@raytio/mcp-server 3.5.0 → 4.0.0

package/dist/tools/hrm/hrm-user-role-assign.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Grant a user a role assignment (`hrm_user_role_assignments`).
+ *
+ * A role grant confers durable authority inside the tenant, so this
+ * is a `provisioning` action that requires `confirm: true` and
+ * documents its natural key: (tenant_id, user_id, user_role_id).
+ * Reusing the same natural key with the same start_date converges on
+ * the original grant rather than creating a duplicate row.
+ *
+ * `active` and lifecycle transitions are NOT settable through this
+ * path — a grant is created active by default. Revocation is a
+ * separate semantic tool (`hrm_user_role_unassign`) that carries a
+ * reason for the audit trail.
+ */
+export const hrmUserRoleAssignTool = {
+    name: 'hrm_user_role_assign',
+    description: 'Grant a user a role assignment (hrm_user_role_assignments). Requires confirm=true, ' +
+        'user_id, and user_role_id; tenant_id is inferred from the caller. Natural key: ' +
+        '(tenant_id, user_id, user_role_id). Retry-safe.',
+    inputSchema: z.object({
+        user_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the user receiving the role assignment'),
+        user_role_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_roles row being granted'),
+        start_date: z
+            .string()
+            .datetime()
+            .optional()
+            .describe('Optional ISO-8601 start date; defaults to the persist backend clock'),
+        end_date: z
+            .string()
+            .datetime()
+            .optional()
+            .describe('Optional ISO-8601 end date; grants without an end date are open-ended'),
+        metadata: z.record(z.unknown()).optional(),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_assignments', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            user_id: input.user_id,
+            user_role_id: input.user_role_id,
+        };
+        for (const field of ['start_date', 'end_date', 'metadata']) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/hrm_user_role_assignments?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to grant HRM user role assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-assign.js.map

package/dist/tools/hrm/hrm-user-role-assign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-assign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-assign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAS;IACzC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,qFAAqF;QACrF,iFAAiF;QACjF,iDAAiD;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,8CAA8C,CAAC;QAC3D,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,qEAAqE,CAAC;QAClF,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,uEAAuE,CAAC;QACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;IAC1D,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,MAAM,IAAI,GAAwB;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,qCAAqC,EAChE,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,6CAA6C,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-parent-remove.d.ts

@@ -0,0 +1,9 @@
+import { Tool } from '../registry.js';
+/**
+ * Remove a parent → child role inheritance by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Breaks policy inheritance
+ * for every user in the child role, so this requires confirm=true and
+ * a reason.
+ */
+export declare const hrmUserRoleParentRemoveTool: Tool;
+//# sourceMappingURL=hrm-user-role-parent-remove.d.ts.map

package/dist/tools/hrm/hrm-user-role-parent-remove.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-parent-remove.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-parent-remove.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,IAqDzC,CAAC"}

package/dist/tools/hrm/hrm-user-role-parent-remove.js

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, reasonSchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Remove a parent → child role inheritance by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Breaks policy inheritance
+ * for every user in the child role, so this requires confirm=true and
+ * a reason.
+ */
+export const hrmUserRoleParentRemoveTool = {
+    name: 'hrm_user_role_parent_remove',
+    description: 'Remove a role parent-child inheritance link by soft-closing the row ' +
+        '(active=false, end_date=now). Requires confirm=true and a reason. Retry-safe.',
+    inputSchema: z.object({
+        id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_role_parents row to remove'),
+        end_date: z.string().datetime().optional(),
+        confirm: confirmFlagSchema,
+        reason: reasonSchema.describe('Human-readable justification recorded on the audit trail'),
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_parents', 'UPDATE')],
+    sideEffect: 'state_change',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            active: false,
+            metadata: { remove_reason: input.reason },
+        };
+        if (input.end_date !== undefined)
+            body.end_date = input.end_date;
+        try {
+            const rows = await ctx.apiClient.patch(`${ctx.apiClient.dbBasePath}/hrm_user_role_parents?id=eq.${input.id}&select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            if (!rows || rows.length === 0) {
+                return errorResponse(API_ERROR, `HRM role parent link ${input.id} not found or not accessible`);
+            }
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to remove HRM role parent link: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-parent-remove.js.map

package/dist/tools/hrm/hrm-user-role-parent-remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-parent-remove.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-parent-remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAS;IAC/C,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,sEAAsE;QACtE,+EAA+E;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC;aACF,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,iDAAiD,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAC3B,0DAA0D,CAC3D;QACD,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAKb,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE;SAC1C,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CACpC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,gCAAgC,KAAK,CAAC,EAAE,WAAW,EAC9E,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,aAAa,CAClB,SAAS,EACT,wBAAwB,KAAK,CAAC,EAAE,8BAA8B,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-parent-set.d.ts

@@ -0,0 +1,11 @@
+import { Tool } from '../registry.js';
+/**
+ * Establish a parent→child inheritance link between two roles
+ * (`hrm_user_role_parents`). The child role inherits every policy of
+ * the parent, so this is a `provisioning` action that requires
+ * `confirm: true`.
+ *
+ * Natural key: (tenant_id, parent_role_id, child_role_id).
+ */
+export declare const hrmUserRoleParentSetTool: Tool;
+//# sourceMappingURL=hrm-user-role-parent-set.d.ts.map

package/dist/tools/hrm/hrm-user-role-parent-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-parent-set.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-parent-set.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAStC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,IAsDtC,CAAC"}

package/dist/tools/hrm/hrm-user-role-parent-set.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Establish a parent→child inheritance link between two roles
+ * (`hrm_user_role_parents`). The child role inherits every policy of
+ * the parent, so this is a `provisioning` action that requires
+ * `confirm: true`.
+ *
+ * Natural key: (tenant_id, parent_role_id, child_role_id).
+ */
+export const hrmUserRoleParentSetTool = {
+    name: 'hrm_user_role_parent_set',
+    description: 'Establish a parent → child inheritance link between two roles ' +
+        '(hrm_user_role_parents). Requires confirm=true, parent_role_id, and ' +
+        'child_role_id. Natural key: (tenant_id, parent_role_id, child_role_id). Retry-safe.',
+    inputSchema: z.object({
+        parent_role_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_roles row whose policies are inherited'),
+        child_role_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_roles row that will inherit the parent policies'),
+        start_date: z.string().datetime().optional(),
+        end_date: z.string().datetime().optional(),
+        metadata: z.record(z.unknown()).optional(),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_parents', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        if (input.parent_role_id === input.child_role_id) {
+            return errorResponse(API_ERROR, 'parent_role_id and child_role_id must differ — a role cannot inherit from itself.');
+        }
+        const body = {
+            parent_role_id: input.parent_role_id,
+            child_role_id: input.child_role_id,
+        };
+        for (const field of ['start_date', 'end_date', 'metadata']) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/hrm_user_role_parents?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to set HRM role parent: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-parent-set.js.map

package/dist/tools/hrm/hrm-user-role-parent-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-parent-set.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-parent-set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE,0BAA0B;IAChC,WAAW,EACT,gEAAgE;QAChE,sEAAsE;QACtE,qFAAqF;IACvF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,6DAA6D,CAAC;QAC1E,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,sEAAsE,CAAC;QACnF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,aAAa,CAClB,SAAS,EACT,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAwB;YAChC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,iCAAiC,EAC5D,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-policy-assign.d.ts

@@ -0,0 +1,11 @@
+import { Tool } from '../registry.js';
+/**
+ * Attach an authorization policy to a role
+ * (`hrm_user_role_policy_assignments`). Every user holding the role
+ * transitively receives the policy, so this is a high-fanout
+ * `provisioning` action that requires `confirm: true`.
+ *
+ * Natural key: (tenant_id, user_role_id, authorization_policy_id).
+ */
+export declare const hrmUserRolePolicyAssignTool: Tool;
+//# sourceMappingURL=hrm-user-role-policy-assign.d.ts.map

package/dist/tools/hrm/hrm-user-role-policy-assign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-policy-assign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-policy-assign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAStC;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,IAgDzC,CAAC"}

package/dist/tools/hrm/hrm-user-role-policy-assign.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Attach an authorization policy to a role
+ * (`hrm_user_role_policy_assignments`). Every user holding the role
+ * transitively receives the policy, so this is a high-fanout
+ * `provisioning` action that requires `confirm: true`.
+ *
+ * Natural key: (tenant_id, user_role_id, authorization_policy_id).
+ */
+export const hrmUserRolePolicyAssignTool = {
+    name: 'hrm_user_role_policy_assign',
+    description: 'Attach an authorization policy to a role (hrm_user_role_policy_assignments). ' +
+        'Requires confirm=true, user_role_id, and authorization_policy_id. ' +
+        'Natural key: (tenant_id, user_role_id, authorization_policy_id). Retry-safe.',
+    inputSchema: z.object({
+        user_role_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_roles row receiving the policy attachment'),
+        authorization_policy_id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_authorization_policies row being attached'),
+        start_date: z.string().datetime().optional(),
+        end_date: z.string().datetime().optional(),
+        metadata: z.record(z.unknown()).optional(),
+        confirm: confirmFlagSchema,
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_policy_assignments', 'INSERT')],
+    sideEffect: 'provisioning',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            user_role_id: input.user_role_id,
+            authorization_policy_id: input.authorization_policy_id,
+        };
+        for (const field of ['start_date', 'end_date', 'metadata']) {
+            if (input[field] !== undefined)
+                body[field] = input[field];
+        }
+        try {
+            const rows = await ctx.apiClient.post(`${ctx.apiClient.dbBasePath}/hrm_user_role_policy_assignments?select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to attach HRM role policy assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-policy-assign.js.map

package/dist/tools/hrm/hrm-user-role-policy-assign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-policy-assign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-policy-assign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAS;IAC/C,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,+EAA+E;QAC/E,oEAAoE;QACpE,8EAA8E;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,gEAAgE,CAAC;QAC7E,uBAAuB,EAAE,CAAC;aACvB,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,2DAA2D,CAAC;QACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;IACjE,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA2B,CAAC;QAC1C,MAAM,IAAI,GAAwB;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;SACvD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,4CAA4C,EACvE,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-policy-unassign.d.ts

@@ -0,0 +1,9 @@
+import { Tool } from '../registry.js';
+/**
+ * Detach an authorization policy from a role by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Every user holding the role
+ * loses the transitive policy, so this requires confirm=true and a
+ * reason for the audit trail.
+ */
+export declare const hrmUserRolePolicyUnassignTool: Tool;
+//# sourceMappingURL=hrm-user-role-policy-unassign.d.ts.map

package/dist/tools/hrm/hrm-user-role-policy-unassign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-policy-unassign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-policy-unassign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,IAqD3C,CAAC"}

package/dist/tools/hrm/hrm-user-role-policy-unassign.js

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, reasonSchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Detach an authorization policy from a role by soft-closing the row:
+ * set `active=false` and stamp `end_date`. Every user holding the role
+ * loses the transitive policy, so this requires confirm=true and a
+ * reason for the audit trail.
+ */
+export const hrmUserRolePolicyUnassignTool = {
+    name: 'hrm_user_role_policy_unassign',
+    description: 'Detach an authorization policy from a role by soft-closing the row ' +
+        '(active=false, end_date=now). Requires confirm=true and a reason. Retry-safe.',
+    inputSchema: z.object({
+        id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_role_policy_assignments row to detach'),
+        end_date: z.string().datetime().optional(),
+        confirm: confirmFlagSchema,
+        reason: reasonSchema.describe('Human-readable justification recorded on the audit trail'),
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_policy_assignments', 'UPDATE')],
+    sideEffect: 'state_change',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            active: false,
+            metadata: { unassign_reason: input.reason },
+        };
+        if (input.end_date !== undefined)
+            body.end_date = input.end_date;
+        try {
+            const rows = await ctx.apiClient.patch(`${ctx.apiClient.dbBasePath}/hrm_user_role_policy_assignments?id=eq.${input.id}&select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            if (!rows || rows.length === 0) {
+                return errorResponse(API_ERROR, `HRM role policy assignment ${input.id} not found or not accessible`);
+            }
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to detach HRM role policy assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-policy-unassign.js.map

package/dist/tools/hrm/hrm-user-role-policy-unassign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-policy-unassign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-policy-unassign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAS;IACjD,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,qEAAqE;QACrE,+EAA+E;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC;aACF,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,4DAA4D,CAAC;QACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC1C,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAC3B,0DAA0D,CAC3D;QACD,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC;IACjE,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAKb,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE;SAC5C,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CACpC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,2CAA2C,KAAK,CAAC,EAAE,WAAW,EACzF,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,aAAa,CAClB,SAAS,EACT,8BAA8B,KAAK,CAAC,EAAE,8BAA8B,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/hrm-user-role-unassign.d.ts

@@ -0,0 +1,13 @@
+import { Tool } from '../registry.js';
+/**
+ * Revoke a user role assignment by soft-closing the row: set
+ * `active=false` and stamp `end_date`. A revocation is an
+ * administrative security transition, so the tool requires both
+ * `confirm: true` AND a `reason` for the audit trail.
+ *
+ * Retry-safe: repeat calls converge on the same closed state; the
+ * `end_date` is only stamped on the first call so subsequent retries
+ * preserve the original close timestamp.
+ */
+export declare const hrmUserRoleUnassignTool: Tool;
+//# sourceMappingURL=hrm-user-role-unassign.d.ts.map

package/dist/tools/hrm/hrm-user-role-unassign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-unassign.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-unassign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,IA2DrC,CAAC"}

package/dist/tools/hrm/hrm-user-role-unassign.js

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import { API_ERROR, errorResponse, successResponse } from '../types.js';
+import { cap } from '../../capabilities/tool-capability.js';
+import { confirmFlagSchema, idempotencyKeySchema, reasonSchema, writeHeadersWithIdempotency, } from '../_shared/side-effect.js';
+/**
+ * Revoke a user role assignment by soft-closing the row: set
+ * `active=false` and stamp `end_date`. A revocation is an
+ * administrative security transition, so the tool requires both
+ * `confirm: true` AND a `reason` for the audit trail.
+ *
+ * Retry-safe: repeat calls converge on the same closed state; the
+ * `end_date` is only stamped on the first call so subsequent retries
+ * preserve the original close timestamp.
+ */
+export const hrmUserRoleUnassignTool = {
+    name: 'hrm_user_role_unassign',
+    description: 'Revoke a user role assignment by soft-closing the row (active=false, end_date=now). ' +
+        'Requires confirm=true and a reason for the audit trail. Retry-safe.',
+    inputSchema: z.object({
+        id: z
+            .string()
+            .min(1)
+            .describe('UUID of the hrm_user_role_assignments row to revoke'),
+        end_date: z
+            .string()
+            .datetime()
+            .optional()
+            .describe('Optional ISO-8601 revocation timestamp; defaults to the persist backend clock'),
+        confirm: confirmFlagSchema,
+        reason: reasonSchema.describe('Human-readable justification recorded on the audit trail'),
+        idempotency_key: idempotencyKeySchema,
+    }),
+    capabilities: [cap('hrm_user_role_assignments', 'UPDATE')],
+    sideEffect: 'state_change',
+    confirmation: 'caller_confirms',
+    idempotency: 'natural_key',
+    handler: async (args, ctx) => {
+        const input = args;
+        const body = {
+            active: false,
+            metadata: { revoke_reason: input.reason },
+        };
+        if (input.end_date !== undefined)
+            body.end_date = input.end_date;
+        try {
+            const rows = await ctx.apiClient.patch(`${ctx.apiClient.dbBasePath}/hrm_user_role_assignments?id=eq.${input.id}&select=*`, body, { headers: writeHeadersWithIdempotency(input.idempotency_key) });
+            if (!rows || rows.length === 0) {
+                return errorResponse(API_ERROR, `HRM user role assignment ${input.id} not found or not accessible`);
+            }
+            return successResponse(rows[0]);
+        }
+        catch (error) {
+            return errorResponse(API_ERROR, `Failed to revoke HRM user role assignment: ${error.message}`);
+        }
+    },
+};
+//# sourceMappingURL=hrm-user-role-unassign.js.map

package/dist/tools/hrm/hrm-user-role-unassign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hrm-user-role-unassign.js","sourceRoot":"","sources":["../../../src/tools/hrm/hrm-user-role-unassign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,GAAG,EAAE,MAAM,uCAAuC,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAS;IAC3C,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,sFAAsF;QACtF,qEAAqE;IACvE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,CAAC;aACF,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,qDAAqD,CAAC;QAClE,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CACP,+EAA+E,CAChF;QACH,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAC3B,0DAA0D,CAC3D;QACD,eAAe,EAAE,oBAAoB;KACtC,CAAC;IACF,YAAY,EAAE,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;IAC1D,UAAU,EAAE,cAAc;IAC1B,YAAY,EAAE,iBAAiB;IAC/B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAKb,CAAC;QACF,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,MAAM,EAAE;SAC1C,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CACpC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,oCAAoC,KAAK,CAAC,EAAE,WAAW,EAClF,IAAI,EACJ,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,aAAa,CAClB,SAAS,EACT,4BAA4B,KAAK,CAAC,EAAE,8BAA8B,CACnE,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,SAAS,EACT,8CAA8C,KAAK,CAAC,OAAO,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/hrm/index.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+export declare const hrmTools: Tool[];
+/** Read-only slice used by the `hrm-readonly` selectable sub-domain. */
+export declare const hrmReadOnlyTools: Tool[];
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/hrm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/hrm/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAsBtC,eAAO,MAAM,QAAQ,EAAE,IAAI,EAAiD,CAAC;AAE7E,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,IAAI,EAA0B,CAAC"}

package/dist/tools/hrm/index.js

@@ -0,0 +1,23 @@
+import { hrmGeneratedReadTools } from './generated-reads.js';
+import { hrmUserRoleAssignTool } from './hrm-user-role-assign.js';
+import { hrmUserRoleUnassignTool } from './hrm-user-role-unassign.js';
+import { hrmUserPolicyAssignTool } from './hrm-user-policy-assign.js';
+import { hrmUserPolicyUnassignTool } from './hrm-user-policy-unassign.js';
+import { hrmUserRolePolicyAssignTool } from './hrm-user-role-policy-assign.js';
+import { hrmUserRolePolicyUnassignTool } from './hrm-user-role-policy-unassign.js';
+import { hrmUserRoleParentSetTool } from './hrm-user-role-parent-set.js';
+import { hrmUserRoleParentRemoveTool } from './hrm-user-role-parent-remove.js';
+const hrmWriteTools = [
+    hrmUserRoleAssignTool,
+    hrmUserRoleUnassignTool,
+    hrmUserPolicyAssignTool,
+    hrmUserPolicyUnassignTool,
+    hrmUserRolePolicyAssignTool,
+    hrmUserRolePolicyUnassignTool,
+    hrmUserRoleParentSetTool,
+    hrmUserRoleParentRemoveTool,
+];
+export const hrmTools = [...hrmGeneratedReadTools, ...hrmWriteTools];
+/** Read-only slice used by the `hrm-readonly` selectable sub-domain. */
+export const hrmReadOnlyTools = hrmGeneratedReadTools;
+//# sourceMappingURL=index.js.map

package/dist/tools/hrm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/hrm/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,aAAa,GAAW;IAC5B,qBAAqB;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,2BAA2B;IAC3B,6BAA6B;IAC7B,wBAAwB;IACxB,2BAA2B;CAC5B,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,GAAG,qBAAqB,EAAE,GAAG,aAAa,CAAC,CAAC;AAE7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAW,qBAAqB,CAAC"}

package/dist/tools/sec/generated-reads.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+import { CatalogueReport } from '../../generated-reads/index.js';
+export declare const secGeneratedReadReport: CatalogueReport;
+export declare const secGeneratedReadTools: Tool[];
+//# sourceMappingURL=generated-reads.d.ts.map

package/dist/tools/sec/generated-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.d.ts","sourceRoot":"","sources":["../../../src/tools/sec/generated-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAGL,eAAe,EAChB,MAAM,gCAAgC,CAAC;AA0BxC,eAAO,MAAM,sBAAsB,EAAE,eAIjC,CAAC;AAEL,eAAO,MAAM,qBAAqB,EAAE,IAAI,EAGvC,CAAC"}

package/dist/tools/sec/generated-reads.js

@@ -0,0 +1,29 @@
+import { buildGeneratedReadCatalogue, buildGeneratedReadCatalogueReport, } from '../../generated-reads/index.js';
+import { loadPersistResourceContract } from '../../contracts/persist-resource-contract.js';
+/**
+ * Bounded read tools for the SEC module (WI-0003503).
+ *
+ * The pinned contract carries a single SEC resource
+ * (`sec_qr_pairing_sessions`) classified `sensitive` because it
+ * carries an `encrypted_local_secret` column and an
+ * `encryption_nonce`. The catalogue is invoked with
+ * `includeSensitive: true` so status polling of a pairing session
+ * (checking `session_status`, `expires_at`, `paired_at`) is available
+ * to operators.
+ *
+ * Field-level redaction strips the secret at the guardrail layer —
+ * the returned rows carry no `*_secret` column. The
+ * `encryption_nonce` column is not credential material on its own but
+ * has no operational value outside the pairing workflow either;
+ * callers who need it must go through a dedicated Persist endpoint.
+ *
+ * Every write on a pairing session lives in a dedicated hand-written
+ * tool (`sec-qr-pairing-*`) with confirmation semantics.
+ */
+const contract = loadPersistResourceContract();
+export const secGeneratedReadReport = buildGeneratedReadCatalogueReport(contract, {
+    modules: ['sec'],
+    includeSensitive: true,
+});
+export const secGeneratedReadTools = buildGeneratedReadCatalogue(contract, { modules: ['sec'], includeSensitive: true });
+//# sourceMappingURL=generated-reads.js.map

package/dist/tools/sec/generated-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-reads.js","sourceRoot":"","sources":["../../../src/tools/sec/generated-reads.ts"],"names":[],"mappings":"AACA,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GACjC,iCAAiC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,qBAAqB,GAAW,2BAA2B,CACtE,QAAQ,EACR,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC7C,CAAC"}

package/dist/tools/sec/index.d.ts

@@ -0,0 +1,5 @@
+import { Tool } from '../registry.js';
+export declare const secTools: Tool[];
+/** Read-only slice used by the `sec-readonly` selectable sub-domain. */
+export declare const secReadOnlyTools: Tool[];
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/sec/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/sec/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AActC,eAAO,MAAM,QAAQ,EAAE,IAAI,EAAiD,CAAC;AAE7E,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,IAAI,EAA0B,CAAC"}

package/dist/tools/sec/index.js

@@ -0,0 +1,15 @@
+import { secGeneratedReadTools } from './generated-reads.js';
+import { secQrPairingStartTool } from './sec-qr-pairing-start.js';
+import { secQrPairingJoinTool } from './sec-qr-pairing-join.js';
+import { secQrPairingCompleteTool } from './sec-qr-pairing-complete.js';
+import { secQrPairingCancelTool } from './sec-qr-pairing-cancel.js';
+const secWriteTools = [
+    secQrPairingStartTool,
+    secQrPairingJoinTool,
+    secQrPairingCompleteTool,
+    secQrPairingCancelTool,
+];
+export const secTools = [...secGeneratedReadTools, ...secWriteTools];
+/** Read-only slice used by the `sec-readonly` selectable sub-domain. */
+export const secReadOnlyTools = secGeneratedReadTools;
+//# sourceMappingURL=index.js.map

package/dist/tools/sec/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/sec/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,MAAM,aAAa,GAAW;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,GAAG,qBAAqB,EAAE,GAAG,aAAa,CAAC,CAAC;AAE7E,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAW,qBAAqB,CAAC"}

package/dist/tools/sec/sec-qr-pairing-cancel.d.ts

@@ -0,0 +1,11 @@
+import { Tool } from '../registry.js';
+/**
+ * Cancel a QR pairing session by setting `session_status=CANCELLED`
+ * and stamping `completed_at`. Cancellation is a security state
+ * transition, so the tool requires `confirm: true` AND a `reason`
+ * for the audit trail.
+ *
+ * Retry-safe: repeat calls converge on the same cancelled state.
+ */
+export declare const secQrPairingCancelTool: Tool;
+//# sourceMappingURL=sec-qr-pairing-cancel.d.ts.map

package/dist/tools/sec/sec-qr-pairing-cancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sec-qr-pairing-cancel.d.ts","sourceRoot":"","sources":["../../../src/tools/sec/sec-qr-pairing-cancel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAUtC;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAyDpC,CAAC"}