB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAExB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,eAAe;IACf,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;IAC3B,uBAAuB;IACvB,4BAA4B;IAC5B,4BAA4B;IAC5B,iCAAiC;IACjC,wBAAwB;IACxB,mBAAmB;IACnB,4BAA4B;IAC5B,gCAAgC;CACjC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAA2B;IACjD,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,gBAAgB;IAChC,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,gBAAgB;IAChC,GAAG,EAAE,QAAQ;IACb,cAAc,EAAE,gBAAgB;CACjC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,iBAAiB,SAAS,GAAG,CACxE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/tools/fnd/generated-reads.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+import { CatalogueReport } from '../../generated-reads/index.js';
+export declare const fndGeneratedReadReport: CatalogueReport;
+export declare const fndGeneratedReadTools: Tool[];
+//# sourceMappingURL=generated-reads.d.ts.map

package/dist/tools/fnd/generated-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.d.ts","sourceRoot":"","sources":["../../../src/tools/fnd/generated-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAGL,eAAe,EAChB,MAAM,gCAAgC,CAAC;AA0CxC,eAAO,MAAM,sBAAsB,EAAE,eAC8B,CAAC;AAEpE,eAAO,MAAM,qBAAqB,EAAE,IAAI,EAGvC,CAAC"}

package/dist/tools/fnd/generated-reads.js

@@ -0,0 +1,42 @@
+import { buildGeneratedReadCatalogue, buildGeneratedReadCatalogueReport, } from '../../generated-reads/index.js';
+import { loadPersistResourceContract } from '../../contracts/persist-resource-contract.js';
+/**
+ * Bounded read tools for the FND module (WI-0003503).
+ *
+ * The schema-driven catalogue (WI-0003500) emits describe/list/get for
+ * every `normal`-sensitivity FND resource that declares a read
+ * operation and has no side effects. The pinned Persist contract
+ * already excludes the noise for us:
+ *
+ *  - internal permission model tables (fnd_authz_*, fnd_permissions,
+ *    fnd_permission_group*) — MCP consumes derived capabilities;
+ *  - job / worker infrastructure (fnd_jobs, fnd_job_schedules,
+ *    fnd_workers, fnd_programs, fnd_worker_managers) — not part of
+ *    the "approved" tenant/job read surface for this WI;
+ *  - seed lookups (fnd_lookups, fnd_countries, fnd_categories, …)
+ *    which are already carried in downstream lookup tables;
+ *  - log tables (fnd_job_logs, fnd_inbound_webhook_logs, …).
+ *
+ * The remaining `normal` FND surface — approved reference /
+ * configuration data (labels, entity labels, domains, locales, RUC
+ * enforcement modes), documents and their versions/attachments,
+ * ETL templates, menus, notification topics, report templates,
+ * tenants, tenants_domain, and integration-object links — lands
+ * automatically. Sensitive FND resources (notification destinations,
+ * provider subscriptions, role menus / overrides, tenant parameters,
+ * tenant users, tenant users directory) are deliberately EXCLUDED to
+ * preserve administrative restrictions.
+ *
+ * Side-effecting FND rows (fnd_notification_subscriptions,
+ * fnd_notification_templates) are hard-excluded by the guardrails
+ * because they carry `emits_notifications` / `templates_notifications`
+ * markers, and no `includeSideEffects` opt-in exists.
+ *
+ * FND is a bounded-read-only surface for this WI — every mutating
+ * FND workflow currently belongs to another team; when a semantic
+ * endpoint lands, a dedicated tool will be added here.
+ */
+const contract = loadPersistResourceContract();
+export const fndGeneratedReadReport = buildGeneratedReadCatalogueReport(contract, { modules: ['fnd'] });
+export const fndGeneratedReadTools = buildGeneratedReadCatalogue(contract, { modules: ['fnd'] });
+//# sourceMappingURL=generated-reads.js.map

package/dist/tools/fnd/generated-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.js","sourceRoot":"","sources":["../../../src/tools/fnd/generated-reads.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GACjC,iCAAiC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CACtE,QAAQ,EACR,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CACrB,CAAC"}

package/dist/tools/fnd/index.d.ts

@@ -0,0 +1,13 @@
+import { Tool } from '../registry.js';
+/**
+ * FND tool surface (WI-0003503).
+ *
+ * FND is a bounded-read-only module in this WI — every mutation on
+ * FND rows is either handled elsewhere (permission model → derived
+ * capabilities; job scheduling → workers) or awaits a dedicated
+ * semantic endpoint.
+ */
+export declare const fndTools: Tool[];
+/** Read-only slice used by the `fnd-readonly` selectable sub-domain. */
+export declare const fndReadOnlyTools: Tool[];
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/fnd/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/fnd/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGtC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,EAAE,IAAI,EAA+B,CAAC;AAE3D,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,IAAI,EAA0B,CAAC"}

package/dist/tools/fnd/index.js

@@ -0,0 +1,13 @@
+import { fndGeneratedReadTools } from './generated-reads.js';
+/**
+ * FND tool surface (WI-0003503).
+ *
+ * FND is a bounded-read-only module in this WI — every mutation on
+ * FND rows is either handled elsewhere (permission model → derived
+ * capabilities; job scheduling → workers) or awaits a dedicated
+ * semantic endpoint.
+ */
+export const fndTools = [...fndGeneratedReadTools];
+/** Read-only slice used by the `fnd-readonly` selectable sub-domain. */
+export const fndReadOnlyTools = fndGeneratedReadTools;
+//# sourceMappingURL=index.js.map

package/dist/tools/fnd/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/fnd/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,GAAG,qBAAqB,CAAC,CAAC;AAE3D,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAW,qBAAqB,CAAC"}

package/dist/tools/hrm/generated-reads.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+import { CatalogueReport } from '../../generated-reads/index.js';
+export declare const hrmGeneratedReadReport: CatalogueReport;
+export declare const hrmGeneratedReadTools: Tool[];
+//# sourceMappingURL=generated-reads.d.ts.map

package/dist/tools/hrm/generated-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/generated-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAGL,eAAe,EAChB,MAAM,gCAAgC,CAAC;AAqCxC,eAAO,MAAM,sBAAsB,EAAE,eAIjC,CAAC;AAEL,eAAO,MAAM,qBAAqB,EAAE,IAAI,EAGvC,CAAC"}

package/dist/tools/hrm/generated-reads.js

@@ -0,0 +1,40 @@
+import { buildGeneratedReadCatalogue, buildGeneratedReadCatalogueReport, } from '../../generated-reads/index.js';
+import { loadPersistResourceContract } from '../../contracts/persist-resource-contract.js';
+/**
+ * Bounded read tools for the HRM module (WI-0003503).
+ *
+ * The pinned Persist contract carries seven HRM resources. The
+ * generic guardrails already exclude the four authentication-internal
+ * policy tables (hrm_authorization_policies, *_templates,
+ * hrm_permissions, hrm_role_permissions) via the
+ * `internal_permission_model` reason, so they never appear here.
+ *
+ * Of the remaining seven, four are classified `sensitive` because
+ * they describe who holds which permission — role definitions, role
+ * inheritance, role→policy assignment, and the user→role grant list:
+ *
+ *  - `hrm_user_roles`
+ *  - `hrm_user_role_assignments`
+ *  - `hrm_user_role_parents`
+ *  - `hrm_user_role_policy_assignments`
+ *
+ * These reads are genuinely needed to run "who has access to what"
+ * workflows — the exact use case this WI approves — so the catalogue
+ * is invoked with `includeSensitive: true`. The field-level redaction
+ * pass still strips any credential-shaped column; none of the HRM
+ * tables carry a password/token/secret field, but the check keeps the
+ * guardrail active if that ever changes.
+ *
+ * Every write on an HRM row lives in a dedicated hand-written tool
+ * (`hrm-user-role-*`, `hrm-user-policy-*`) with a confirmation flag
+ * and, for revocations, a caller-supplied reason. Role definitions
+ * (`hrm_user_roles`) and organisation records (`hrm_organizations_*`)
+ * are SELECT-only in the pinned contract and expose no write tool.
+ */
+const contract = loadPersistResourceContract();
+export const hrmGeneratedReadReport = buildGeneratedReadCatalogueReport(contract, {
+    modules: ['hrm'],
+    includeSensitive: true,
+});
+export const hrmGeneratedReadTools = buildGeneratedReadCatalogue(contract, { modules: ['hrm'], includeSensitive: true });
+//# sourceMappingURL=generated-reads.js.map

package/dist/tools/hrm/generated-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.js","sourceRoot":"","sources":["../../../src/tools/hrm/generated-reads.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GACjC,iCAAiC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CACtE,QAAQ,EACR,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC7C,CAAC"}

package/dist/tools/hrm/hrm-user-policy-assign.d.ts

@@ -0,0 +1,15 @@
+import { Tool } from '../registry.js';
+/**
+ * Attach an authorization policy directly to a user
+ * (`hrm_user_policy_assignments`).
+ *
+ * A direct policy assignment grants the user a specific permission
+ * bundle outside the role hierarchy, so this is a `provisioning`
+ * action that requires `confirm: true`. Natural key:
+ * (tenant_id, user_id, authorization_policy_id).
+ *
+ * Revocation is a separate semantic tool
+ * (`hrm_user_policy_unassign`) with a required audit reason.
+ */
+export declare const hrmUserPolicyAssignTool: Tool;
+//# sourceMappingURL=hrm-user-policy-assign.d.ts.map

package/dist/tools/hrm/hrm-user-policy-assign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-policy-assign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-policy-assign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAStC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAAE,IAgDrC,CAAC"}

package/dist/tools/hrm/hrm-user-policy-assign.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Attach an authorization policy directly to a user
+ * (`hrm_user_policy_assignments`).
+ *
+ * A direct policy assignment grants the user a specific permission
+ * bundle outside the role hierarchy, so this is a `provisioning`
+ * action that requires `confirm: true`. Natural key:
+ * (tenant_id, user_id, authorization_policy_id).
+ *
+ * Revocation is a separate semantic tool
+ * (`hrm_user_policy_unassign`) with a required audit reason.
+ */
+export const hrmUserPolicyAssignTool = {
+    name: 'hrm_user_policy_assign',
+    description: 'Attach an authorization policy directly to a user (hrm_user_policy_assignments). ' +
+        'Requires confirm=true, user_id, and authorization_policy_id. ' +
+        'Natural key: (tenant_id, user_id, authorization_policy_id). Retry-safe.',
+    inputSchema: z.object({
+        user_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the user receiving the direct policy assignment'),
+        authorization_policy_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_authorization_policies row being attached'),
+        start_date: z.string().datetime().optional(),
+        end_date: z.string().datetime().optional(),
+        metadata: z.record(z.unknown()).optional(),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_policy_assignments', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            user_id: input.user_id,
+            authorization_policy_id: input.authorization_policy_id,
+        };
+        for (const field of ['start_date', 'end_date', 'metadata']) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/hrm_user_policy_assignments?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to attach HRM user policy assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-policy-assign.js.map

package/dist/tools/hrm/hrm-user-policy-assign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-policy-assign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-policy-assign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAS;IAC3C,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,mFAAmF;QACnF,+DAA+D;QAC/D,yEAAyE;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,yDAAyD,CAAC;QACtE,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,2DAA2D,CAAC;QACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IAC5D,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,MAAM,IAAI,GAAwB;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;SACvD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,uCAAuC,EAClE,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-policy-unassign.d.ts

@@ -0,0 +1,8 @@
+import { Tool } from '../registry.js';
+/**
+ * Detach an authorization policy from a user by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Requires confirm=true and
+ * a reason for the audit trail.
+ */
+export declare const hrmUserPolicyUnassignTool: Tool;
+//# sourceMappingURL=hrm-user-policy-unassign.d.ts.map

package/dist/tools/hrm/hrm-user-policy-unassign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-policy-unassign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-policy-unassign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,IAqDvC,CAAC"}

package/dist/tools/hrm/hrm-user-policy-unassign.js

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, reasonSchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Detach an authorization policy from a user by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Requires confirm=true and
+ * a reason for the audit trail.
+ */
+export const hrmUserPolicyUnassignTool = {
+    name: 'hrm_user_policy_unassign',
+    description: 'Detach an authorization policy from a user by soft-closing the row ' +
+        '(active=false, end_date=now). Requires confirm=true and a reason. Retry-safe.',
+    inputSchema: z.object({
+        id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_policy_assignments row to detach'),
+        end_date: z.string().datetime().optional(),
+        confirm: confirmFlagSchema,
+        reason: reasonSchema.describe('Human-readable justification recorded on the audit trail'),
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_policy_assignments', 'UPDATE')],
+    sideEffect: 'state_change',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            active: false,
+            metadata: { unassign_reason: input.reason },
+        };
+        if (input.end_date !== undefined)
+            body.end_date = input.end_date;
+        try {
+            const rows = await ctx.apiClient.patch(`${ctx.apiClient.dbBasePath}/hrm_user_policy_assignments?id=eq.${input.id}&select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            if (!rows || rows.length === 0) {
+                return errorResponse(API_ERROR, `HRM user policy assignment ${input.id} not found or not accessible`);
+            }
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to detach HRM user policy assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-policy-unassign.js.map

package/dist/tools/hrm/hrm-user-policy-unassign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-policy-unassign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-policy-unassign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAS;IAC7C,IAAI,EAAE,0BAA0B;IAChC,WAAW,EACT,qEAAqE;QACrE,+EAA+E;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC;aACF,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,uDAAuD,CAAC;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAC3B,0DAA0D,CAC3D;QACD,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC;IAC5D,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAKb,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE;SAC5C,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CACpC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,sCAAsC,KAAK,CAAC,EAAE,WAAW,EACpF,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,aAAa,CAClB,SAAS,EACT,8BAA8B,KAAK,CAAC,EAAE,8BAA8B,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-assign.d.ts

@@ -0,0 +1,17 @@
+import { Tool } from '../registry.js';
+/**
+ * Grant a user a role assignment (`hrm_user_role_assignments`).
+ *
+ * A role grant confers durable authority inside the tenant, so this
+ * is a `provisioning` action that requires `confirm: true` and
+ * documents its natural key: (tenant_id, user_id, user_role_id).
+ * Reusing the same natural key with the same start_date converges on
+ * the original grant rather than creating a duplicate row.
+ *
+ * `active` and lifecycle transitions are NOT settable through this
+ * path — a grant is created active by default. Revocation is a
+ * separate semantic tool (`hrm_user_role_unassign`) that carries a
+ * reason for the audit trail.
+ */
+export declare const hrmUserRoleAssignTool: Tool;
+//# sourceMappingURL=hrm-user-role-assign.d.ts.map

package/dist/tools/hrm/hrm-user-role-assign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-assign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-assign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAStC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,IAwDnC,CAAC"}