@vfarcic/dot-ai 1.7.0 → 1.9.0

package/dist/core/ai-provider-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-provider-factory.d.ts","sourceRoot":"","sources":["../../src/core/ai-provider-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AA8BjC;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU;IA2BnD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,aAAa,IAAI,UAAU;IAoFlC;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAWrD;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,IAAI,MAAM,EAAE;IAMxC;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAGxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C"}
+{"version":3,"file":"ai-provider-factory.d.ts","sourceRoot":"","sources":["../../src/core/ai-provider-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AA6BjC;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU;IA2BnD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,aAAa,IAAI,UAAU;IAoFlC;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAWrD;;;;OAIG;IACH,MAAM,CAAC,qBAAqB,IAAI,MAAM,EAAE;IAMxC;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAGxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C"}

package/dist/core/ai-provider-factory.js

@@ -27,8 +27,7 @@ const PROVIDER_ENV_KEYS = {
     openai: 'OPENAI_API_KEY',
     google: 'GOOGLE_GENERATIVE_AI_API_KEY', // Standard Vercel AI SDK env var (also checks GOOGLE_API_KEY as fallback)
     google_flash: 'GOOGLE_GENERATIVE_AI_API_KEY', // PRD #294: Uses same API key as regular Google
-    kimi: 'MOONSHOT_API_KEY', // PRD #237: Moonshot AI Kimi K2
-    kimi_thinking: 'MOONSHOT_API_KEY', // PRD #237: Uses same API key as regular Kimi
+    kimi: 'MOONSHOT_API_KEY', // PRD #353: Moonshot AI Kimi K2.5
     xai: 'XAI_API_KEY',
 };
 const IMPLEMENTED_PROVIDERS = Object.keys(model_config_1.CURRENT_MODELS);

package/dist/core/embedding-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedding-service.d.ts","sourceRoot":"","sources":["../../src/core/embedding-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAc3B;;GAEG;AACH,eAAO,MAAM,mBAAmB,iDAItB,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC;IACvB,aAAa,IAAI,MAAM,CAAC;IACxB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAgBD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,aAAa,CAAqC;gBAE9C,MAAM,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,qBAAqB,CAAA;KAAE;IAmFnE,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgElD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA2E9D,WAAW,IAAI,OAAO;IAItB,aAAa,IAAI,MAAM;IAIvB,QAAQ,IAAI,MAAM;IAIlB,eAAe,IAAI,MAAM;CAG1B;AAqCD;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAA2B;gBAE/B,MAAM,GAAE,eAAoB;IAKxC;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBxD;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAiB9D;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAqCD;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,MAAM;IAYV;;;OAGG;IACH,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;CAGrD"}
+{"version":3,"file":"embedding-service.d.ts","sourceRoot":"","sources":["../../src/core/embedding-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAc3B;;GAEG;AACH,eAAO,MAAM,mBAAmB,iDAItB,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC;IACvB,aAAa,IAAI,MAAM,CAAC;IACxB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAgBD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,aAAa,CAA6B;gBAEtC,MAAM,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,qBAAqB,CAAA;KAAE;IAmFnE,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgElD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA2E9D,WAAW,IAAI,OAAO;IAItB,aAAa,IAAI,MAAM;IAIvB,QAAQ,IAAI,MAAM;IAIlB,eAAe,IAAI,MAAM;CAG1B;AAqCD;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAA2B;gBAE/B,MAAM,GAAE,eAAoB;IAKxC;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBxD;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAiB9D;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAqCD;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,MAAM;IAYV;;;OAGG;IACH,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;CAGrD"}

package/dist/core/model-config.d.ts

@@ -8,15 +8,14 @@ export declare const CURRENT_MODELS: {
     readonly anthropic: "claude-sonnet-4-6";
     readonly anthropic_opus: "claude-opus-4-6";
     readonly anthropic_haiku: "claude-haiku-4-5-20251001";
-    readonly openai: "gpt-5.1-codex";
+    readonly openai: "gpt-5.4";
     readonly google: "gemini-3.1-pro-preview";
     readonly google_flash: "gemini-3-flash-preview";
-    readonly kimi: "kimi-k2-0905-preview";
-    readonly kimi_thinking: "kimi-k2-thinking";
+    readonly kimi: "kimi-k2.5";
     readonly xai: "grok-4";
     readonly host: "host";
     readonly openrouter: "anthropic/claude-haiku-4.5";
-    readonly custom: "gpt-5.1-codex";
+    readonly custom: "gpt-5.4";
     readonly amazon_bedrock: "global.anthropic.claude-sonnet-4-6";
 };
 /**

package/dist/core/model-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-config.d.ts","sourceRoot":"","sources":["../../src/core/model-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;CAcjB,CAAC;AAEX;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,OAAO,cAAc,GAAG,MAAM,CAE7E"}
+{"version":3,"file":"model-config.d.ts","sourceRoot":"","sources":["../../src/core/model-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;CAajB,CAAC;AAEX;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,OAAO,cAAc,GAAG,MAAM,CAE7E"}

package/dist/core/model-config.js

@@ -12,16 +12,15 @@ exports.CURRENT_MODELS = {
     anthropic: 'claude-sonnet-4-6',
     anthropic_opus: 'claude-opus-4-6',
     anthropic_haiku: 'claude-haiku-4-5-20251001',
-    openai: 'gpt-5.1-codex',
+    openai: 'gpt-5.4',
     google: 'gemini-3.1-pro-preview',
     google_flash: 'gemini-3-flash-preview', // PRD #294: Gemini 3 Flash - faster/cheaper variant with same 1M context
-    kimi: 'kimi-k2-0905-preview', // PRD #237: Moonshot AI Kimi K2 - standard model with 256K context
-    kimi_thinking: 'kimi-k2-thinking', // PRD #237: Moonshot AI Kimi K2 - extended thinking variant
+    kimi: 'kimi-k2.5', // PRD #353: Moonshot AI Kimi K2.5 - single model with thinking by default, 256K context
     xai: 'grok-4',
     host: 'host', // Delegates generation to the client via MCP Sampling
     openrouter: 'anthropic/claude-haiku-4.5', // PRD #194: OpenRouter default model (overridden by AI_MODEL env var)
-    custom: 'gpt-5.1-codex', // PRD #194: Custom endpoint default model (overridden by AI_MODEL env var)
-    amazon_bedrock: 'global.anthropic.claude-sonnet-4-6' // PRD #175: Amazon Bedrock default model (overridden by AI_MODEL env var)
+    custom: 'gpt-5.4', // PRD #194: Custom endpoint default model (overridden by AI_MODEL env var)
+    amazon_bedrock: 'global.anthropic.claude-sonnet-4-6', // PRD #175: Amazon Bedrock default model (overridden by AI_MODEL env var)
 };
 /**
  * Get current model for a provider

package/dist/core/providers/vercel-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-provider.d.ts","sourceRoot":"","sources":["../../../src/core/providers/vercel-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AA4DlC,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,aAAa,CAAiB;gBAE1B,MAAM,EAAE,gBAAgB;IAWpC,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,eAAe;IAwFvB,eAAe,IAAI,MAAM;IAIzB,eAAe,IAAI,MAAM;IAIzB,YAAY,IAAI,MAAM;IAItB,aAAa,IAAI,OAAO;IAIxB,OAAO,CAAC,iBAAiB;IAyBnB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAkB,EAC7B,iBAAiB,CAAC,EAAE;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GACA,OAAO,CAAC,UAAU,CAAC;IAsJtB;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CA6b/D"}
+{"version":3,"file":"vercel-provider.d.ts","sourceRoot":"","sources":["../../../src/core/providers/vercel-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AA4DlC,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,aAAa,CAAiB;gBAE1B,MAAM,EAAE,gBAAgB;IAWpC,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,eAAe;IAwFvB,eAAe,IAAI,MAAM;IAIzB,eAAe,IAAI,MAAM;IAIzB,YAAY,IAAI,MAAM;IAItB,aAAa,IAAI,OAAO;IAIxB,OAAO,CAAC,iBAAiB;IAyBnB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAkB,EAC7B,iBAAiB,CAAC,EAAE;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GACA,OAAO,CAAC,UAAU,CAAC;IAsJtB;;;;;;;;;;;;OAYG;IACG,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CA6b/D"}

package/dist/core/providers/vercel-provider.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VercelProvider = void 0;
 const ai_1 = require("ai");
 const openai_1 = require("@ai-sdk/openai");
+const openai_compatible_1 = require("@ai-sdk/openai-compatible");
 const google_1 = require("@ai-sdk/google");
 const anthropic_1 = require("@ai-sdk/anthropic");
 const xai_1 = require("@ai-sdk/xai");
@@ -75,15 +76,15 @@ class VercelProvider {
                     provider = (0, xai_1.createXai)({ apiKey: this.apiKey });
                     break;
                 case 'kimi':
-                case 'kimi_thinking':
-                    // PRD #237: Moonshot AI Kimi K2 - uses OpenAI-compatible API
-                    // Use .chat() explicitly to use /chat/completions instead of /responses
+                    // PRD #353: Moonshot AI Kimi K2.5 - uses @ai-sdk/openai-compatible for proper
+                    // reasoning_content preservation in multi-turn tool calling
                     // Use global endpoint (api.moonshot.ai) - China endpoint (api.moonshot.cn) requires China-specific API keys
-                    provider = (0, openai_1.createOpenAI)({
+                    provider = (0, openai_compatible_1.createOpenAICompatible)({
+                        name: 'kimi',
                         apiKey: this.apiKey,
                         baseURL: 'https://api.moonshot.ai/v1',
                     });
-                    this.modelInstance = provider.chat(this.model);
+                    this.modelInstance = provider.chatModel(this.model);
                     return; // Early return - model instance already set
                 case 'amazon_bedrock':
                     // PRD #175: Amazon Bedrock provider

package/dist/core/rbac/audit-logger.d.ts

@@ -0,0 +1,23 @@
+/**
+ * RBAC Audit Logger (PRD #392 Milestone 5)
+ *
+ * Logs all authorization decisions and user management operations
+ * for traceability. Uses a dedicated "RBAC-Audit" component name
+ * so entries can be filtered with grep/jq in pod logs.
+ */
+import type { UserIdentity } from '../../interfaces/oauth/types';
+import type { RbacCheckParams, RbacCheckResult } from './check-access';
+/**
+ * Log a tool access authorization decision (allowed or denied).
+ *
+ * Called automatically from checkToolAccess() for every RBAC evaluation.
+ * Token user access is logged at DEBUG level to reduce noise.
+ */
+export declare function logToolAccessDecision(identity: UserIdentity | undefined, params: RbacCheckParams, result: RbacCheckResult): void;
+/**
+ * Log a successful user management operation (create or delete).
+ *
+ * Called from REST API handlers after the operation completes successfully.
+ */
+export declare function logUserManagementOperation(identity: UserIdentity | undefined, operation: 'created' | 'deleted', targetEmail: string): void;
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/core/rbac/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIvE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,eAAe,GACtB,IAAI,CA4BN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAClB,IAAI,CAUN"}

package/dist/core/rbac/audit-logger.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * RBAC Audit Logger (PRD #392 Milestone 5)
+ *
+ * Logs all authorization decisions and user management operations
+ * for traceability. Uses a dedicated "RBAC-Audit" component name
+ * so entries can be filtered with grep/jq in pod logs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logToolAccessDecision = logToolAccessDecision;
+exports.logUserManagementOperation = logUserManagementOperation;
+const error_handling_1 = require("../error-handling");
+const auditLogger = new error_handling_1.ConsoleLogger('RBAC-Audit', error_handling_1.LogLevel.DEBUG);
+/**
+ * Log a tool access authorization decision (allowed or denied).
+ *
+ * Called automatically from checkToolAccess() for every RBAC evaluation.
+ * Token user access is logged at DEBUG level to reduce noise.
+ */
+function logToolAccessDecision(identity, params, result) {
+    const event = result.allowed ? 'tool.access.allowed' : 'tool.access.denied';
+    const data = {
+        event,
+        userId: identity?.userId,
+        email: identity?.email,
+        source: identity?.source,
+        tool: params.toolName,
+        resource: params.resource || 'tools',
+        verb: params.verb || 'execute',
+    };
+    if (params.namespace) {
+        data.namespace = params.namespace;
+    }
+    if (result.reason) {
+        data.reason = result.reason;
+    }
+    if (result.evaluationError) {
+        data.evaluationError = result.evaluationError;
+    }
+    // Token users log at debug level to avoid noise
+    if (identity?.source === 'token') {
+        auditLogger.debug(event, data);
+    }
+    else {
+        auditLogger.info(event, data);
+    }
+}
+/**
+ * Log a successful user management operation (create or delete).
+ *
+ * Called from REST API handlers after the operation completes successfully.
+ */
+function logUserManagementOperation(identity, operation, targetEmail) {
+    const event = `user.${operation}`;
+    auditLogger.info(event, {
+        event,
+        userId: identity?.userId,
+        email: identity?.email,
+        source: identity?.source,
+        operation,
+        targetEmail,
+    });
+}

package/dist/core/rbac/check-access.d.ts

@@ -0,0 +1,48 @@
+/**
+ * RBAC Enforcement Module (PRD #392 Milestone 1)
+ *
+ * Wraps Kubernetes SubjectAccessReview to check tool-level permissions
+ * for OAuth-authenticated users. Token users bypass RBAC entirely.
+ *
+ * Uses the virtual API group "dot-ai.devopstoolkit.ai" — no CRDs needed.
+ * Kubernetes evaluates RBAC rules as pure string matching on the group,
+ * resource, resourceName, and verb fields.
+ */
+import type { UserIdentity } from '../../interfaces/oauth/types';
+/**
+ * Whether RBAC enforcement is enabled.
+ * When disabled (default), all authenticated users have full access.
+ * Set DOT_AI_RBAC_ENABLED=true to enforce tool-level RBAC via SubjectAccessReview.
+ */
+export declare function isRbacEnabled(): boolean;
+export interface RbacCheckResult {
+    allowed: boolean;
+    reason?: string;
+    evaluationError?: string;
+}
+export interface RbacCheckParams {
+    toolName: string;
+    namespace?: string;
+    resource?: string;
+    verb?: string;
+}
+/**
+ * Check whether the given identity is authorized to use the specified tool.
+ *
+ * - Token users (`source: 'token'`) always bypass RBAC.
+ * - OAuth users are checked via SubjectAccessReview against the virtual
+ *   API group `dot-ai.devopstoolkit.ai`.
+ */
+export declare function checkToolAccess(identity: UserIdentity | undefined, params: RbacCheckParams): Promise<RbacCheckResult>;
+/**
+ * Check which tools from a list the identity is authorized for.
+ * Runs checks in parallel for efficiency.
+ */
+export declare function filterAuthorizedTools<T extends {
+    name: string;
+}>(identity: UserIdentity | undefined, tools: T[]): Promise<T[]>;
+/**
+ * Reset the cached API client (for testing).
+ */
+export declare function resetAuthzApi(): void;
+//# sourceMappingURL=check-access.d.ts.map

package/dist/core/rbac/check-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-access.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/check-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAMjE;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAaD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACpE,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,KAAK,EAAE,CAAC,EAAE,GACT,OAAO,CAAC,CAAC,EAAE,CAAC,CAcd;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/core/rbac/check-access.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * RBAC Enforcement Module (PRD #392 Milestone 1)
+ *
+ * Wraps Kubernetes SubjectAccessReview to check tool-level permissions
+ * for OAuth-authenticated users. Token users bypass RBAC entirely.
+ *
+ * Uses the virtual API group "dot-ai.devopstoolkit.ai" — no CRDs needed.
+ * Kubernetes evaluates RBAC rules as pure string matching on the group,
+ * resource, resourceName, and verb fields.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRbacEnabled = isRbacEnabled;
+exports.checkToolAccess = checkToolAccess;
+exports.filterAuthorizedTools = filterAuthorizedTools;
+exports.resetAuthzApi = resetAuthzApi;
+const k8s = __importStar(require("@kubernetes/client-node"));
+const audit_logger_1 = require("./audit-logger");
+const RBAC_API_GROUP = 'dot-ai.devopstoolkit.ai';
+const RBAC_VERB = 'execute';
+/**
+ * Whether RBAC enforcement is enabled.
+ * When disabled (default), all authenticated users have full access.
+ * Set DOT_AI_RBAC_ENABLED=true to enforce tool-level RBAC via SubjectAccessReview.
+ */
+function isRbacEnabled() {
+    return process.env.DOT_AI_RBAC_ENABLED === 'true';
+}
+let authzApi;
+function getAuthzApi() {
+    if (!authzApi) {
+        const kc = new k8s.KubeConfig();
+        kc.loadFromDefault();
+        authzApi = kc.makeApiClient(k8s.AuthorizationV1Api);
+    }
+    return authzApi;
+}
+/**
+ * Check whether the given identity is authorized to use the specified tool.
+ *
+ * - Token users (`source: 'token'`) always bypass RBAC.
+ * - OAuth users are checked via SubjectAccessReview against the virtual
+ *   API group `dot-ai.devopstoolkit.ai`.
+ */
+async function checkToolAccess(identity, params) {
+    // No identity — deny
+    if (!identity) {
+        const result = { allowed: false, reason: 'No identity available' };
+        (0, audit_logger_1.logToolAccessDecision)(identity, params, result);
+        return result;
+    }
+    // Token users bypass RBAC (backward-compatible)
+    if (identity.source === 'token') {
+        const result = { allowed: true };
+        (0, audit_logger_1.logToolAccessDecision)(identity, params, result);
+        return result;
+    }
+    // RBAC disabled — all authenticated users have full access
+    if (!isRbacEnabled()) {
+        return { allowed: true };
+    }
+    const resource = params.resource || 'tools';
+    const verb = params.verb || RBAC_VERB;
+    try {
+        const api = getAuthzApi();
+        const review = await api.createSubjectAccessReview({
+            body: {
+                apiVersion: 'authorization.k8s.io/v1',
+                kind: 'SubjectAccessReview',
+                spec: {
+                    user: identity.email,
+                    groups: identity.groups,
+                    resourceAttributes: {
+                        group: RBAC_API_GROUP,
+                        resource,
+                        name: params.toolName,
+                        verb,
+                        ...(params.namespace ? { namespace: params.namespace } : {}),
+                    },
+                },
+            },
+        });
+        const status = review.status;
+        const result = {
+            allowed: status?.allowed ?? false,
+            reason: status?.reason ||
+                (status?.allowed ? undefined : 'Access denied by RBAC policy'),
+        };
+        (0, audit_logger_1.logToolAccessDecision)(identity, params, result);
+        return result;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const result = {
+            allowed: false,
+            reason: 'RBAC evaluation failed',
+            evaluationError: message,
+        };
+        (0, audit_logger_1.logToolAccessDecision)(identity, params, result);
+        return result;
+    }
+}
+/**
+ * Check which tools from a list the identity is authorized for.
+ * Runs checks in parallel for efficiency.
+ */
+async function filterAuthorizedTools(identity, tools) {
+    // No identity, token user, or RBAC disabled — return all tools
+    if (!identity || identity.source === 'token' || !isRbacEnabled()) {
+        return tools;
+    }
+    const checks = await Promise.all(tools.map(async (tool) => ({
+        tool,
+        result: await checkToolAccess(identity, { toolName: tool.name }),
+    })));
+    return checks.filter(c => c.result.allowed).map(c => c.tool);
+}
+/**
+ * Reset the cached API client (for testing).
+ */
+function resetAuthzApi() {
+    authzApi = undefined;
+}

package/dist/core/rbac/index.d.ts

@@ -0,0 +1,3 @@
+export { checkToolAccess, filterAuthorizedTools, isRbacEnabled, resetAuthzApi, type RbacCheckResult, type RbacCheckParams, } from './check-access';
+export { logToolAccessDecision, logUserManagementOperation } from './audit-logger';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/core/rbac/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logUserManagementOperation = exports.logToolAccessDecision = exports.resetAuthzApi = exports.isRbacEnabled = exports.filterAuthorizedTools = exports.checkToolAccess = void 0;
+var check_access_1 = require("./check-access");
+Object.defineProperty(exports, "checkToolAccess", { enumerable: true, get: function () { return check_access_1.checkToolAccess; } });
+Object.defineProperty(exports, "filterAuthorizedTools", { enumerable: true, get: function () { return check_access_1.filterAuthorizedTools; } });
+Object.defineProperty(exports, "isRbacEnabled", { enumerable: true, get: function () { return check_access_1.isRbacEnabled; } });
+Object.defineProperty(exports, "resetAuthzApi", { enumerable: true, get: function () { return check_access_1.resetAuthzApi; } });
+var audit_logger_1 = require("./audit-logger");
+Object.defineProperty(exports, "logToolAccessDecision", { enumerable: true, get: function () { return audit_logger_1.logToolAccessDecision; } });
+Object.defineProperty(exports, "logUserManagementOperation", { enumerable: true, get: function () { return audit_logger_1.logUserManagementOperation; } });

package/dist/core/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAUrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA6B7C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,SAAS;IACxB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAGD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC/D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QACX,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;CAElB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAQpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAOlC,CAAC;AAwBF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC/C;AAKD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE;QAAE,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;CACrD;AA8GD;;GAEG;AACH,qBAAa,YAAY;IACvB;;OAEG;IACH,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,GAAG,cAAc;IAuD1E;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB;CA2D3E;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;;IAKH;;;OAGG;YACW,uBAAuB;IAuCrC;;;;OAIG;IACG,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,gBAAgB,CAAC;IAqF5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAqBhC;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAC,CAAuB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAEhC,UAAU,CAAC,EAAE,UAAU;IAqDnC;;;OAGG;YACW,uBAAuB;IAuCrC;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACvD,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC;IA+G1B;;OAEG;YACW,wBAAwB;IAwBtC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IA4EnC;;OAEG;YACW,0BAA0B;IA2CxC;;OAEG;YACW,0BAA0B;IAyExC;;OAEG;IACH,OAAO,CAAC,8BAA8B;IAQtC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAanC;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAYpC;;;OAGG;YACW,sBAAsB;IA8BpC;;OAEG;YACW,oBAAoB;IAsElC;;;OAGG;YACW,sBAAsB;IAuGpC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAchC;;OAEG;YACW,uBAAuB;IA8NrC;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,aAAa,CAAC;IAgJzB;;OAEG;IACG,qBAAqB,CACzB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA4CnD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAUrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA6B7C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,SAAS;IACxB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAGD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC/D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QACX,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;CAElB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,IAAI,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAQpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,QAOlC,CAAC;AAwBF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,GAAG,aAAa,CAAC;IAC/B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC/C;AAKD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE;QAAE,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;CACrD;AA8GD;;GAEG;AACH,qBAAa,YAAY;IACvB;;OAEG;IACH,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,GAAG,cAAc;IAuD1E;;OAEG;IACH,OAAO,CAAC,cAAc;IA4BtB;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB;CA2D3E;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;;IAKH;;;OAGG;YACW,uBAAuB;IAuCrC;;;;OAIG;IACG,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAC5C,OAAO,CAAC,gBAAgB,CAAC;IAqF5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAqBhC;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAC,CAAuB;IAC9C,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,aAAa,CAAC,CAAsB;gBAEhC,UAAU,CAAC,EAAE,UAAU;IAqDnC;;;OAGG;YACW,uBAAuB;IAuCrC;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACvD,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC;IA+G1B;;OAEG;YACW,wBAAwB;IAwBtC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IA4EnC;;OAEG;YACW,0BAA0B;IA2CxC;;OAEG;YACW,0BAA0B;IAyExC;;OAEG;IACH,OAAO,CAAC,8BAA8B;IAQtC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAanC;;OAEG;IACH,OAAO,CAAC,4BAA4B;IAYpC;;;OAGG;YACW,sBAAsB;IA8BpC;;OAEG;YACW,oBAAoB;IAsElC;;;OAGG;YACW,sBAAsB;IAuGpC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAchC;;OAEG;YACW,uBAAuB;IA2OrC;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,aAAa,CAAC;IAgJzB;;OAEG;IACG,qBAAqB,CACzB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA4CnD"}

package/dist/core/schema.js

@@ -1035,7 +1035,7 @@ ${resourceDetails}`;
                 !questions.open) {
                 throw new Error('Invalid question structure from AI');
             }
-            // Sanitize select/multiselect questions: ensure suggestedAnswer matches options
+            // Sanitize questions: ensure suggestedAnswer passes its own validation constraints
             const sanitizeQuestions = (qs) => {
                 for (const q of qs) {
                     if ((q.type === 'select' || q.type === 'multiselect') &&
@@ -1057,6 +1057,19 @@ ${resourceDetails}`;
                             }
                         }
                     }
+                    // Clamp number suggestedAnswer to validation.min/max bounds
+                    if (q.type === 'number' && q.suggestedAnswer !== undefined && q.validation) {
+                        let num = Number(q.suggestedAnswer);
+                        if (!isNaN(num)) {
+                            if (q.validation.min !== undefined && num < q.validation.min) {
+                                num = q.validation.min;
+                            }
+                            if (q.validation.max !== undefined && num > q.validation.max) {
+                                num = q.validation.max;
+                            }
+                            q.suggestedAnswer = num;
+                        }
+                    }
                 }
             };
             sanitizeQuestions(questions.required);

package/dist/interfaces/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAmEtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAmBD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IAmBvB;;OAEG;IACH,OAAO,CAAC,WAAW;IAwFnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAyBzB,OAAO,CAAC,qBAAqB;IAO7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAYd,kBAAkB;YA4MlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC3B,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/interfaces/mcp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAwEtC,OAAO,EAAgB,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAcvD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAmBD,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAkC;IACrD,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,aAAa,CAAC,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,CAA6B;IAC9C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,SAAS,CAAC,CAAM;gBAEZ,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe;IA6BjD;;;OAGG;IACH,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAQ7C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBxB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2CvB;;OAEG;IACH,OAAO,CAAC,WAAW;IAkKnB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmBzB;;;;OAIG;YACW,mBAAmB;IA6CjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAkCzB,OAAO,CAAC,qBAAqB;IAS7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAInB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAed,kBAAkB;YAuQlB,gBAAgB;IAexB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoC3B,OAAO,IAAI,OAAO;CAGnB"}