@superblocksteam/vite-plugin-file-sync 1.99.99-next.3 → 2.0.0-SNAPSHOT.2143e2e95d0107ab

package/dist/ai-service/agent/tools/integrations/execute-request.js

@@ -0,0 +1,1179 @@
+import z from "zod";
+import { AiEntityType, AiMode, AiPermissionType, } from "@superblocksteam/library-shared/types";
+import { ActionResponseType, CockroachDBPlugin, CosmosDbPlugin, DATABASE_LIFECYCLE_MANAGED_BY, DatabricksPlugin, DynamoDBPlugin, EditorLanguage, ExtendedIntegrationPluginId, GCSPlugin, GraphQLIntegrationPluginMergedFieldNames, LakebasePlugin, MongoDBPlugin, PostgresPlugin, RestApiBodyDataType, RestApiFields, S3ActionType, S3Plugin, SalesforcePlugin, SnowflakePostgresPlugin, } from "@superblocksteam/shared";
+import { getLogger } from "../../../../util/logger.js";
+import { createToolFactory, ToolCategory, PermissionLevel, ToolExecutionError, } from "../../tools2/types.js";
+import { codeBlock } from "../../tools2/utils.js";
+import { executeRequest, MAX_QUERY_RESPONSE_TOKENS } from "./internal.js";
+import { isManagedAppDatabaseIntegration } from "./managed-app-database.js";
+import { classifySqlStatement, peekSqlClassification, } from "./sql-classification.js";
+// Maximum number of rows that can be returned from a query
+const MAX_QUERY_LIMIT = 10;
+const S3_READ_ACTIONS = [
+    S3ActionType.GENERATE_PRESIGNED_URL,
+    S3ActionType.GET_OBJECT,
+    S3ActionType.LIST_BUCKET_OBJECTS,
+    S3ActionType.LIST_BUCKETS,
+];
+const DYNAMODB_READ_ACTIONS = [
+    "describeTable",
+    "getItem",
+    "listTables",
+    "query",
+    "scan",
+];
+const GCS_READ_ACTIONS = [
+    "GENERATE_PRESIGNED_URL",
+    "GET_OBJECT",
+    "LIST_BUCKETS",
+    "LIST_OBJECTS",
+];
+const COSMOSDB_READ_ACTION_CASES = ["read", "singleton"];
+const COSMOSDB_READ_CATEGORY_CASES = ["pointOperation", "sql"];
+const MONGODB_READ_ACTIONS = [
+    "aggregate",
+    "count",
+    "distinct",
+    "find",
+    "findOne",
+    "listCollections",
+];
+const DESCRIPTION_BASE_PROMPT = `
+A concise plain-English description of WHAT data operation will be performed
+Focus on the domain names, the specific number of records if limited, and the table/resource name.
+CRITICAL: Always specify which integration is being used with the format @IntegrationName[id=INTEGRATION_ID] where INTEGRATION_ID is the integrationId parameter and IntegrationName is the tagName of the integration.
+DO NOT explain why or include context.
+`;
+// Hoisted out of the factory so `classifyPermissionType` and tests can derive
+// their argument types directly from the schema via `z.infer`, instead of
+// manually duplicating the discriminated union (which would silently drift
+// when plugin types or fields are added).
+const inputSchema = z.object({
+    integrationId: z.string().min(1).describe("The ID of the integration"),
+    operation: z
+        .enum(["read", "write"])
+        .describe("Declare whether this request only reads data (read) or creates/updates/deletes data (write). " +
+        "This is only consulted for ambiguous cases — REST POST requests and 'other' plugin types — " +
+        "where intent cannot be determined structurally. For SQL/Salesforce/GraphQL/S3/DynamoDB/GCS/" +
+        "CosmosDB/MongoDB, intent is derived from the query or schema and this field is effectively ignored. " +
+        "For REST PUT/PATCH/DELETE, it is always treated as a write regardless of this field. " +
+        "Still set it accurately: choose 'read' for queries, searches, lists, and fetches; 'write' for " +
+        "anything that modifies server state. Write operations require user approval."),
+    description: z.object({
+        request: z.string().min(1).describe(`
+      ${DESCRIPTION_BASE_PROMPT}
+      Phrased as a request for permission.
+      Examples: "Ok if I read 20 orders from @DemoOrders[id=abc123]?", "Ok if I read 5 rows from the users table of @Postgres[id=xyz789]?", "Ok if I read 10 issues from @Linear[id=def456]?".
+    `),
+        present: z.string().min(1).describe(`
+      ${DESCRIPTION_BASE_PROMPT}.
+      Phrased as a present tense statement.
+      Examples: "Reading 20 orders from @DemoOrders[id=abc123]", "Reading 5 rows from the users table of @Postgres[id=xyz789]", "Reading 10 issues from @Linear[id=def456]".
+    `),
+        past: z.string().min(1).describe(`
+      ${DESCRIPTION_BASE_PROMPT}.
+      Phrased as a past tense statement.
+      Examples: "Read 20 orders from @DemoOrders[id=abc123]", "Read 5 rows from the users table of @Postgres[id=xyz789]", "Read 10 issues from @Linear[id=def456]".
+    `),
+    }),
+    params: z.discriminatedUnion("type", [
+        z.object({
+            type: z.literal("sql"),
+            query: z.string().min(1).describe("The SQL query string to execute"),
+        }),
+        z.object({
+            type: z.literal("graphql"),
+            graphQLQuery: z.object({
+                query: z
+                    .string()
+                    .min(1)
+                    .describe("The GraphQL query string to execute"),
+                variables: z
+                    .record(z.unknown())
+                    .optional()
+                    .describe("Optional variables for the GraphQL query"),
+                headers: z
+                    .record(z.string())
+                    .optional()
+                    .describe("Optional HTTP headers to include in the request"),
+            }),
+        }),
+        z.object({
+            type: z.literal("rest"),
+            httpRequest: z.object({
+                httpMethod: z
+                    .enum(["GET", "POST", "PUT", "PATCH", "DELETE"])
+                    .describe("The HTTP method for the request"),
+                path: z
+                    .string()
+                    .min(1)
+                    .describe("The URL path to the API endpoint, beginning with a '/'"),
+                headers: z
+                    .record(z.string())
+                    .optional()
+                    .describe("Optional HTTP headers to include in the request"),
+                queryParams: z
+                    .record(z.string())
+                    .optional()
+                    .describe("Optional query parameters to include in the request"),
+                body: z
+                    .string()
+                    .optional()
+                    .refine((val) => {
+                    if (val === undefined)
+                        return true;
+                    try {
+                        JSON.parse(val);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                }, { message: "body must be a JSON-encoded string" })
+                    .describe("Optional JSON-encoded request body (for POST, PUT, PATCH methods). " +
+                    "Must be a string containing valid JSON — e.g. '{\"foo\": 1}'. " +
+                    "Sent with Content-Type: application/json."),
+            }),
+        }),
+        z.object({
+            type: z.literal("s3"),
+            action: z.enum(S3_READ_ACTIONS).describe("The S3 action to perform"),
+            resource: z
+                .string()
+                .optional()
+                .describe("The S3 bucket name (required for all actions except LIST_BUCKETS)"),
+            path: z
+                .string()
+                .optional()
+                .describe("The object key/path (required for GET_OBJECT and GENERATE_PRESIGNED_URL)"),
+            listFilesConfig: z
+                .object({
+                prefix: z
+                    .string()
+                    .optional()
+                    .describe("Prefix filter for listing objects"),
+                delimiter: z
+                    .string()
+                    .optional()
+                    .describe("Delimiter for hierarchical listing (e.g. '/' for folder-like grouping)"),
+            })
+                .optional()
+                .describe("Configuration for LIST_BUCKET_OBJECTS action"),
+        }),
+        z.object({
+            type: z.literal("cosmosdb"),
+            actionCategory: z
+                .enum(COSMOSDB_READ_CATEGORY_CASES)
+                .describe("The CosmosDB action category: 'sql' for SQL queries, 'pointOperation' for single object actions"),
+            actionCase: z
+                .enum(COSMOSDB_READ_ACTION_CASES)
+                .describe("The specific action: 'singleton' for SQL queries, 'read' for point reads"),
+            containerId: z.string().optional().describe("The CosmosDB container ID"),
+            query: z
+                .string()
+                .optional()
+                .describe("The SQL query string (required for sql/singleton action)"),
+            partitionKey: z
+                .string()
+                .optional()
+                .describe("The partition key for point operations"),
+            id: z
+                .string()
+                .optional()
+                .describe("The item ID (required for pointOperation/read action)"),
+        }),
+        z.object({
+            type: z.literal("dynamodb"),
+            action: z
+                .enum(DYNAMODB_READ_ACTIONS)
+                .describe("The DynamoDB action to perform (read-only)"),
+            body: z
+                .string()
+                .optional()
+                .describe("JSON string of DynamoDB request parameters (e.g. TableName, Key, FilterExpression)"),
+        }),
+        z.object({
+            type: z.literal("gcs"),
+            action: z
+                .enum(GCS_READ_ACTIONS)
+                .describe("The GCS action to perform (read-only)"),
+            resource: z
+                .string()
+                .optional()
+                .describe("The GCS bucket name (required for all actions except LIST_BUCKETS)"),
+            path: z
+                .string()
+                .optional()
+                .describe("The object key/path (required for GET_OBJECT and GENERATE_PRESIGNED_URL)"),
+            prefix: z
+                .string()
+                .optional()
+                .describe("Prefix filter for listing objects or buckets"),
+        }),
+        z.object({
+            type: z.literal("mongodb"),
+            action: z
+                .enum(MONGODB_READ_ACTIONS)
+                .describe("The MongoDB operation to perform (read-only)"),
+            collection: z
+                .string()
+                .optional()
+                .describe("The collection name (required for all actions except listCollections)"),
+            query: z
+                .string()
+                .optional()
+                .describe("JSON query filter for count, distinct, find, findOne operations"),
+            pipeline: z
+                .string()
+                .optional()
+                .describe("JSON aggregation pipeline array for aggregate operation"),
+            projection: z
+                .string()
+                .optional()
+                .describe("JSON projection document for find/findOne operations"),
+            sortby: z
+                .string()
+                .optional()
+                .describe("JSON sort specification for find operation"),
+            limit: z
+                .string()
+                .optional()
+                .describe("Maximum number of documents to return for find operation"),
+            field: z
+                .string()
+                .optional()
+                .describe("Field name for distinct operation"),
+        }),
+        z.object({
+            type: z.literal("salesforce"),
+            query: z.string().min(1).describe("The SOQL query string to execute"),
+        }),
+        z.object({
+            type: z.literal("other"),
+            body: z
+                .string()
+                .min(1)
+                .describe("The body of the request to execute against the integration"),
+        }),
+    ]),
+});
+export const executeRequestToIntegrationToolFactory = createToolFactory("executeRequestToIntegration", ({ clark, services, }) => {
+    return {
+        category: ToolCategory.DATA,
+        timeoutMs: 300_000, // 5 minutes — integration requests involve LLM/network calls that regularly exceed 60s
+        defaultPermission: PermissionLevel.ALLOW,
+        description: `
+      Use this tool to make requests to integrations configured in the user's application.
+
+      You can use this tool to query data from databases, APIs, or other external services that the user has connected to their application.
+
+      Both read-only and write operations are supported. Write operations (creating, updating, or deleting data) will require user approval before execution.
+
+      SQL write rules:
+      - INSERT, UPDATE, DELETE and MERGE run only on integrations backed by PostgreSQL itself (${PostgresPlugin.id}, ${LakebasePlugin.id}, ${SnowflakePostgresPlugin.id}). On every other SQL integration — including ${CockroachDBPlugin.id}, whose dialect this tool cannot verify — and on Salesforce, only reads are supported; do not attempt writes there.
+      - Row-level writes and DDL statements require Build mode. In Plan mode this tool is read-only, so plan the write and perform it after switching to Build mode.
+      - Row-level writes need the user's approval, except against a managed App Database, where they run immediately.
+      - DDL statements require Build mode and user approval. They run only on integrations backed by PostgreSQL itself (${PostgresPlugin.id}, ${LakebasePlugin.id}, ${SnowflakePostgresPlugin.id}), and only on tables, columns, table constraints, indexes, views, materialized views, sequences, and schemas. DDL naming any other object, such as a trigger, row-level-security policy, function, or extension, is rejected. DDL that assigns ownership, changes relation options, or uses CASCADE is also rejected. An ALTER TABLE may only change the table's shape; subcommands that change access control, such as OWNER TO, DISABLE TRIGGER, and ENABLE or DISABLE ROW LEVEL SECURITY, are rejected even though they name a table.
+      - Change a managed App Database's schema with startApplyDevDatabaseMigrations so migrations track the schema for every environment. Direct DDL is rejected for managed App Databases.
+      - Session, privilege, maintenance, and bulk I/O statements such as SET, GRANT, REVOKE, VACUUM, and COPY are always rejected, including when they appear inside a CREATE SCHEMA. A DDL statement that also writes rows, such as CREATE TABLE AS with a data-modifying CTE, keeps every DDL restriction in addition to counting as a row-level write.
+      - A query must be a single valid statement. Anything unparseable is rejected.
+      - Direct INSERT, UPDATE, or DELETE ... RETURNING statements are rejected because PostgreSQL cannot apply LIMIT to them. Use WITH result AS (... RETURNING ...) SELECT * FROM result LIMIT ${MAX_QUERY_LIMIT}, or omit RETURNING when only the row count is needed.
+
+      IMPORTANT: SQL queries that return rows must include a row limit clause with a maximum of ${MAX_QUERY_LIMIT} rows.
+      Supported syntax: LIMIT N (MySQL/PostgreSQL), SELECT TOP N (SQL Server), or FETCH NEXT N ROWS ONLY (ANSI SQL).
+      Note: Metadata commands (SHOW, DESCRIBE, EXPLAIN) and writes that return no rows don't require a row limit.
+
+      IMPORTANT: Limit requests to a maximum of ${MAX_QUERY_LIMIT} entities.
+
+      NOTE: For running Python/JavaScript code, use the 'runCode' tool instead.
+
+      Plugin Types:
+      - "sql": For SQL database integrations, including Databricks. Provide a SQL query string.
+      - "graphql": For GraphQL integrations (${ExtendedIntegrationPluginId.GRAPHQL}). Provide query, variables, and headers.
+      - "rest": For REST API integrations (${ExtendedIntegrationPluginId.REST_API}). Provide HTTP method (GET, POST, PUT, PATCH, DELETE), path, headers, query parameters, and optionally a JSON body.
+      - "s3": For Amazon S3 integrations (${S3Plugin.id}). Provide a structured action (LIST_BUCKETS, LIST_BUCKET_OBJECTS, GET_OBJECT, GENERATE_PRESIGNED_URL) with optional resource (bucket name), path, and listFilesConfig.
+      - "cosmosdb": For Azure Cosmos DB integrations (${CosmosDbPlugin.id}). Provide a structured action with actionCategory (sql or pointOperation) and actionCase (singleton for SQL queries, read for point reads).
+      - "dynamodb": For Amazon DynamoDB integrations (${DynamoDBPlugin.id}). Provide a structured action (getItem, query, scan, listTables, describeTable) with JSON params.
+      - "gcs": For Google Cloud Storage integrations (${GCSPlugin.id}). Provide a structured action (LIST_OBJECTS, GET_OBJECT, LIST_BUCKETS, GENERATE_PRESIGNED_URL) with optional resource (bucket), path, and prefix.
+      - "mongodb": For MongoDB integrations (${MongoDBPlugin.id}). Provide a structured action (aggregate, count, distinct, find, findOne, listCollections) with collection, query, and other operation-specific fields.
+      - "salesforce": For Salesforce integrations (${SalesforcePlugin.id}). Provide SOQL query string.
+      - "other": For any other integration types that doesn't fit one of the above. Provide a generic query string.
+
+      Authentication is handled automatically based on the integration configuration.
+      Response data is returned as a JSON object.
+`,
+        inputSchema,
+        onCall: async (args) => {
+            assertSqlParamsTypeMatchesIntegration(services, args);
+            if (args.params.type !== "sql") {
+                return;
+            }
+            const classification = await classifySqlStatement(args.params.query, sqlPluginIdFor(services, args.integrationId));
+            if (classification.kind === "unknown") {
+                const rejection = describeRejection(classification);
+                throw createSqlPolicyError(rejection ?? "This query could not be checked safely.", args);
+            }
+        },
+        toModelOutput: ({ output }) => {
+            if (output.isPartial) {
+                return {
+                    type: "text",
+                    value: `Output too long. Max output size is ${MAX_QUERY_RESPONSE_TOKENS * 3} characters (~${MAX_QUERY_RESPONSE_TOKENS} tokens). Truncated result:
+          <result>
+          ${output.data}
+          </result>`,
+                };
+            }
+            return {
+                type: "json",
+                value: output,
+            };
+        },
+        execute: async (args) => {
+            const { params, integrationId } = args;
+            assertSqlParamsTypeMatchesIntegration(services, args);
+            const integrationHeader = services.integrationStore.getHeader(integrationId);
+            const integrationHint = integrationHeader?.name && integrationHeader.plugin.id
+                ? {
+                    name: integrationHeader.name,
+                    type: integrationHeader.plugin.id,
+                    displayName: integrationHeader.displayName,
+                }
+                : undefined;
+            const executeIntegrationRequest = (request) => integrationHint
+                ? executeRequest(clark.context, integrationId, request, integrationHint)
+                : executeRequest(clark.context, integrationId, request);
+            switch (params.type) {
+                case "salesforce":
+                case "sql": {
+                    const { query } = params;
+                    const normalizedQuery = query.trim().toUpperCase();
+                    // Whether this query may run at all. Approval for mutations is
+                    // settled before execute() by checkExecuteRequestPermissions and
+                    // the registry's WRITE escalation.
+                    const classification = await classifySqlStatement(query, services.integrationStore.getHeader(integrationId)?.plugin.id);
+                    const rejection = describeRejection(classification, isManagedAppDatabaseTarget(services, integrationId));
+                    if (rejection !== undefined) {
+                        throw new ToolExecutionError(rejection, {
+                            toolName: "executeRequestToIntegration",
+                            input: args,
+                            context: {},
+                            severity: "info",
+                        });
+                    }
+                    // A mutation that returns rows but cannot carry a LIMIT is the one
+                    // shape with no bound at all: `DELETE FROM events RETURNING *`
+                    // commits the delete and then materializes every deleted row, and
+                    // truncation only runs once that whole result has crossed the wire.
+                    // Wrapping it in a CTE keeps the RETURNING and makes the outer
+                    // SELECT limitable, so the rewrite is always available.
+                    if (isUnboundedReturningMutation(classification)) {
+                        throw new ToolExecutionError("A RETURNING clause on a direct INSERT, UPDATE, or DELETE has no row limit, so the result set is unbounded. Wrap it so the rows come back through a query that can be limited: " +
+                            `WITH result AS (DELETE FROM events WHERE ... RETURNING *) SELECT * FROM result LIMIT ${MAX_QUERY_LIMIT}. ` +
+                            "Drop RETURNING entirely if you only need the row count.", {
+                            toolName: "executeRequestToIntegration",
+                            input: args,
+                            context: {},
+                            severity: "info",
+                        });
+                    }
+                    // Validate row limit clause (supports multiple SQL dialects)
+                    // Skip validation for metadata commands that don't support LIMIT
+                    const metadataCommands = [
+                        "SHOW",
+                        "DESCRIBE",
+                        "DESC",
+                        "EXPLAIN",
+                        "USE",
+                        "INFORMATION_SCHEMA",
+                    ];
+                    const isMetadataCommand = metadataCommands.some((cmd) => new RegExp(`^${cmd}\\b`, "i").test(normalizedQuery));
+                    // Check if this is an aggregate-only query (returns single row)
+                    // Aggregate queries without GROUP BY always return exactly one row
+                    const hasGroupBy = /\bGROUP\s+BY\b/i.test(normalizedQuery);
+                    const aggregateFunctions = ["COUNT", "SUM", "AVG", "MIN", "MAX"];
+                    const hasAggregateFunction = aggregateFunctions.some((fn) => new RegExp(`\\b${fn}\\s*\\(`, "i").test(normalizedQuery));
+                    // Check if SELECT clause only contains aggregate functions (no regular columns)
+                    // Extract the SELECT clause (between SELECT and FROM)
+                    const selectClauseMatch = normalizedQuery.match(/SELECT\s+(.*?)\s+FROM\b/is);
+                    const selectClause = selectClauseMatch?.[1] || "";
+                    // Remove aggregate functions and check if anything meaningful remains
+                    let selectWithoutAggregates = selectClause;
+                    for (const fn of aggregateFunctions) {
+                        // Remove aggregate function calls like COUNT(*), SUM(column), etc.
+                        selectWithoutAggregates = selectWithoutAggregates.replace(new RegExp(`\\b${fn}\\s*\\([^)]*\\)`, "gi"), "");
+                    }
+                    // Remove whitespace, commas, and AS aliases to check if only aggregates remain
+                    const remainingColumns = selectWithoutAggregates
+                        .replace(/\bAS\s+\w+/gi, "")
+                        .replace(/[,\s]+/g, "");
+                    const isAggregateOnlyQuery = hasAggregateFunction && !hasGroupBy && remainingColumns === "";
+                    // A statement that cannot carry a LIMIT clause has nothing to
+                    // check. That covers bare mutations and `... RETURNING`, where
+                    // `LIMIT` is a syntax error.
+                    if (classification.supportsRowLimit &&
+                        !isMetadataCommand &&
+                        !isAggregateOnlyQuery) {
+                        // Check for various SQL dialect row limiting syntaxes:
+                        // - MySQL/PostgreSQL/SQLite: LIMIT N
+                        // - SQL Server: TOP N (after SELECT)
+                        // - ANSI SQL (SQL Server, Oracle, DB2): OFFSET ... FETCH NEXT N ROWS ONLY
+                        const limitMatch = normalizedQuery.match(/LIMIT\s+(\d+)/i);
+                        const topMatch = normalizedQuery.match(/SELECT\s+TOP\s+(\d+)\b/i);
+                        const fetchMatch = normalizedQuery.match(/FETCH\s+(?:FIRST|NEXT)\s+(\d+)\s+ROWS?\s+ONLY/i);
+                        const matchedLimit = limitMatch?.[1] || topMatch?.[1] || fetchMatch?.[1];
+                        if (!matchedLimit) {
+                            throw new ToolExecutionError("SQL queries must include a row limit clause to prevent excessive result sizes. " +
+                                "Use LIMIT N (MySQL/PostgreSQL), SELECT TOP N (SQL Server), or FETCH NEXT N ROWS ONLY (ANSI SQL). " +
+                                `Maximum allowed limit is ${MAX_QUERY_LIMIT} rows.`, {
+                                toolName: "executeRequestToIntegration",
+                                input: args,
+                                context: {},
+                                severity: "info",
+                            });
+                        }
+                        const limit = parseInt(matchedLimit, 10);
+                        if (limit > MAX_QUERY_LIMIT) {
+                            throw new ToolExecutionError(`Query row limit of ${limit} exceeds maximum allowed limit of ${MAX_QUERY_LIMIT} rows.`, {
+                                toolName: "executeRequestToIntegration",
+                                input: args,
+                                context: {},
+                                severity: "info",
+                            });
+                        }
+                    }
+                    let request;
+                    if (params.type === "salesforce") {
+                        request = {
+                            soql: {
+                                action: "SOQL_ACTION_SOQL",
+                                sqlBody: query,
+                            },
+                        };
+                    }
+                    else {
+                        const queryFieldPath = getQueryFieldPath(integrationId, services.integrationStore);
+                        request = buildSqlRequest(query, queryFieldPath);
+                    }
+                    if (classification.kind === "data_mutation" &&
+                        isManagedAppDatabaseWrite(services, integrationId)) {
+                        logManagedWriteAutoAllow(services, integrationId);
+                    }
+                    return await executeIntegrationRequest(request);
+                }
+                case "graphql": {
+                    const { graphQLQuery } = params;
+                    const request = buildGraphQLRequest(graphQLQuery);
+                    return await executeIntegrationRequest(request);
+                }
+                case "rest": {
+                    const { httpRequest } = params;
+                    const request = buildRestApiRequest(httpRequest);
+                    return await executeIntegrationRequest(request);
+                }
+                case "s3": {
+                    const request = buildS3Request(params);
+                    return await executeIntegrationRequest(request);
+                }
+                case "cosmosdb": {
+                    const validCombos = [
+                        ["sql", "singleton"],
+                        ["pointOperation", "read"],
+                    ];
+                    const isValid = validCombos.some(([cat, act]) => params.actionCategory === cat && params.actionCase === act);
+                    if (!isValid) {
+                        throw new ToolExecutionError(`Invalid CosmosDB action combination: "${params.actionCategory}/${params.actionCase}". ` +
+                            `Valid combinations are: sql/singleton, pointOperation/read.`, {
+                            toolName: "executeRequestToIntegration",
+                            input: args,
+                            context: {},
+                            severity: "info",
+                        });
+                    }
+                    const request = buildCosmosDbRequest(params);
+                    return await executeIntegrationRequest(request);
+                }
+                case "dynamodb": {
+                    const request = buildDynamoDBRequest(params);
+                    return await executeIntegrationRequest(request);
+                }
+                case "gcs": {
+                    const request = buildGCSRequest(params);
+                    return await executeIntegrationRequest(request);
+                }
+                case "mongodb": {
+                    const request = buildMongoDBRequest(params);
+                    return await executeIntegrationRequest(request);
+                }
+                case "other": {
+                    const { body } = params;
+                    const request = { body };
+                    return await executeIntegrationRequest(request);
+                }
+                default: {
+                    const _exhaustive = params;
+                    throw new Error(`Unsupported plugin type: ${_exhaustive}`);
+                }
+            }
+        },
+        getRequiredPermissions: async (args) => {
+            const classification = args.params.type === "sql"
+                ? await classifySqlStatement(args.params.query, sqlPluginIdFor(services, args.integrationId))
+                : undefined;
+            return [
+                {
+                    entityType: AiEntityType.INTEGRATION,
+                    entityId: args.integrationId,
+                    permissionType: classifyPermissionType(args, sqlStatementNeedsApproval(services, args, classification)),
+                },
+            ];
+        },
+        getActionName: (input) => {
+            // When the tool is about to perform a write (POST/PUT/PATCH/DELETE,
+            // GraphQL mutation, or an "other"/"write"-declared op), use an
+            // operation-neutral verb in the approval dialog so users aren't
+            // told they're "Querying" an integration right before an update
+            // or delete is executed.
+            // Cosmetic only, so a cache miss on the SQL classification just means
+            // the neutral "Query" label rather than a wrong decision.
+            const sqlClassification = input?.params.type === "sql"
+                ? peekSqlClassification(input.params.query, sqlPluginIdFor(services, input.integrationId))
+                : undefined;
+            // Whether the statement mutates, which is not the same question as
+            // whether it needed approval. Managed app databases write without a
+            // prompt, and reporting that as "Querying" describes the opposite of
+            // what just happened.
+            const sqlMutates = sqlClassification?.kind === "data_mutation" ||
+                sqlClassification?.kind === "ddl";
+            const sqlNeedsApproval = input !== undefined &&
+                sqlStatementNeedsApproval(services, input, sqlClassification);
+            if (input &&
+                (sqlMutates ||
+                    classifyPermissionType(input, sqlNeedsApproval) ===
+                        AiPermissionType.WRITE)) {
+                return {
+                    future: "Execute",
+                    present: "Executing",
+                    past: "Executed",
+                };
+            }
+            return {
+                future: "Query",
+                present: "Querying",
+                past: "Queried",
+            };
+        },
+        formatInput: (args) => {
+            const { params, integrationId, description } = args;
+            const integration = services.integrationStore.getEntityTag(integrationId) ??
+                integrationId;
+            let cleanDescription = description.request.trim();
+            if (cleanDescription.at(-1) !== "?") {
+                cleanDescription = `${cleanDescription}?`;
+            }
+            switch (params.type) {
+                case "salesforce":
+                case "sql": {
+                    return {
+                        targets: [integration],
+                        details: codeBlock(params.query, "sql"),
+                        summary: cleanDescription,
+                    };
+                }
+                case "graphql": {
+                    return {
+                        targets: [integration],
+                        details: codeBlock(params.graphQLQuery.query, "graphql"),
+                        summary: cleanDescription,
+                    };
+                }
+                case "rest": {
+                    const { httpMethod, path, queryParams, body } = params.httpRequest;
+                    const queryString = queryParams
+                        ? `?${Object.entries(queryParams)
+                            .map(([key, val]) => `${key}=${val}`)
+                            .join("&")}`
+                        : "";
+                    const bodySnippet = body ? `\n${body}` : "";
+                    return {
+                        targets: [integration],
+                        details: codeBlock(`${httpMethod} ${path}${queryString}${bodySnippet}`),
+                        summary: cleanDescription,
+                    };
+                }
+                case "s3": {
+                    const details = [params.action];
+                    if (params.resource)
+                        details.push(params.resource);
+                    if (params.path)
+                        details.push(params.path);
+                    return {
+                        targets: [integration],
+                        details: codeBlock(details.join(" ")),
+                        summary: cleanDescription,
+                    };
+                }
+                case "cosmosdb": {
+                    const details = [`${params.actionCategory}/${params.actionCase}`];
+                    if (params.containerId)
+                        details.push(params.containerId);
+                    if (params.query)
+                        details.push(params.query);
+                    return {
+                        targets: [integration],
+                        details: codeBlock(details.join(" ")),
+                        summary: cleanDescription,
+                    };
+                }
+                case "dynamodb": {
+                    const details = [params.action];
+                    if (params.body)
+                        details.push(params.body);
+                    return {
+                        targets: [integration],
+                        details: codeBlock(details.join(" ")),
+                        summary: cleanDescription,
+                    };
+                }
+                case "gcs": {
+                    const details = [params.action];
+                    if (params.resource)
+                        details.push(params.resource);
+                    if (params.path)
+                        details.push(params.path);
+                    return {
+                        targets: [integration],
+                        details: codeBlock(details.join(" ")),
+                        summary: cleanDescription,
+                    };
+                }
+                case "mongodb": {
+                    const details = [params.action];
+                    if (params.collection)
+                        details.push(params.collection);
+                    return {
+                        targets: [integration],
+                        details: codeBlock(details.join(" ")),
+                        summary: cleanDescription,
+                    };
+                }
+                case "other": {
+                    return {
+                        targets: [integration],
+                        details: codeBlock(params.body),
+                        summary: cleanDescription,
+                    };
+                }
+                default: {
+                    const _exhaustive = params;
+                    return {
+                        targets: [integration],
+                        summary: cleanDescription,
+                    };
+                }
+            }
+        },
+        // SQL data mutations can run through this tool. Reads still reach Plan
+        // mode via the ToolCategory.DATA allowance in access-control.ts, and
+        // checkExecuteRequestPermissions blocks mutations there.
+        readOnly: false,
+        // This tool handles its own response truncation (via truncateToTokens in internal.ts),
+        // so skip the generic outputLimiter middleware to avoid double-truncation and preserve
+        // the structured { data, isPartial } output format.
+        skipOutputLimit: () => true,
+        getSummary: (input, output) => {
+            const integration = services.integrationStore.getEntityTag(input.integrationId) ??
+                input.integrationId;
+            const type = input.params.type;
+            // Try to extract row count from output
+            let rowInfo = "Query executed";
+            if (output && typeof output === "object") {
+                const data = output;
+                if (Array.isArray(data.output)) {
+                    rowInfo = `${data.output.length} row${data.output.length === 1 ? "" : "s"}`;
+                }
+                else if (data.output &&
+                    typeof data.output === "object" &&
+                    "records" in data.output &&
+                    Array.isArray(data.output.records)) {
+                    const recordCount = data.output.records.length;
+                    rowInfo = `${recordCount} record${recordCount === 1 ? "" : "s"}`;
+                }
+            }
+            return {
+                input: `${integration} (${type})`,
+                output: rowInfo,
+            };
+        },
+    };
+});
+function getQueryFieldPath(integrationId, store) {
+    const pluginId = store.getHeader(integrationId)?.plugin.id;
+    if (!pluginId) {
+        throw new Error(`Integration with ID ${integrationId} not found`);
+    }
+    const plugin = store.getPlugin(pluginId);
+    if (!plugin) {
+        throw new Error(`Plugin with ID ${pluginId} not found`);
+    }
+    let queryFieldPath;
+    switch (pluginId) {
+        case DatabricksPlugin.id:
+            queryFieldPath = "runSql.sqlBody";
+            break;
+        default:
+            queryFieldPath =
+                extractSqlQueryFieldPathFromTemplate(plugin.actionTemplate) ?? "body";
+    }
+    return queryFieldPath;
+}
+function extractSqlQueryFieldPathFromTemplate(actionTemplate) {
+    const queryField = actionTemplate.sections
+        .flatMap((section) => section.items)
+        .flatMap((item) => ("rowItems" in item ? item.rowItems : item))
+        .filter((item) => "language" in item)
+        .filter((item) => item.language === EditorLanguage.SQL)[0];
+    if (queryField) {
+        return queryField.name;
+    }
+    return undefined;
+}
+function recordToProto(headers) {
+    return Object.entries(headers).map(([key, value]) => ({
+        key,
+        value,
+    }));
+}
+function buildSqlRequest(query, queryFieldPath) {
+    if (!queryFieldPath) {
+        throw new Error("Invalid query field path");
+    }
+    const request = {};
+    let current = request;
+    // sometimes the path to the field in the config where the query should go is nested.
+    // in the action template this is represented with dot notation `level1.level2.queryField`.
+    // the loop here is taking that field path and building
+    // level1: {
+    //   level2: {
+    //     queryField: <query>
+    //   }
+    // }
+    const queryFieldPathParts = queryFieldPath.split(".");
+    for (let i = 0; i < queryFieldPathParts.length - 1; i++) {
+        const field = queryFieldPathParts.at(i);
+        if (!field || !field.trim()) {
+            throw new Error("Invalid query field path: empty segment detected");
+        }
+        current[field] = {};
+        current = current[field];
+    }
+    const lastField = queryFieldPathParts.at(-1);
+    if (!lastField || !lastField.trim()) {
+        throw new Error("Invalid query field path: empty segment detected");
+    }
+    current[lastField] = query;
+    return request;
+}
+function buildGraphQLRequest(graphQLQuery) {
+    const headers = {
+        ...graphQLQuery.headers,
+        "Content-Type": "application/json",
+    };
+    const headersProto = recordToProto(headers);
+    getLogger().debug("GraphQL request headers:", headersProto);
+    const request = {
+        body: graphQLQuery.query,
+        [GraphQLIntegrationPluginMergedFieldNames.HEADERS]: headersProto,
+    };
+    if (graphQLQuery.variables) {
+        request["custom.variables.value"] = JSON.stringify(graphQLQuery.variables);
+    }
+    return request;
+}
+function buildS3Request(params) {
+    const request = {
+        action: params.action,
+    };
+    if (params.resource !== undefined) {
+        request.resource = params.resource;
+    }
+    if (params.path !== undefined) {
+        request.path = params.path;
+    }
+    if (params.listFilesConfig !== undefined) {
+        request.listFilesConfig = params.listFilesConfig;
+    }
+    return request;
+}
+function buildRestApiRequest(httpRequest) {
+    const request = {
+        [RestApiFields.HTTP_METHOD]: httpRequest.httpMethod,
+        [RestApiFields.URL_PATH]: httpRequest.path,
+        [RestApiFields.RESPONSE_TYPE]: ActionResponseType.JSON,
+    };
+    if (httpRequest.headers) {
+        request[RestApiFields.HEADERS] = recordToProto(httpRequest.headers);
+    }
+    if (httpRequest.queryParams) {
+        request[RestApiFields.PARAMS] = recordToProto(httpRequest.queryParams);
+    }
+    if (httpRequest.body) {
+        request[RestApiFields.BODY] = httpRequest.body;
+        request[RestApiFields.BODY_TYPE] = RestApiBodyDataType.JSON;
+    }
+    return request;
+}
+function buildDynamoDBRequest(params) {
+    const request = {
+        action: params.action,
+    };
+    if (params.body !== undefined) {
+        request.body = params.body;
+    }
+    return request;
+}
+function buildGCSRequest(params) {
+    const request = {
+        action: params.action,
+    };
+    if (params.resource !== undefined) {
+        request.resource = params.resource;
+    }
+    if (params.path !== undefined) {
+        request.path = params.path;
+    }
+    if (params.prefix !== undefined) {
+        request.prefix = params.prefix;
+    }
+    return request;
+}
+function buildCosmosDbRequest(params) {
+    const request = {
+        "cosmosdbAction.case": params.actionCategory,
+        "cosmosdbAction.value.action.case": params.actionCase,
+    };
+    if (params.containerId !== undefined) {
+        if (params.actionCategory === "pointOperation") {
+            request["cosmosdbAction.value.containerId"] = params.containerId;
+        }
+        else {
+            request["cosmosdbAction.value.action.value.containerId"] =
+                params.containerId;
+        }
+    }
+    if (params.query !== undefined) {
+        request["cosmosdbAction.value.action.value.query"] = params.query;
+    }
+    if (params.partitionKey !== undefined) {
+        request["cosmosdbAction.value.action.value.partitionKey"] =
+            params.partitionKey;
+    }
+    if (params.id !== undefined) {
+        request["cosmosdbAction.value.action.value.id"] = params.id;
+    }
+    return request;
+}
+function buildMongoDBRequest(params) {
+    const request = {
+        action: params.action,
+    };
+    if (params.collection !== undefined) {
+        request.resource = params.collection;
+    }
+    if (params.query !== undefined) {
+        request.query = params.query;
+    }
+    if (params.pipeline !== undefined) {
+        request.pipeline = params.pipeline;
+    }
+    if (params.projection !== undefined) {
+        request.projection = params.projection;
+    }
+    if (params.sortby !== undefined) {
+        request.sortby = params.sortby;
+    }
+    if (params.limit !== undefined) {
+        request.limit = params.limit;
+    }
+    if (params.field !== undefined) {
+        request.field = params.field;
+    }
+    return request;
+}
+/**
+ * Strips GraphQL comments and string literals from a query so that
+ * keyword matching only operates on structural tokens.
+ */
+function stripGraphQLNonCode(query) {
+    return query
+        .replace(/"""[\s\S]*?"""/g, "") // strip block strings
+        .replace(/"(?:[^"\\]|\\.)*"/g, "") // strip double-quoted strings
+        .replace(/#.*$/gm, ""); // strip # comments (after strings so # inside strings is safe)
+}
+/**
+ * Classifies a GraphQL query as READ or WRITE by regex-matching the top-level
+ * operation type keyword on a stripped copy of the document (comments and
+ * string literals removed). This is a structural check, not full AST parsing.
+ *
+ * Handles documents with fragments before operations and multiple operations.
+ * Falls back to WRITE on any error (fail-closed).
+ */
+function classifyGraphQLOperation(query) {
+    try {
+        const stripped = stripGraphQLNonCode(query);
+        // In valid GraphQL, the `mutation` keyword appears as an operation type at
+        // the top level — either at the start of the document or after a closing
+        // brace `}` (e.g. after a fragment definition).
+        if (/(?:^|})[\s]*mutation\b/i.test(stripped)) {
+            return AiPermissionType.WRITE;
+        }
+        return AiPermissionType.READ;
+    }
+    catch (err) {
+        // Fail-closed: treat as WRITE on error. Log so future regressions in the
+        // regex/stripping logic are debuggable instead of silently over-prompting.
+        getLogger().warn("classifyGraphQLOperation failed; falling back to WRITE", err);
+        return AiPermissionType.WRITE;
+    }
+}
+/**
+ * Explains why a classified query may not run, or undefined when it may.
+ *
+ * A managed App Database rejects any statement that changes schema before the
+ * primary kind is considered. Hybrid CREATE TABLE AS statements also mutate
+ * rows, so their primary kind alone is not enough to protect the schema.
+ */
+function describeRejection(classification, managedAppDatabase = false) {
+    if (managedAppDatabase && classification.changesSchema) {
+        return "Change a managed App Database's schema with startApplyDevDatabaseMigrations so the schema is tracked and can be applied to every environment.";
+    }
+    switch (classification.kind) {
+        case "data_mutation":
+        case "read":
+        case "ddl":
+            return undefined;
+        case "schema_or_session":
+            return ("Session, privilege, maintenance, and bulk I/O statements are not allowed here. " +
+                "Use a supported read, row-level write, or DDL statement instead.");
+        case "unsupported_dialect":
+            return ("Writes are not yet supported for this integration type, so only read-only " +
+                "queries can run against it.");
+        case "unknown":
+            return ("This query could not be parsed, so it cannot be checked for writes. " +
+                "Rewrite it as a single valid statement.");
+    }
+}
+function createSqlPolicyError(message, input) {
+    return new ToolExecutionError(message, {
+        toolName: "executeRequestToIntegration",
+        input,
+        context: {},
+        severity: "info",
+    });
+}
+/**
+ * A direct mutation with RETURNING produces an unbounded result set and cannot
+ * accept a LIMIT clause. Keep this predicate shared by permission prompting and
+ * execution so Clark is never asked to approve a query that cannot run.
+ */
+function isUnboundedReturningMutation(classification) {
+    return (classification.kind === "data_mutation" &&
+        classification.returnsRows &&
+        !classification.supportsRowLimit);
+}
+/**
+ * Whether this SQL mutation targets a managed app database that Clark may
+ * write to without asking. Managed app databases hold Clark-owned sandbox
+ * data, so writes there need no confirmation.
+ *
+ * Gated on the `managedNativeDbEnabled` kill switch, matching `testApi`.
+ */
+function isManagedAppDatabaseWrite(services, integrationId) {
+    if (services.features?.managedNativeDbEnabled !== true) {
+        return false;
+    }
+    return isManagedAppDatabaseTarget(services, integrationId);
+}
+/**
+ * Identifies the target independently of the Native DB rollout switch.
+ * Disabling the feature must not make an existing App Database look external
+ * and bypass migration-only DDL handling. The shared helper recognizes both
+ * the durable managedBy marker and allowlisted lifecycle states primed before
+ * that marker is fetched.
+ */
+function isManagedAppDatabaseTarget(services, integrationId) {
+    const header = services.integrationStore?.getHeader(integrationId);
+    return header != null && isManagedAppDatabaseIntegration(header);
+}
+function logManagedWriteAutoAllow(services, integrationId) {
+    const header = services.integrationStore?.getHeader(integrationId);
+    const logger = getLogger();
+    const message = "[executeRequestToIntegration] Auto-allowing SQL write against a managed app database";
+    const attributes = {
+        "clark.execute_request.permission_decision": "allow_managed_app_database",
+        // Bounded, low-cardinality: which signal identified the integration.
+        "clark.execute_request.allow_signal": header?.managedBy === DATABASE_LIFECYCLE_MANAGED_BY
+            ? "managed_by"
+            : "lifecycle_state",
+        // This log records the unprompted dispatch decision. Without the target,
+        // an investigator looking at an org with several managed databases cannot
+        // tell which one Clark attempted to write to.
+        "integration.id": integrationId,
+    };
+    if (logger.infoStructured) {
+        logger.infoStructured(message, attributes);
+    }
+    else {
+        logger.info(message, attributes);
+    }
+}
+function sqlPluginIdFor(services, integrationId) {
+    return services.integrationStore?.getHeader(integrationId)?.plugin.id;
+}
+function resolveIntegrationParamsType(services, integrationId) {
+    const pluginId = sqlPluginIdFor(services, integrationId);
+    if (pluginId === undefined) {
+        return { resolved: false };
+    }
+    if (pluginId === SalesforcePlugin.id) {
+        return { resolved: true, expected: "salesforce" };
+    }
+    if (pluginId === CosmosDbPlugin.id) {
+        return { resolved: true, expected: "cosmosdb" };
+    }
+    if (pluginId === DatabricksPlugin.id) {
+        return { resolved: true, expected: "sql" };
+    }
+    const plugin = services.integrationStore?.getPlugin(pluginId);
+    if (plugin === undefined) {
+        return { resolved: false };
+    }
+    if (extractSqlQueryFieldPathFromTemplate(plugin.actionTemplate) !== undefined) {
+        return { resolved: true, expected: "sql" };
+    }
+    return { resolved: true };
+}
+/**
+ * The params discriminator is model-authored and cannot be trusted to identify
+ * the integration protocol. A mismatched discriminator can bypass the
+ * protocol-specific policy or build a payload for the wrong plugin.
+ */
+function assertSqlParamsTypeMatchesIntegration(services, input) {
+    const resolution = resolveIntegrationParamsType(services, input.integrationId);
+    if (!resolution.resolved) {
+        if (input.params.type === "other") {
+            throw createSqlPolicyError('Cannot verify the integration type, so params.type "other" is not safe to dispatch. Wait for integration metadata and retry with the dedicated params.type.', input);
+        }
+        return;
+    }
+    if (resolution.expected !== undefined &&
+        input.params.type !== resolution.expected) {
+        throw createSqlPolicyError(`This integration requires params.type "${resolution.expected}" so its request policy and payload shape can be enforced.`, input);
+    }
+}
+/**
+ * Whether a SQL query must be approved by the user before it runs: it mutates
+ * rows, and it is not headed for a managed app database that Clark may write
+ * to on its own.
+ */
+function sqlStatementNeedsApproval(services, args, classification) {
+    if (args.params.type !== "sql" || classification === undefined) {
+        return false;
+    }
+    // No plugin id means execute may later parse this as Postgres DDL or a
+    // write. Reporting READ here would skip the prompt, then a header that
+    // appears before execute would run it. Prompt instead; execute still
+    // rejects if the dialect stays unknown.
+    if (sqlPluginIdFor(services, args.integrationId) === undefined &&
+        classification.kind !== "read") {
+        return true;
+    }
+    if (classification.changesSchema &&
+        classification.kind !== "schema_or_session") {
+        return !isManagedAppDatabaseTarget(services, args.integrationId);
+    }
+    return (classification.kind === "data_mutation" &&
+        !isUnboundedReturningMutation(classification) &&
+        !isManagedAppDatabaseWrite(services, args.integrationId));
+}
+/**
+ * Per-input access rule for `executeRequestToIntegration`.
+ *
+ * Returns BLOCK for a data mutation in Plan mode, which the DATA-category
+ * allowance in access-control.ts would otherwise let through. Everything else
+ * returns ALLOW, which the registry treats as "no objection" — it never
+ * downgrades a PROMPT another rule asked for, and the registry still escalates
+ * to a prompt whenever `getRequiredPermissions` reports a WRITE. That is what
+ * separates a managed auto-allow (reported as READ, so it runs) from an
+ * ordinary write (reported as WRITE, so it prompts).
+ */
+export async function checkExecuteRequestPermissions(services, context, input) {
+    if (input === undefined || input.params.type !== "sql") {
+        return PermissionLevel.ALLOW;
+    }
+    const classification = await classifySqlStatement(input.params.query, sqlPluginIdFor(services, input.integrationId));
+    // Unknown results are deliberately not cached so a transient parser outage
+    // can recover. Stop this attempt here: allowing it to continue would let a
+    // later reclassification change READ to WRITE after the access decision.
+    if (classification.kind === "unknown") {
+        return PermissionLevel.BLOCK;
+    }
+    if (classification.kind !== "data_mutation" &&
+        classification.kind !== "ddl") {
+        return PermissionLevel.ALLOW;
+    }
+    // Plan mode stays read-only even when the plan itself is approved.
+    if (context.mode === AiMode.PLAN) {
+        return PermissionLevel.BLOCK;
+    }
+    return PermissionLevel.ALLOW;
+}
+/**
+ * Classifies permission type using a hybrid approach:
+ * 1. Deterministic floor (free): GET→READ, DELETE/PUT/PATCH→WRITE,
+ *    SQL data mutations→WRITE, Salesforce→READ, GraphQL structural check,
+ *    S3/DynamoDB/GCS/CosmosDB/MongoDB→READ.
+ * 2. Clark's declared `operation` for the remaining ambiguous cases:
+ *    REST POST, and the "other" plugin type.
+ *
+ * SQL is classified from the parsed statement, and must stay in lockstep with
+ * what `execute()` will actually let run — a mutation reported as READ here
+ * would execute with no approval at all.
+ */
+function classifyPermissionType(args, sqlNeedsApproval = false) {
+    const { params, operation } = args;
+    if (params.type === "sql") {
+        return sqlNeedsApproval ? AiPermissionType.WRITE : AiPermissionType.READ;
+    }
+    // Salesforce SOQL mutations are rejected outright, so nothing to approve.
+    if (params.type === "salesforce") {
+        return AiPermissionType.READ;
+    }
+    if (params.type === "graphql") {
+        return classifyGraphQLOperation(params.graphQLQuery.query);
+    }
+    // Deterministic floor for REST: GET is always READ; DELETE/PUT/PATCH are
+    // semantically mutating and always WRITE. Only POST is truly ambiguous
+    // (e.g. search APIs, RPC-style reads) and falls through to Clark's
+    // declared operation below.
+    if (params.type === "rest") {
+        const method = params.httpRequest.httpMethod;
+        if (method === "GET") {
+            return AiPermissionType.READ;
+        }
+        if (method === "DELETE" || method === "PUT" || method === "PATCH") {
+            return AiPermissionType.WRITE;
+        }
+    }
+    // Schema-constrained read-only types (enum limits to read actions)
+    if (params.type === "s3" ||
+        params.type === "dynamodb" ||
+        params.type === "gcs" ||
+        params.type === "cosmosdb" ||
+        params.type === "mongodb") {
+        return AiPermissionType.READ;
+    }
+    // For everything else (REST POST, "other"): trust Clark's declaration.
+    return operation === "write" ? AiPermissionType.WRITE : AiPermissionType.READ;
+}
+//# sourceMappingURL=execute-request.js.map