@taiga-ai/mcp-server 0.13.0-rc.424 → 0.14.0-dev.425

package/src/tools/maintenance.ts

@@ -0,0 +1,336 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import {
+  MAINTENANCE_FINDING_KINDS,
+  MAINTENANCE_FINDING_SEVERITIES,
+  MAINTENANCE_FINDING_STATUSES,
+  MAINTENANCE_IGNORE_REASONS,
+} from '@taiga/types';
+import { z } from 'zod';
+import type { TaigaClient } from '../client.js';
+import { OPERATE, READ_ONLY } from './annotations.js';
+import { runTool, toolError, toolResult } from './errors.js';
+import { pagination, productId } from './inputs.js';
+import { page, pickFields } from './summarize.js';
+
+/**
+ * Maintaining (docs.tai.ga, Operate): what the sweeps found in a product's
+ * repository and where it stands against the organization's own policies,
+ * and the two things a person does with a finding, Ignore and Fix. Sweeps run
+ * themselves and nothing is marked fixed by hand: a finding resolves when the
+ * next sweep no longer detects it, so there is no tool for either.
+ */
+
+type Row = Record<string, unknown>;
+
+/** A finding as a list row: enough to decide whether to open, fix or ignore it. */
+const FINDING_ROW_FIELDS = [
+  'id',
+  'kind',
+  'severity',
+  'tier',
+  'status',
+  'title',
+  'ecosystem',
+  'packageName',
+  'currentVersion',
+  'recommendedVersion',
+  'advisoryId',
+  'location',
+  'sourcePaths',
+  'productRepositoryId',
+  'ownership',
+  'remediableBy',
+  'controls',
+  'backlogItemId',
+  'detectedAt',
+  'ignoreReason',
+  'ignoreExpiresAt',
+] as const;
+
+/** A sweep as the record of when the product was last checked, and whether that check held. */
+const SWEEP_FIELDS = [
+  'id',
+  'trigger',
+  'status',
+  'scanners',
+  'findingsCount',
+  'newFindingsCount',
+  'error',
+  'createdAt',
+  'completedAt',
+] as const;
+
+/** A policy violation in a list: what it is, how bad, and what is being done about it. */
+const VIOLATION_FIELDS = [
+  'id',
+  'controlId',
+  'policyType',
+  'severity',
+  'status',
+  'title',
+  'summary',
+  'work',
+  'unconfirmedSince',
+  'verifyRequestedAt',
+  'assessedAt',
+] as const;
+
+const findingId = z.string().uuid().describe('Finding ID -- taiga_list_findings gives it');
+
+export function registerMaintenanceTools(server: McpServer, client: TaigaClient) {
+  if (!client.hasCapability('products:read')) return;
+
+  server.registerTool(
+    'taiga_get_maintenance',
+    {
+      title: "Get a product's maintenance standing",
+      description:
+        "Where a product's repository stands: open findings by severity and kind, the most pressing ones, and " +
+        'the latest sweeps, so you can tell when the product was last checked and whether that check succeeded. A ' +
+        'quiet list from a sweep that last ran long ago, or that failed, is not an all-clear; a product never swept ' +
+        'says so. Sweeps run on their own after a push and periodically; nothing here starts one. Read the ' +
+        'findings with taiga_list_findings and the policy standing with taiga_get_policy_standing.',
+      inputSchema: { productId },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const [summary, sweeps] = await Promise.all([
+          client.getMaintenanceSummary(params.productId),
+          client.listMaintenanceSweeps(params.productId, { limit: 3 }),
+        ]);
+        const latest = pickFields(sweeps.data as Row[], SWEEP_FIELDS);
+        const { lastRun: _lastRun, ...standing } = summary.data as Row;
+        return toolResult({
+          ...standing,
+          latestSweeps: latest,
+          ...(latest.length === 0 ? { note: 'This product has never been swept: no result is not an all-clear.' } : {}),
+        });
+      })
+  );
+
+  server.registerTool(
+    'taiga_list_findings',
+    {
+      title: 'List maintenance findings',
+      description:
+        "List what the sweeps found in a product's repository: vulnerable or outdated dependencies, committed " +
+        'secrets, insecure code (sast) and infrastructure misconfigurations (iac_misconfig). Each row carries its ' +
+        'severity and its priority tier (act_now: known exploited; urgent: likely and serious; elevated: one of ' +
+        'the two; routine), where it is, who can fix it (remediableBy: coding_agent, or upstream_only for a ' +
+        'submodule or a dependency with no fixed version), the policy controls it breaches, and the initiative ' +
+        'already fixing it (backlogItemId). Omit status for the findings that need action; work from the top tier ' +
+        'down. Read one in full with taiga_get_finding.',
+      inputSchema: {
+        productId,
+        status: z
+          .enum(MAINTENANCE_FINDING_STATUSES)
+          .optional()
+          .describe('Only findings in this status; omit for the ones needing action'),
+        severity: z.enum(MAINTENANCE_FINDING_SEVERITIES).optional().describe('Only this severity'),
+        kind: z.enum(MAINTENANCE_FINDING_KINDS).optional().describe('Only this kind of finding'),
+        ...pagination,
+      },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const { productId: id, ...filters } = params;
+        const result = await client.listFindings(id, filters);
+        return toolResult({
+          ...page(pickFields(result.data as Row[], FINDING_ROW_FIELDS), result.nextCursor),
+          ...(typeof result.totalCount === 'number' ? { totalCount: result.totalCount } : {}),
+        });
+      })
+  );
+
+  server.registerTool(
+    'taiga_get_finding',
+    {
+      title: 'Get a maintenance finding',
+      description:
+        'Read one finding in full: what it is, how likely it is to be exploited (EPSS, the known-exploited list), ' +
+        'the advisory and the fixed version, the place in the code, the policy controls it breaches, why it is ' +
+        'ranked where it is, its history (reintroduced, previously resolved) and the remediation under way. A ' +
+        "secret's value is never stored; the finding names the rule and the location only.",
+      inputSchema: { findingId },
+      annotations: READ_ONLY,
+    },
+    (params) => runTool(async () => toolResult((await client.getFinding(params.findingId)).data))
+  );
+
+  server.registerTool(
+    'taiga_get_policy_standing',
+    {
+      title: "Get a product's policy standing",
+      description:
+        "Where a product stands against the organization's own published policies: the controls it violates, " +
+        "each with its violations (critical and high only, each citing the policy's sentence and the document " +
+        'passage that contradicts it), what is being done about each (an initiative raised, a fix in progress, ' +
+        'awaiting verification), and when the documents were derived and assessed. A control with no violation ' +
+        'is not listed, and it is not "passing" either: there is no such state. Pass full: true for every ' +
+        "violation's evidence and the resolved ones. Fix a control with taiga_fix_policy_violation.",
+      inputSchema: {
+        productId,
+        full: z
+          .boolean()
+          .optional()
+          .describe("Carry each violation's evidence, the policy excerpt and the resolved violations (default false)"),
+      },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const standing = (await client.getPolicyStanding(params.productId)).data as Row;
+        if (params.full) return toolResult(standing);
+        const controls = Array.isArray(standing.controls) ? (standing.controls as Row[]) : [];
+        const violations = Array.isArray(standing.divergences) ? (standing.divergences as Row[]) : [];
+        const resolved = Array.isArray(standing.resolvedDivergences) ? standing.resolvedDivergences.length : 0;
+        return toolResult({
+          productId: standing.productId,
+          hasPolicies: standing.hasPolicies,
+          assessment: standing.assessment,
+          documents: standing.documents,
+          // Only the controls something is recorded against; every other
+          // control is simply not reported, as the page does.
+          controls: pickFields(
+            controls.filter((c) => Number(c.divergenceCount ?? 0) > 0 || Number(c.findingCount ?? 0) > 0),
+            ['controlId', 'policyType', 'text', 'state', 'divergenceCount', 'findingCount', 'plannedCount']
+          ),
+          violations: pickFields(violations, VIOLATION_FIELDS),
+          resolvedViolations: resolved,
+        });
+      })
+  );
+
+  if (!client.hasCapability('products:write')) return;
+
+  server.registerTool(
+    'taiga_ignore_finding',
+    {
+      title: 'Ignore or reopen a finding',
+      description:
+        'Ignore a finding that does not apply or whose risk is accepted, with the reason (false_positive, ' +
+        'not_reachable, accepted_risk, wont_fix), an optional note and an optional expiry after which it resurfaces ' +
+        'if it still exists; or reopen an ignored one (ignored: false). Ignored findings are kept and reviewable. ' +
+        'There is no "mark fixed": a finding resolves when the next sweep no longer detects it. For a secret that ' +
+        'is only in history, rotate the credential outside Taiga, then ignore it with a reason. Ignoring hides a ' +
+        "shared signal and can record the team's acceptance of a risk, which is the person's decision: ask the " +
+        'person first.',
+      inputSchema: {
+        findingId,
+        ignored: z.boolean().describe('true ignores the finding, false reopens it'),
+        reason: z.enum(MAINTENANCE_IGNORE_REASONS).optional().describe('Why it is ignored; required when ignoring'),
+        note: z.string().trim().max(280).optional().describe('A short justification, kept for audit'),
+        expiresAt: z
+          .string()
+          .datetime({ offset: true })
+          .optional()
+          .describe('When the ignore lapses and the finding resurfaces if it still exists (ISO 8601, in the future)'),
+      },
+      annotations: OPERATE,
+    },
+    (params) =>
+      runTool(async () => {
+        if (params.ignored && params.reason === undefined) {
+          return toolError('VALIDATION_FAILED', 'Say why the finding is ignored (reason).');
+        }
+        const body = params.ignored
+          ? {
+              status: 'ignored' as const,
+              ignoreReason: params.reason,
+              ...(params.note !== undefined ? { ignoreNote: params.note } : {}),
+              ...(params.expiresAt !== undefined ? { ignoreExpiresAt: params.expiresAt } : {}),
+            }
+          : { status: 'open' as const };
+        const finding = (await client.updateFinding(params.findingId, body)).data as Row;
+        return toolResult(pickFields([finding], [...FINDING_ROW_FIELDS, 'ignoreNote'])[0]);
+      })
+  );
+
+  server.registerTool(
+    'taiga_fix_finding',
+    {
+      title: 'Fix a finding',
+      description:
+        "Ask for a finding's fix: Taiga raises an initiative and adds it to the end of the product's queue, where " +
+        "the line plans it in turn; whether the build then waits for a person is the initiative's review gate, " +
+        'as for any initiative. The fix is a normal run that ends in a pull request you review and merge. With ' +
+        "wholeGroup: true it fixes the finding's whole group in one initiative, as the page does: for a " +
+        'dependency, every open advisory on that package at that installed version in one version bump; for ' +
+        'code or infrastructure, every location the same rule flagged. Absent for a secret only in history, ' +
+        'anything in a submodule, and a dependency with no fixed version (remediableBy says upstream_only); the ' +
+        'API refuses those. Starts paid work; ask the person first.',
+      inputSchema: {
+        productId,
+        findingId,
+        wholeGroup: z
+          .boolean()
+          .optional()
+          .describe("Fix every finding in this finding's group (its package and version, or its rule) together"),
+      },
+      annotations: OPERATE,
+    },
+    (params) =>
+      runTool(async () => {
+        if (!params.wholeGroup) {
+          const fixed = (await client.remediateFinding(params.productId, params.findingId)).data as {
+            finding?: Row;
+            backlogItemId?: unknown;
+          };
+          return toolResult({
+            backlogItemId: fixed.backlogItemId,
+            finding: fixed.finding ? pickFields([fixed.finding], FINDING_ROW_FIELDS)[0] : null,
+          });
+        }
+        // The group is the finding's own: the route matches the package (or
+        // rule), the installed version and the repository exactly, so they are
+        // taken from the finding rather than asked of the caller.
+        const finding = (await client.getFinding(params.findingId)).data as Row;
+        // The finding is read by its own id, so it is held to the product the
+        // group fix is sent to, as the single-finding route holds it.
+        if (finding.productId !== params.productId) {
+          return toolError('NOT_FOUND', 'No such finding in this product.');
+        }
+        const result = await client.remediatePackage(params.productId, {
+          ecosystem: String(finding.ecosystem),
+          packageName: String(finding.packageName),
+          currentVersion: typeof finding.currentVersion === 'string' ? finding.currentVersion : null,
+          productRepositoryId: typeof finding.productRepositoryId === 'string' ? finding.productRepositoryId : null,
+        });
+        return toolResult(result.data);
+      })
+  );
+
+  server.registerTool(
+    'taiga_fix_policy_violation',
+    {
+      title: 'Fix policy violations',
+      description:
+        "Ask for the fix of a product's policy violations: name a control to cover every violation recorded " +
+        'against it that has no initiative yet, or a single violation (violationId) when the control has more ' +
+        "than one. Taiga raises one initiative and adds it to the end of the product's queue, exactly as a " +
+        'finding fix does. The violation stays listed while the work is under way: only the next assessment ' +
+        'can record that the documents no longer show it. Starts paid work; ask the person first.',
+      inputSchema: {
+        productId,
+        controlId: z.string().min(1).max(40).optional().describe("The control's identifier, e.g. SEC-3.4"),
+        violationId: z.string().uuid().optional().describe('One violation -- taiga_get_policy_standing gives it'),
+      },
+      annotations: OPERATE,
+    },
+    (params) =>
+      runTool(async () => {
+        if ((params.controlId === undefined) === (params.violationId === undefined)) {
+          return toolError(
+            'VALIDATION_FAILED',
+            'Name either a control (controlId) or one violation (violationId), not both or neither.'
+          );
+        }
+        const result = params.controlId
+          ? await client.remediatePolicyControl(params.productId, params.controlId)
+          : await client.remediatePolicyViolation(params.productId, params.violationId!);
+        return toolResult(result.data);
+      })
+  );
+}

package/src/tools/observe.ts

@@ -0,0 +1,241 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { ENVIRONMENT_TYPES } from '@taiga/types';
+import { z } from 'zod';
+import { TaigaApiError, type TaigaClient } from '../client.js';
+import { OPERATE, OPERATE_SETTING, READ_ONLY } from './annotations.js';
+import { isNetworkFailure, runTool, toolError, toolResult } from './errors.js';
+import { pagination, productId } from './inputs.js';
+import { page, pickFields } from './summarize.js';
+
+/**
+ * What runs where and how it is doing (docs.tai.ga, Deliver: Deployments;
+ * Operate: Monitoring). Taiga observes deployments, it does not perform them:
+ * the history is mirrored from the provider, so these tools read and never
+ * deploy, approve or cancel. Importing history reaches into the connected
+ * provider and is an administrator's action in the web.
+ */
+
+type Row = Record<string, unknown>;
+
+/** A deployment as a line of history: what shipped where, how it ended, and who shipped it. */
+const DEPLOYMENT_FIELDS = [
+  'id',
+  'environmentId',
+  'status',
+  'commitSha',
+  'commitSubject',
+  'version',
+  'tag',
+  'ref',
+  'prNumber',
+  'buildRunId',
+  'actorLogin',
+  'error',
+  'runUrl',
+  'createdAt',
+  'completedAt',
+] as const;
+
+const ENVIRONMENT_FIELDS = ['id', 'name', 'slug', 'type', 'ordinal', 'status', 'isProtected', 'url'] as const;
+
+const environmentId = z.string().uuid().describe('Environment ID -- taiga_get_deployments lists them');
+const windowDays = (choices: string) =>
+  z.number().int().optional().describe(`Days to look back: ${choices} (default 30)`);
+
+/** Whether a failure is the API's (refused, missing, unreachable) rather than a bug here. */
+const isApiFailure = (error: unknown) => error instanceof TaigaApiError || isNetworkFailure(error);
+
+/** A part that may fail on its own without failing the read: null and the reason, or the value. */
+async function part<T>(read: () => Promise<T>): Promise<{ value: T } | { unavailable: string }> {
+  try {
+    return { value: await read() };
+  } catch (error) {
+    if (!isApiFailure(error)) throw error;
+    return {
+      unavailable: error instanceof TaigaApiError ? `${error.status}: ${error.apiMessage ?? ''}`.trim() : 'unreachable',
+    };
+  }
+}
+
+/** Environment pages read for one answer; a product has a handful, so this is a guard, not a page size. */
+const ENVIRONMENT_PAGES = 5;
+
+/** Every environment of a product, page by page, and whether any were left past the guard. */
+async function allEnvironments(client: TaigaClient, product: string): Promise<{ rows: Row[]; more: boolean }> {
+  const rows: Row[] = [];
+  let cursor: string | undefined;
+  for (let pageNo = 0; pageNo < ENVIRONMENT_PAGES; pageNo++) {
+    const result = await client.listEnvironments(product, { limit: 100, cursor });
+    rows.push(...(result.data as Row[]));
+    if (!result.nextCursor) return { rows, more: false };
+    cursor = result.nextCursor;
+  }
+  return { rows, more: true };
+}
+
+export function registerObserveTools(server: McpServer, client: TaigaClient) {
+  if (!client.hasCapability('products:read')) return;
+
+  server.registerTool(
+    'taiga_get_deployments',
+    {
+      title: 'Get what runs where',
+      description:
+        "What is running in each of a product's environments now, anything deploying to them, and the recent " +
+        'history, newest first: each deployment with its commit, pull request, status, who deployed it and, ' +
+        'for a failure, the error the provider reported. What runs is the most recent deployment that actually ' +
+        'succeeded, so a newer failed attempt shows beside the version still running, not in its place. The ' +
+        'history is mirrored from the provider, including deployments made outside Taiga; syncStatus says when ' +
+        "it last synced. Pass environmentId for one environment's history. Taiga observes deployments and " +
+        'never performs them.',
+      inputSchema: { productId, environmentId: environmentId.optional(), ...pagination },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const [environments, current, history, sync] = await Promise.all([
+          allEnvironments(client, params.productId),
+          client.getCurrentDeployments(params.productId),
+          client.listDeployments(params.productId, {
+            environmentId: params.environmentId,
+            limit: params.limit ?? 10,
+            cursor: params.cursor,
+          }),
+          part(() => client.getDeploymentSyncStatus(params.productId)),
+        ]);
+        const now = current.data as { current?: Row[]; deploying?: Row[] };
+        return toolResult({
+          environments: pickFields(environments.rows, ENVIRONMENT_FIELDS),
+          ...(environments.more ? { moreEnvironments: true } : {}),
+          running: pickFields(now.current ?? [], DEPLOYMENT_FIELDS),
+          deploying: pickFields(now.deploying ?? [], DEPLOYMENT_FIELDS),
+          history: page(pickFields(history.data as Row[], DEPLOYMENT_FIELDS), history.nextCursor),
+          ...('value' in sync
+            ? { syncStatus: sync.value.data }
+            : { syncStatus: null, syncUnavailable: sync.unavailable }),
+        });
+      })
+  );
+
+  server.registerTool(
+    'taiga_get_delivery_metrics',
+    {
+      title: 'Get delivery metrics',
+      description:
+        "DORA's five software delivery metrics for one environment (the one marked production, as the page " +
+        'reports them), computed from its deployment history over the last 30, 60 or 90 days: deployment ' +
+        'frequency, lead time and failed deployment recovery time (throughput), change-failure rate and rework ' +
+        'rate (instability), each with its trend against the window before, and a performance band for all but ' +
+        'rework rate, which DORA has published none for. Failures and recoveries are read from deployments, not ' +
+        'incidents. A trend built on fewer than ten deployments is approximate; a metric no deployment fed says ' +
+        'so instead of showing a number. Previews and checks do not count.',
+      inputSchema: { productId, environmentId, windowDays: windowDays('30, 60 or 90') },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const days = params.windowDays ?? 30;
+        if (![30, 60, 90].includes(days)) {
+          return toolError('VALIDATION_FAILED', 'windowDays is 30, 60 or 90.');
+        }
+        return toolResult((await client.getDeliveryMetrics(params.productId, params.environmentId, days)).data);
+      })
+  );
+
+  server.registerTool(
+    'taiga_get_monitoring',
+    {
+      title: "Get a product's monitoring",
+      description:
+        "How a product's environments are doing: each environment's current health from Taiga's availability " +
+        'checks of its App URL, with its uptime and when it was last checked; a status Taiga cannot verify now ' +
+        'reads as not checked rather than the last thing it knew, and a new environment as baseline learning. ' +
+        "With environmentId, that environment's uptime over a 30, 60 or 90-day window, and the experience " +
+        'signals the beacon reports (Core Web Vitals, JavaScript errors, client-observed API health) where it is ' +
+        'installed; until then they read as not set up, which means no data, not good data. Setting up the ' +
+        "beacon raises an initiative from the environment's settings in the web.",
+      inputSchema: { productId, environmentId: environmentId.optional(), windowDays: windowDays('30, 60 or 90') },
+      annotations: READ_ONLY,
+    },
+    (params) =>
+      runTool(async () => {
+        const health = await client.getMonitoringHealth(params.productId);
+        if (!params.environmentId) return toolResult({ health: health.data });
+        const days = params.windowDays ?? 30;
+        if (![30, 60, 90].includes(days)) {
+          return toolError('VALIDATION_FAILED', 'windowDays is 30, 60 or 90, the windows the page offers.');
+        }
+        const env = params.environmentId;
+        const [uptime, experience, clientHealth] = await Promise.all([
+          part(() => client.getMonitoringSignal(params.productId, 'uptime', env, days)),
+          part(() => client.getMonitoringSignal(params.productId, 'rum', env, days)),
+          part(() => client.getMonitoringSignal(params.productId, 'client-health', env, days)),
+        ]);
+        const value = (p: { value: { data: unknown } } | { unavailable: string }) =>
+          'value' in p ? p.value.data : { unavailable: p.unavailable };
+        return toolResult({
+          health: (health.data as Row[]).filter((row) => row.environmentId === env),
+          windowDays: days,
+          uptime: value(uptime),
+          realUserExperience: value(experience),
+          clientHealth: value(clientHealth),
+        });
+      })
+  );
+
+  if (!client.hasCapability('products:write')) return;
+
+  server.registerTool(
+    'taiga_define_environment',
+    {
+      title: 'Define an environment',
+      description:
+        "Add a place a product's software runs: development, staging, production or whatever ladder it uses. " +
+        'Deployments are recorded against an environment, monitoring is reported per environment, and plans ' +
+        'read where the work will run. Describing one gives Taiga no access to it: the pipeline deploys, Taiga ' +
+        'learns what happened from source control. Member-level work. Give it its App URL afterwards with ' +
+        'taiga_update_environment, which is all monitoring needs to start checking. Changes the ' +
+        "product's setup for everybody; ask the person first.",
+      inputSchema: {
+        productId,
+        name: z.string().trim().min(1).max(100).describe('What the team calls it, e.g. staging'),
+        type: z.enum(ENVIRONMENT_TYPES).describe('Its kind; production is the one delivery metrics report on'),
+      },
+      annotations: OPERATE,
+    },
+    (params) =>
+      runTool(async () => {
+        const created = (await client.createEnvironment(params.productId, { name: params.name, type: params.type }))
+          .data as Row;
+        return toolResult(pickFields([created], ENVIRONMENT_FIELDS)[0]);
+      })
+  );
+
+  server.registerTool(
+    'taiga_update_environment',
+    {
+      title: 'Update an environment',
+      description:
+        'Rename an environment, change its kind, or set its public App URL (null clears it). The App URL is all ' +
+        "monitoring needs: once it is saved, Taiga checks the app's availability every few minutes on its own. " +
+        'Marking an environment production makes it the one delivery metrics report on. Changes the ' +
+        "product's setup for everybody; ask the person first.",
+      inputSchema: {
+        environmentId,
+        name: z.string().trim().min(1).max(100).optional().describe('A new name'),
+        type: z.enum(ENVIRONMENT_TYPES).optional().describe('A new kind'),
+        url: z.string().trim().max(500).url().nullable().optional().describe('The public App URL; null clears it'),
+      },
+      annotations: OPERATE_SETTING,
+    },
+    (params) =>
+      runTool(async () => {
+        const { environmentId: id, ...changes } = params;
+        if (Object.values(changes).every((value) => value === undefined)) {
+          return toolError('VALIDATION_FAILED', 'Change at least one of name, type or url.');
+        }
+        const updated = (await client.updateEnvironment(id, changes)).data as Row;
+        return toolResult(pickFields([updated], ENVIRONMENT_FIELDS)[0]);
+      })
+  );
+}