arc-1 0.6.10 → 0.7.0

package/dist/authz/policy.js

@@ -0,0 +1,199 @@
+/**
+ * ACTION_POLICY — single source of truth for scope/opType/featureGate per tool+action.
+ *
+ * Every MCP tool call is gated by this matrix. `handleToolCall` in intent.ts looks up
+ * `(tool, action-or-type)` here to get the required scope (user-gate) and OperationType
+ * (server-safety gate). Tool-listing pruning in server.ts also reads from here to hide
+ * actions the user can't execute.
+ *
+ * Lookup rules:
+ *   - Specific key `Tool.action` or `Tool.type` wins if present.
+ *   - Falls back to tool-level key `Tool`.
+ *   - Missing → treated as "unknown action" error at runtime.
+ *
+ * Admin-facing invariant: the CI validator at scripts/validate-action-policy.ts
+ * asserts every action in src/handlers/schemas.ts is covered here, and vice versa.
+ * If you add a new action, add its policy entry here and the validator will tell
+ * you if you forgot.
+ */
+import { OperationType } from '../adt/safety.js';
+/** The central policy matrix — all tools, all actions/types. */
+export const ACTION_POLICY = {
+    // ── SAPRead ──────────────────────────────────────────────────────
+    // Tool-level default — applies to all SAP object reads (PROG, CLAS, etc.)
+    SAPRead: { scope: 'read', opType: OperationType.Read },
+    // Per-type overrides
+    'SAPRead.TABLE_CONTENTS': { scope: 'data', opType: OperationType.Query },
+    // ── SAPSearch ────────────────────────────────────────────────────
+    SAPSearch: { scope: 'read', opType: OperationType.Search },
+    // ── SAPQuery (freestyle SQL) ─────────────────────────────────────
+    SAPQuery: { scope: 'sql', opType: OperationType.FreeSQL },
+    // ── SAPWrite ─────────────────────────────────────────────────────
+    SAPWrite: { scope: 'write', opType: OperationType.Update },
+    'SAPWrite.create': { scope: 'write', opType: OperationType.Create },
+    'SAPWrite.update': { scope: 'write', opType: OperationType.Update },
+    'SAPWrite.delete': { scope: 'write', opType: OperationType.Delete },
+    'SAPWrite.edit_method': { scope: 'write', opType: OperationType.Update },
+    'SAPWrite.batch_create': { scope: 'write', opType: OperationType.Create },
+    // scaffold_rap_handlers updates an existing behavior-pool CLAS (writes method
+    // declarations into one or more includes). It is a RAP-feature-specific
+    // action — explicit entry lets admins target it with SAP_DENY_ACTIONS
+    // (e.g. "SAPWrite.scaffold_rap_handlers") to block it while still allowing
+    // plain create/update. The featureGate tag also keeps this action aligned
+    // with the SAPTransport/SAPGit/FLP pattern for future enforcement.
+    'SAPWrite.scaffold_rap_handlers': { scope: 'write', opType: OperationType.Update, featureGate: 'rap' },
+    // ── SAPActivate ──────────────────────────────────────────────────
+    SAPActivate: { scope: 'write', opType: OperationType.Activate },
+    'SAPActivate.activate': { scope: 'write', opType: OperationType.Activate },
+    'SAPActivate.publish_srvb': { scope: 'write', opType: OperationType.Activate },
+    'SAPActivate.unpublish_srvb': { scope: 'write', opType: OperationType.Activate },
+    // ── SAPNavigate ──────────────────────────────────────────────────
+    SAPNavigate: { scope: 'read', opType: OperationType.Intelligence },
+    'SAPNavigate.definition': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPNavigate.references': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPNavigate.completion': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPNavigate.hierarchy': { scope: 'read', opType: OperationType.Intelligence },
+    // ── SAPLint ──────────────────────────────────────────────────────
+    SAPLint: { scope: 'read', opType: OperationType.Intelligence },
+    'SAPLint.lint': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPLint.lint_and_fix': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPLint.list_rules': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPLint.format': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPLint.get_formatter_settings': { scope: 'read', opType: OperationType.Intelligence },
+    // CLASSIFICATION BUG FIX: set_formatter_settings mutates server-side settings
+    'SAPLint.set_formatter_settings': { scope: 'write', opType: OperationType.Update },
+    // ── SAPDiagnose ──────────────────────────────────────────────────
+    SAPDiagnose: { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.syntax': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.unittest': { scope: 'read', opType: OperationType.Test },
+    'SAPDiagnose.atc': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.dumps': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.traces': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.system_messages': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.gateway_errors': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.quickfix': { scope: 'read', opType: OperationType.Read },
+    'SAPDiagnose.apply_quickfix': { scope: 'read', opType: OperationType.Read },
+    // ── SAPTransport ─────────────────────────────────────────────────
+    // CLASSIFICATION BUG FIX: check/history/list/get are reads; previously required write
+    SAPTransport: { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAPTransport.list': { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAPTransport.get': { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAPTransport.check': { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAPTransport.history': { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAPTransport.create': { scope: 'transports', opType: OperationType.Transport, featureGate: 'transport' },
+    'SAPTransport.release': { scope: 'transports', opType: OperationType.Transport, featureGate: 'transport' },
+    'SAPTransport.release_recursive': { scope: 'transports', opType: OperationType.Transport, featureGate: 'transport' },
+    'SAPTransport.reassign': { scope: 'transports', opType: OperationType.Transport, featureGate: 'transport' },
+    'SAPTransport.delete': { scope: 'transports', opType: OperationType.Transport, featureGate: 'transport' },
+    // ── SAPGit ───────────────────────────────────────────────────────
+    SAPGit: { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.list_repos': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.whoami': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.config': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.branches': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.external_info': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.history': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.objects': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.check': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAPGit.stage': { scope: 'git', opType: OperationType.Update, featureGate: 'git' },
+    'SAPGit.clone': { scope: 'git', opType: OperationType.Create, featureGate: 'git' },
+    'SAPGit.pull': { scope: 'git', opType: OperationType.Update, featureGate: 'git' },
+    'SAPGit.push': { scope: 'git', opType: OperationType.Update, featureGate: 'git' },
+    'SAPGit.commit': { scope: 'git', opType: OperationType.Update, featureGate: 'git' },
+    'SAPGit.switch_branch': { scope: 'git', opType: OperationType.Update, featureGate: 'git' },
+    'SAPGit.create_branch': { scope: 'git', opType: OperationType.Create, featureGate: 'git' },
+    'SAPGit.unlink': { scope: 'git', opType: OperationType.Delete, featureGate: 'git' },
+    // ── SAPContext ───────────────────────────────────────────────────
+    SAPContext: { scope: 'read', opType: OperationType.Intelligence },
+    'SAPContext.deps': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPContext.usages': { scope: 'read', opType: OperationType.Intelligence },
+    'SAPContext.impact': { scope: 'read', opType: OperationType.Intelligence },
+    // ── SAPManage ────────────────────────────────────────────────────
+    SAPManage: { scope: 'write', opType: OperationType.Update },
+    'SAPManage.features': { scope: 'read', opType: OperationType.Read },
+    'SAPManage.probe': { scope: 'read', opType: OperationType.Read },
+    'SAPManage.cache_stats': { scope: 'read', opType: OperationType.Read },
+    'SAPManage.create_package': { scope: 'write', opType: OperationType.Create },
+    'SAPManage.delete_package': { scope: 'write', opType: OperationType.Delete },
+    'SAPManage.change_package': { scope: 'write', opType: OperationType.Update },
+    // CLASSIFICATION BUG FIX: flp_list_* are read operations; previously required write
+    'SAPManage.flp_list_catalogs': { scope: 'read', opType: OperationType.Read, featureGate: 'flp' },
+    'SAPManage.flp_list_groups': { scope: 'read', opType: OperationType.Read, featureGate: 'flp' },
+    'SAPManage.flp_list_tiles': { scope: 'read', opType: OperationType.Read, featureGate: 'flp' },
+    'SAPManage.flp_create_catalog': { scope: 'write', opType: OperationType.Workflow, featureGate: 'flp' },
+    'SAPManage.flp_create_group': { scope: 'write', opType: OperationType.Workflow, featureGate: 'flp' },
+    'SAPManage.flp_create_tile': { scope: 'write', opType: OperationType.Workflow, featureGate: 'flp' },
+    'SAPManage.flp_add_tile_to_group': { scope: 'write', opType: OperationType.Workflow, featureGate: 'flp' },
+    'SAPManage.flp_delete_catalog': { scope: 'write', opType: OperationType.Workflow, featureGate: 'flp' },
+    // ── Hyperfocused SAP (single-tool mode) ──────────────────────────
+    // Mirrors the action surface of the non-hyperfocused tools. Keys are SAP.<action>.
+    // Most are identical to the per-tool entries above.
+    SAP: { scope: 'read', opType: OperationType.Read },
+    'SAP.read': { scope: 'read', opType: OperationType.Read },
+    'SAP.search': { scope: 'read', opType: OperationType.Search },
+    'SAP.query': { scope: 'sql', opType: OperationType.FreeSQL },
+    'SAP.navigate': { scope: 'read', opType: OperationType.Intelligence },
+    'SAP.context': { scope: 'read', opType: OperationType.Intelligence },
+    'SAP.lint': { scope: 'read', opType: OperationType.Intelligence },
+    'SAP.diagnose': { scope: 'read', opType: OperationType.Read },
+    'SAP.write': { scope: 'write', opType: OperationType.Update },
+    'SAP.activate': { scope: 'write', opType: OperationType.Activate },
+    // Hyperfocused delegators are intentionally read-scoped at the top level.
+    // The recursive real-tool call enforces the concrete sub-action policy
+    // (for example SAPTransport.create => transports, SAPManage.create_package => write).
+    'SAP.transport': { scope: 'read', opType: OperationType.Read, featureGate: 'transport' },
+    'SAP.git': { scope: 'read', opType: OperationType.Read, featureGate: 'git' },
+    'SAP.manage': { scope: 'read', opType: OperationType.Read },
+};
+/**
+ * Look up the policy for a tool + optional action/type.
+ * Falls back to tool-level default if the specific key is absent.
+ */
+export function getActionPolicy(tool, action) {
+    if (action) {
+        const specific = ACTION_POLICY[`${tool}.${action}`];
+        if (specific)
+            return specific;
+    }
+    return ACTION_POLICY[tool];
+}
+/** Return all keys in the policy matrix (used by validator + consistency tests). */
+export function allPolicyKeys() {
+    return Object.keys(ACTION_POLICY);
+}
+/**
+ * Expand implicit scopes.
+ * - `admin` implies all other scopes.
+ * - `write` implies `read`.
+ * - `sql` implies `data`.
+ * Returns a sorted deduplicated list.
+ */
+export function expandScopes(scopes) {
+    const expanded = new Set(scopes);
+    if (expanded.has('admin')) {
+        expanded.add('read');
+        expanded.add('write');
+        expanded.add('data');
+        expanded.add('sql');
+        expanded.add('transports');
+        expanded.add('git');
+    }
+    if (expanded.has('write'))
+        expanded.add('read');
+    if (expanded.has('sql'))
+        expanded.add('data');
+    return [...expanded].sort();
+}
+/**
+ * Check whether a user's scopes satisfy the required scope, applying implications.
+ * Returns true when:
+ *   - The user has the exact required scope, OR
+ *   - The user has `admin` (implies all), OR
+ *   - required=`read` and the user has `write` OR any other scope that implies read, OR
+ *   - required=`data` and the user has `sql`.
+ */
+export function hasRequiredScope(scopes, required) {
+    const expanded = new Set(expandScopes(scopes));
+    return expanded.has(required);
+}
+//# sourceMappingURL=policy.js.map

package/dist/authz/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/authz/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAA0B,MAAM,kBAAkB,CAAC;AAYzE,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAiC;IACzD,oEAAoE;IACpE,0EAA0E;IAC1E,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACtD,qBAAqB;IACrB,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE;IAExE,oEAAoE;IACpE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAE1D,oEAAoE;IACpE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAEzD,oEAAoE;IACpE,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC1D,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IACnE,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IACnE,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IACnE,sBAAsB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IACxE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,mEAAmE;IACnE,gCAAgC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAEtG,oEAAoE;IACpE,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC/D,sBAAsB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC1E,0BAA0B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9E,4BAA4B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAEhF,oEAAoE;IACpE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAClE,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC/E,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC/E,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC/E,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAE9E,oEAAoE;IACpE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC9D,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACrE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC7E,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC3E,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACvE,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACvF,8EAA8E;IAC9E,gCAAgC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAElF,oEAAoE;IACpE,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAC1D,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACnE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACrE,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAChE,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAClE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACnE,6BAA6B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAC5E,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAC3E,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACrE,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAE3E,oEAAoE;IACpE,sFAAsF;IACtF,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IACrF,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IAC5F,kBAAkB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3F,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IAC7F,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IAC/F,qBAAqB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;IACzG,sBAAsB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;IAC1G,gCAAgC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;IACpH,uBAAuB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;IAC3G,qBAAqB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE;IAEzG,oEAAoE;IACpE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACzE,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACtF,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAClF,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAClF,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACpF,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACzF,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACnF,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACnF,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IACjF,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAClF,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAClF,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IACjF,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IACjF,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IACnF,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAC1F,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAC1F,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE;IAEnF,oEAAoE;IACpE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACjE,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACxE,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAC1E,mBAAmB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IAE1E,oEAAoE;IACpE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC3D,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACnE,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAChE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACtE,0BAA0B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC5E,0BAA0B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC5E,0BAA0B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC5E,oFAAoF;IACpF,6BAA6B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAChG,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAC9F,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAC7F,8BAA8B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IACtG,4BAA4B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IACpG,2BAA2B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IACnG,iCAAiC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IACzG,8BAA8B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;IAEtG,oEAAoE;IACpE,mFAAmF;IACnF,oDAAoD;IACpD,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAClD,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IACzD,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC7D,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE;IAC5D,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACrE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACpE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,YAAY,EAAE;IACjE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;IAC7D,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE;IAC7D,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,EAAE;IAClE,0EAA0E;IAC1E,uEAAuE;IACvE,sFAAsF;IACtF,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;IACxF,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;IAC5E,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE;CAC5D,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAe;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgB,EAAE,QAAe;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC"}

package/dist/cli-args.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pure argument-parsing helpers for the `arc1 call` command.
+ * Split out from cli.ts so tests can import without side effects
+ * (cli.ts invokes commander's `program.parse()` on import).
+ */
+export type OutputMode = 'text' | 'json';
+export declare function coerceValue(raw: string): unknown;
+export declare function parseArgPair(pair: string): [string, unknown];
+export declare function readJsonInput(source: string): Record<string, unknown>;
+export declare function buildArgs(opts: {
+    arg?: string[];
+    json?: string;
+}): Record<string, unknown>;
+//# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBhD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAM5D;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAerE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ1F"}

package/dist/cli-args.js

@@ -0,0 +1,62 @@
+/**
+ * Pure argument-parsing helpers for the `arc1 call` command.
+ * Split out from cli.ts so tests can import without side effects
+ * (cli.ts invokes commander's `program.parse()` on import).
+ */
+import { readFileSync } from 'node:fs';
+export function coerceValue(raw) {
+    if (raw === 'true')
+        return true;
+    if (raw === 'false')
+        return false;
+    if (raw === 'null')
+        return null;
+    if (raw !== '' && /^-?(\d+(\.\d+)?|\.\d+)$/.test(raw) && !Number.isNaN(Number(raw))) {
+        return Number(raw);
+    }
+    const trimmed = raw.trimStart();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            // fall through — treat as literal string
+        }
+    }
+    return raw;
+}
+export function parseArgPair(pair) {
+    const idx = pair.indexOf('=');
+    if (idx <= 0) {
+        throw new Error(`Invalid --arg '${pair}': expected key=value`);
+    }
+    return [pair.slice(0, idx), coerceValue(pair.slice(idx + 1))];
+}
+export function readJsonInput(source) {
+    let text;
+    const trimmed = source.trimStart();
+    if (source === '-') {
+        text = readFileSync(0, 'utf-8');
+    }
+    else if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        text = source;
+    }
+    else {
+        text = readFileSync(source, 'utf-8');
+    }
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('--json payload must be a JSON object');
+    }
+    return parsed;
+}
+export function buildArgs(opts) {
+    const fromJson = opts.json ? readJsonInput(opts.json) : {};
+    const merged = { ...fromJson };
+    for (const pair of opts.arg ?? []) {
+        const [k, v] = parseArgPair(pair);
+        merged[k] = v;
+    }
+    return merged;
+}
+//# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvC,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,KAAK,EAAE,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,IAAY,CAAC;IACjB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IACnC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuC;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli.d.ts

@@ -1,14 +1,20 @@
 /**
  * ARC-1 CLI — command-line interface for SAP ADT operations.
  *
- * Minimal CLI for direct SAP interaction without an MCP client.
- * For the full MCP server, use `arc1` (runs index.ts).
+ * Exposed via the `arc1-cli` bin (separate from `arc1`, which is the MCP server entry).
  *
- * Commands:
- *   arc1 search <query>       - Search for ABAP objects
- *   arc1 source <type> <name> - Get source code
- *   arc1 lint <source-file>   - Lint ABAP source code
- *   arc1 version              - Show version
+ * Two layers:
+ *   - `arc1-cli serve`                  Start the MCP server (same as `arc1`).
+ *   - `arc1-cli call <tool> [...]`      Call any of the 12 MCP tools directly.
+ *   - `arc1-cli tools [<tool>]`         List tools / show a tool's JSON schema.
+ *   - Shortcuts: `read`, `source` (alias), `activate`, `syntax`, `sql`, `lint`,
+ *     `search`, `extract-cookies`, `version` — one-liners over `call` or helpers
+ *     for common operations.
+ *
+ * The `call` command bypasses the MCP transport but reuses the same dispatch
+ * path (`handleToolCall` in src/handlers/intent.ts), so Zod validation,
+ * safety gates (`SAP_READ_ONLY`, `SAP_ALLOWED_PACKAGES`, ...), and audit
+ * logging all apply exactly as they do under `arc1 serve` stdio mode.
  */
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}