d365fo-mcp 1.0.0

package/dist/tools/securityArtifactInfo.js

@@ -0,0 +1,192 @@
+/**
+ * Security Artifact Info Tool
+ * Retrieve full details for security privileges, duties, and roles including hierarchy chains
+ */
+import { z } from 'zod';
+import { tryBridgeSecurityArtifact } from '../bridge/index.js';
+import { canonicalSymbolName } from '../utils/symbolLookup.js';
+const SecurityArtifactInfoArgsSchema = z.object({
+    name: z.string().describe('Name of the security privilege, duty, or role'),
+    artifactType: z.enum(['privilege', 'duty', 'role']).describe('Type of security artifact'),
+    includeChain: z.boolean().optional().default(true).describe('Walk the full hierarchy (role→duties→privileges→entry points)'),
+});
+/** Symbol type backing each artifactType. */
+const SYMBOL_TYPE = {
+    privilege: 'security-privilege',
+    duty: 'security-duty',
+    role: 'security-role',
+};
+export async function securityArtifactInfoTool(request, context) {
+    try {
+        const args = SecurityArtifactInfoArgsSchema.parse(request.params.arguments);
+        // Resolve the caller's casing to the canonical AOT name before anything else
+        // (#686) — the bridge matches by exact name too, so canonicalizing here fixes
+        // the bridge path as well as the SQLite fallback below.
+        let name = args.name;
+        try {
+            name = canonicalSymbolName(context.symbolIndex.getReadDb(), args.name, [SYMBOL_TYPE[args.artifactType]]) ?? args.name;
+        }
+        catch { /* DB not available — bridge may still resolve it */ }
+        // Bridge fast-path (C# IMetadataProvider)
+        const bridgeResult = await tryBridgeSecurityArtifact(context.bridge, name, args.artifactType, args.includeChain ?? true);
+        if (bridgeResult)
+            return bridgeResult;
+        // Fallback: SQLite index
+        const rdb = context.symbolIndex.getReadDb();
+        if (args.artifactType === 'privilege') {
+            return getPrivilegeInfo(rdb, name, args.includeChain ?? true);
+        }
+        else if (args.artifactType === 'duty') {
+            return getDutyInfo(rdb, name, args.includeChain ?? true);
+        }
+        else {
+            return getRoleInfo(rdb, name, args.includeChain ?? true);
+        }
+    }
+    catch (error) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Error getting security artifact info: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+}
+function getPrivilegeInfo(db, name, _includeChain) {
+    const symbol = db.prepare(`SELECT name, description, signature, model, file_path FROM symbols WHERE name = ? AND type = 'security-privilege' LIMIT 1`).get(name);
+    if (!symbol) {
+        return {
+            content: [{ type: 'text', text: `Security privilege not found: ${name}\n\nTip: Run extract-metadata and build-database to index security objects.` }],
+            isError: true,
+        };
+    }
+    const entryPoints = db.prepare(`SELECT entry_point_name, object_type, access_level FROM security_privilege_entries WHERE privilege_name = ? ORDER BY entry_point_name`).all(name);
+    const duties = db.prepare(`SELECT DISTINCT duty_name FROM security_duty_privileges WHERE privilege_name = ? ORDER BY duty_name`).all(name);
+    let output = `SecurityPrivilege: ${symbol.name}\n`;
+    if (symbol.description)
+        output += `Label: ${symbol.description}\n`;
+    output += `Model: ${symbol.model}\n`;
+    if (entryPoints.length > 0) {
+        output += `\nEntry Points (${entryPoints.length}):\n`;
+        for (const ep of entryPoints) {
+            output += `  ✓ ${ep.entry_point_name} [${ep.object_type}]  → ${ep.access_level} access\n`;
+        }
+    }
+    else {
+        output += `\nEntry Points: none indexed\n`;
+    }
+    if (duties.length > 0) {
+        output += `\nUsed in Duties (${duties.length}):\n`;
+        output += `  ${duties.map((d) => d.duty_name).join(', ')}\n`;
+    }
+    return { content: [{ type: 'text', text: output }] };
+}
+function getDutyInfo(db, name, includeChain) {
+    const symbol = db.prepare(`SELECT name, description, signature, model FROM symbols WHERE name = ? AND type = 'security-duty' LIMIT 1`).get(name);
+    if (!symbol) {
+        return {
+            content: [{ type: 'text', text: `Security duty not found: ${name}` }],
+            isError: true,
+        };
+    }
+    const privileges = db.prepare(`SELECT privilege_name FROM security_duty_privileges WHERE duty_name = ? ORDER BY privilege_name`).all(name);
+    const roles = db.prepare(`SELECT DISTINCT role_name FROM security_role_duties WHERE duty_name = ? ORDER BY role_name`).all(name);
+    let output = `SecurityDuty: ${symbol.name}\n`;
+    if (symbol.description)
+        output += `Label: ${symbol.description}\n`;
+    output += `Model: ${symbol.model}\n`;
+    if (privileges.length > 0) {
+        output += `\nPrivileges (${privileges.length}):\n`;
+        if (includeChain) {
+            // Batched query — fetch all entry points for all privileges in one query
+            const privNames = privileges.map((p) => p.privilege_name);
+            const ph = privNames.map(() => '?').join(',');
+            const allEps = db.prepare(`SELECT privilege_name, entry_point_name, object_type, access_level
+         FROM security_privilege_entries WHERE privilege_name IN (${ph})
+         ORDER BY privilege_name, entry_point_name`).all(...privNames);
+            const epsByPriv = new Map();
+            for (const ep of allEps) {
+                if (!epsByPriv.has(ep.privilege_name))
+                    epsByPriv.set(ep.privilege_name, []);
+                epsByPriv.get(ep.privilege_name).push(ep);
+            }
+            for (const priv of privileges) {
+                const eps = epsByPriv.get(priv.privilege_name) || [];
+                output += `  • ${priv.privilege_name}`;
+                if (eps.length > 0) {
+                    output += ` (${eps.length} entry points: ${eps.slice(0, 3).map((ep) => `${ep.entry_point_name}[${ep.access_level}]`).join(', ')}${eps.length > 3 ? '...' : ''})`;
+                }
+                output += '\n';
+            }
+        }
+        else {
+            for (const priv of privileges) {
+                output += `  • ${priv.privilege_name}\n`;
+            }
+        }
+    }
+    if (roles.length > 0) {
+        output += `\nAssigned to Roles (${roles.length}):\n`;
+        output += `  ${roles.map((r) => r.role_name).join(', ')}\n`;
+    }
+    return { content: [{ type: 'text', text: output }] };
+}
+function getRoleInfo(db, name, includeChain) {
+    const symbol = db.prepare(`SELECT name, description, signature, model FROM symbols WHERE name = ? AND type = 'security-role' LIMIT 1`).get(name);
+    if (!symbol) {
+        return {
+            content: [{ type: 'text', text: `Security role not found: ${name}` }],
+            isError: true,
+        };
+    }
+    const duties = db.prepare(`SELECT duty_name FROM security_role_duties WHERE role_name = ? ORDER BY duty_name`).all(name);
+    let output = `SecurityRole: ${symbol.name}\n`;
+    if (symbol.description)
+        output += `Description: ${symbol.description}\n`;
+    output += `Model: ${symbol.model}\n`;
+    if (duties.length > 0) {
+        output += `\nDuties (${duties.length}):\n`;
+        if (includeChain) {
+            // Batched query — fetch all privileges for all duties in one query
+            const dutyNames = duties.map((d) => d.duty_name);
+            const ph = dutyNames.map(() => '?').join(',');
+            const allPrivs = db.prepare(`SELECT duty_name, privilege_name FROM security_duty_privileges
+         WHERE duty_name IN (${ph}) ORDER BY duty_name, privilege_name`).all(...dutyNames);
+            const privsByDuty = new Map();
+            for (const p of allPrivs) {
+                if (!privsByDuty.has(p.duty_name))
+                    privsByDuty.set(p.duty_name, []);
+                privsByDuty.get(p.duty_name).push(p.privilege_name);
+            }
+            for (const duty of duties) {
+                const privs = privsByDuty.get(duty.duty_name) || [];
+                output += `  • ${duty.duty_name}`;
+                if (privs.length > 0) {
+                    output += ` → ${privs.length} privilege(s): ${privs.slice(0, 3).join(', ')}${privs.length > 3 ? '...' : ''}`;
+                }
+                output += '\n';
+            }
+            // Count total entry points across all duties' privileges
+            const allPrivNames = [...new Set(allPrivs.map(p => p.privilege_name))];
+            if (allPrivNames.length > 0) {
+                const ph2 = allPrivNames.map(() => '?').join(',');
+                const epCount = db.prepare(`SELECT COUNT(*) as cnt FROM security_privilege_entries
+           WHERE privilege_name IN (${ph2})`).get(...allPrivNames)?.cnt ?? 0;
+                output += `\nTotal entry points covered: ${epCount}\n`;
+            }
+        }
+        else {
+            for (const duty of duties) {
+                output += `  • ${duty.duty_name}\n`;
+            }
+        }
+    }
+    else {
+        output += `\nDuties: none indexed\n`;
+    }
+    return { content: [{ type: 'text', text: output }] };
+}
+//# sourceMappingURL=securityArtifactInfo.js.map

package/dist/tools/securityArtifactInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityArtifactInfo.js","sourceRoot":"","sources":["../../src/tools/securityArtifactInfo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC1E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACzF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC;CAC7H,CAAC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,GAAG;IAClB,SAAS,EAAE,oBAAoB;IAC/B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;CACb,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwB,EACxB,OAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE5E,6EAA6E;QAC7E,8EAA8E;QAC9E,wDAAwD;QACxD,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,mBAAmB,CACxB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAC7E,IAAI,IAAI,CAAC,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC,CAAC,oDAAoD,CAAC,CAAC;QAEhE,0CAA0C;QAC1C,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CACnE,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,yBAAyB;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAE5C,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YACtC,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxC,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBAC1G;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAO,EAAE,IAAY,EAAE,aAAsB;IACrE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,2HAA2H,CAC5H,CAAC,GAAG,CAAC,IAAI,CAAQ,CAAC;IAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,IAAI,6EAA6E,EAAE,CAAC;YACrJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,uIAAuI,CACxI,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;IAErB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,qGAAqG,CACtG,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;IAErB,IAAI,MAAM,GAAG,sBAAsB,MAAM,CAAC,IAAI,IAAI,CAAC;IACnD,IAAI,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,UAAU,MAAM,CAAC,WAAW,IAAI,CAAC;IACnE,MAAM,IAAI,UAAU,MAAM,CAAC,KAAK,IAAI,CAAC;IAErC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,WAAW,CAAC,MAAM,MAAM,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,EAAE,CAAC,gBAAgB,KAAK,EAAE,CAAC,WAAW,QAAQ,EAAE,CAAC,YAAY,WAAW,CAAC;QAC5F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,gCAAgC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,qBAAqB,MAAM,CAAC,MAAM,MAAM,CAAC;QACnD,MAAM,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,EAAO,EAAE,IAAY,EAAE,YAAqB;IAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,2GAA2G,CAC5G,CAAC,GAAG,CAAC,IAAI,CAAQ,CAAC;IAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,IAAI,EAAE,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,iGAAiG,CAClG,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;IAErB,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CACtB,4FAA4F,CAC7F,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;IAErB,IAAI,MAAM,GAAG,iBAAiB,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,UAAU,MAAM,CAAC,WAAW,IAAI,CAAC;IACnE,MAAM,IAAI,UAAU,MAAM,CAAC,KAAK,IAAI,CAAC;IAErC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,UAAU,CAAC,MAAM,MAAM,CAAC;QAEnD,IAAI,YAAY,EAAE,CAAC;YACjB,yEAAyE;YACzE,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YAC/D,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;oEAC4D,EAAE;mDACnB,CAC5C,CAAC,GAAG,CAAC,GAAG,SAAS,CAAU,CAAC;YAE7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiB,CAAC;YAC3C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAC5E,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACrD,MAAM,IAAI,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,GAAG,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBACxK,CAAC;gBACD,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,MAAM,IAAI,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,wBAAwB,KAAK,CAAC,MAAM,MAAM,CAAC;QACrD,MAAM,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,EAAO,EAAE,IAAY,EAAE,YAAqB;IAC/D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,2GAA2G,CAC5G,CAAC,GAAG,CAAC,IAAI,CAAQ,CAAC;IAEnB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,IAAI,EAAE,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,mFAAmF,CACpF,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;IAErB,IAAI,MAAM,GAAG,iBAAiB,MAAM,CAAC,IAAI,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,gBAAgB,MAAM,CAAC,WAAW,IAAI,CAAC;IACzE,MAAM,IAAI,UAAU,MAAM,CAAC,KAAK,IAAI,CAAC;IAErC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,MAAM,CAAC,MAAM,MAAM,CAAC;QAE3C,IAAI,YAAY,EAAE,CAAC;YACjB,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CACzB;+BACuB,EAAE,sCAAsC,CAChE,CAAC,GAAG,CAAC,GAAG,SAAS,CAAU,CAAC;YAE7B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACpE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpD,MAAM,IAAI,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,MAAM,KAAK,CAAC,MAAM,kBAAkB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/G,CAAC;gBACD,MAAM,IAAI,IAAI,CAAC;YACjB,CAAC;YAED,yDAAyD;YACzD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAI,EAAE,CAAC,OAAO,CACzB;sCAC4B,GAAG,GAAG,CACnC,CAAC,GAAG,CAAC,GAAG,YAAY,CAAS,EAAE,GAAG,IAAI,CAAC,CAAC;gBACzC,MAAM,IAAI,iCAAiC,OAAO,IAAI,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,0BAA0B,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/tools/securityCoverageInfo.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Security Coverage Info Tool
+ * Show what security objects (privileges/duties/roles) cover a given D365FO object
+ * by tracing the reverse chain: object → menu items → privileges → duties → roles
+ */
+import type { CallToolRequest } from '@modelcontextprotocol/sdk/types.js';
+import type { XppServerContext } from '../types/context.js';
+export declare function securityCoverageInfoTool(request: CallToolRequest, context: XppServerContext): Promise<{
+    isError?: undefined;
+    content: {
+        type: string;
+        text: string;
+    }[];
+} | {
+    content: {
+        type: string;
+        text: string;
+    }[];
+    isError: boolean;
+}>;
+//# sourceMappingURL=securityCoverageInfo.d.ts.map

package/dist/tools/securityCoverageInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityCoverageInfo.d.ts","sourceRoot":"","sources":["../../src/tools/securityCoverageInfo.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAwC5D,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB;;;;;;;;;;;;GA0OjG"}

package/dist/tools/securityCoverageInfo.js

@@ -0,0 +1,248 @@
+/**
+ * Security Coverage Info Tool
+ * Show what security objects (privileges/duties/roles) cover a given D365FO object
+ * by tracing the reverse chain: object → menu items → privileges → duties → roles
+ */
+import { z } from 'zod';
+import { canonicalSymbolName } from '../utils/symbolLookup.js';
+const SecurityCoverageInfoArgsSchema = z.object({
+    objectName: z.string().describe('Name of the form, table, class, or menu item to check security coverage for'),
+    objectType: z.enum(['form', 'table', 'class', 'menu-item', 'auto']).optional().default('auto')
+        .describe('Type of the object (auto=detect from symbol index)'),
+});
+const MENU_ITEM_TYPES = ['menu-item-display', 'menu-item-action', 'menu-item-output'];
+/** Symbol types a given objectType arg could resolve to. */
+function candidateTypes(objectType) {
+    if (objectType === 'menu-item')
+        return MENU_ITEM_TYPES;
+    if (objectType === 'auto')
+        return ['form', 'table', 'class', ...MENU_ITEM_TYPES];
+    return [objectType];
+}
+/**
+ * Rendered instead of silence when no OLS policies can be found AND none are
+ * indexed at all — an XDS-constrained table would otherwise look identical to an
+ * unconstrained one, turning a security question into a false negative (#690).
+ */
+const OLS_UNKNOWN = `Row-level security (OLS): ⚠️ unknown — AxSecurityPolicy objects are not indexed in this database.\n` +
+    `  This is NOT the same as "no row-level security": a policy constraining this table would not be visible here.\n` +
+    `  Rebuild the metadata database with a current extractor to index security policies.\n\n`;
+/**
+ * Whether the security_policies table holds any row at all.
+ *
+ * `LIMIT 1` with no WHERE stops at the first row, so this reads a single page
+ * and cannot degrade into the kind of scan #686 documents — it stays O(1)
+ * regardless of how many policies are indexed. Throws when the table is absent;
+ * callers treat that the same as empty.
+ */
+function policiesIndexed(db) {
+    return db.prepare('SELECT 1 FROM security_policies LIMIT 1').get() !== undefined;
+}
+export async function securityCoverageInfoTool(request, context) {
+    try {
+        const args = SecurityCoverageInfoArgsSchema.parse(request.params.arguments);
+        const db = context.symbolIndex.getReadDb();
+        // Resolve the caller's casing to the canonical AOT name once (#686) — every
+        // probe and side-table join below keys off this name.
+        const objName = canonicalSymbolName(db, args.objectName, candidateTypes(args.objectType))
+            ?? args.objectName;
+        let resolvedType = args.objectType;
+        if (resolvedType === 'auto') {
+            const sym = db.prepare(`SELECT type FROM symbols WHERE name = ? AND type IN ('form','table','class','menu-item-display','menu-item-action','menu-item-output')
+         ORDER BY CASE type WHEN 'form' THEN 0 WHEN 'table' THEN 1 WHEN 'class' THEN 2 ELSE 3 END LIMIT 1`).get(objName);
+            if (sym) {
+                resolvedType = sym.type.startsWith('menu-item') ? 'menu-item' : sym.type;
+            }
+        }
+        let output = `Security coverage for: ${objName}`;
+        if (resolvedType !== 'auto')
+            output += ` (${resolvedType})`;
+        output += '\n\n';
+        // AxSecurityPolicy (row-level security / OLS) applies to a primary table; surface any that name this object.
+        let olsSection = '';
+        if (resolvedType === 'table' || resolvedType === 'auto') {
+            try {
+                const policies = db.prepare(`SELECT policy_name, query_name, operation, constrained_table, label
+           FROM security_policies WHERE primary_table = ? ORDER BY policy_name`).all(objName);
+                if (policies.length > 0) {
+                    olsSection += `Row-level security (OLS) — ${policies.length} policy(ies) constrain table ${objName}:\n`;
+                    for (const p of policies) {
+                        olsSection += `  🔒 ${p.policy_name}`;
+                        olsSection += ` [${p.operation || 'AllOperations'}]`;
+                        if (p.query_name)
+                            olsSection += ` via query ${p.query_name}`;
+                        if (p.constrained_table)
+                            olsSection += ` (constrained)`;
+                        olsSection += '\n';
+                    }
+                    olsSection += '\n';
+                }
+                else if (!policiesIndexed(db)) {
+                    olsSection += OLS_UNKNOWN;
+                }
+            }
+            catch (e) {
+                // security_policies missing entirely (databases built before the
+                // extractor landed) — same unknown as an empty table, not "none".
+                if (process.env.DEBUG_LOGGING === 'true')
+                    console.warn('[securityCoverageInfo] security_policies query failed:', e);
+                olsSection += OLS_UNKNOWN;
+            }
+        }
+        // Find menu items targeting this object
+        let menuItems = [];
+        try {
+            menuItems = db.prepare(`SELECT menu_item_name, menu_item_type, target_object, target_type FROM menu_item_targets
+         WHERE target_object = ?
+         ORDER BY menu_item_type, menu_item_name`).all(objName);
+        }
+        catch (e) {
+            // menu_item_targets table may not exist in older databases — non-fatal
+            if (process.env.DEBUG_LOGGING === 'true')
+                console.warn('[securityCoverageInfo] menu_item_targets query failed:', e);
+        }
+        // Fallback: if the object IS a menu item, use it directly
+        if (menuItems.length === 0 && (resolvedType === 'menu-item' || resolvedType === 'auto')) {
+            const directMenuItem = db.prepare(`SELECT name as menu_item_name, type as menu_item_type FROM symbols
+         WHERE name = ? AND type IN ('menu-item-display','menu-item-action','menu-item-output') LIMIT 1`).get(objName);
+            if (directMenuItem) {
+                menuItems = [{ ...directMenuItem, target_object: objName, target_type: resolvedType }];
+            }
+        }
+        // Also search by name match (a form named CustTable might have a menu item also named CustTable)
+        if (menuItems.length === 0) {
+            const sameNameMenuItems = db.prepare(`SELECT name as menu_item_name, type as menu_item_type FROM symbols
+         WHERE name = ? AND type IN ('menu-item-display','menu-item-action','menu-item-output')`).all(objName);
+            menuItems.push(...sameNameMenuItems);
+        }
+        if (menuItems.length === 0) {
+            if (olsSection)
+                output += olsSection;
+            output += `No menu items found targeting: ${objName}\n`;
+            output += `This object may not be directly exposed via a menu item, or menu item indexing has not been run.\n`;
+            output += `\nTip: Security coverage requires both menu item indexing (Phase 1D) and security privilege indexing.\n`;
+            return { content: [{ type: 'text', text: output }] };
+        }
+        if (olsSection)
+            output += olsSection;
+        output += `Exposed via ${menuItems.length} menu item(s):\n\n`;
+        const allPrivileges = new Set();
+        const allDuties = new Set();
+        const allRoles = new Set();
+        // Batch-fetch entire privilege→duty→role chain in 3 queries (avoids per-privilege/per-duty round-trips).
+        // All privileges for all menu items at once
+        const miNames = menuItems.map(mi => mi.menu_item_name);
+        const miPH = miNames.map(() => '?').join(',');
+        const allPrivEntries = db.prepare(`SELECT DISTINCT entry_point_name, privilege_name, object_type, access_level
+       FROM security_privilege_entries
+       WHERE entry_point_name IN (${miPH})
+       ORDER BY entry_point_name, privilege_name`).all(...miNames);
+        const privilegesByMi = new Map();
+        for (const pe of allPrivEntries) {
+            if (!privilegesByMi.has(pe.entry_point_name))
+                privilegesByMi.set(pe.entry_point_name, []);
+            privilegesByMi.get(pe.entry_point_name).push(pe);
+        }
+        // All duties for all privilege names at once
+        const allPrivNames = [...new Set(allPrivEntries.map(pe => pe.privilege_name))];
+        const dutiesByPrivilege = new Map();
+        const dutiesCounts = new Map();
+        const rolesByDuty = new Map();
+        const rolesCounts = new Map();
+        if (allPrivNames.length > 0) {
+            const privPH = allPrivNames.map(() => '?').join(',');
+            const allDutyRows = db.prepare(`SELECT privilege_name, duty_name FROM security_duty_privileges
+         WHERE privilege_name IN (${privPH})
+         ORDER BY duty_name`).all(...allPrivNames);
+            for (const d of allDutyRows) {
+                if (!dutiesByPrivilege.has(d.privilege_name))
+                    dutiesByPrivilege.set(d.privilege_name, []);
+                dutiesByPrivilege.get(d.privilege_name).push(d.duty_name);
+            }
+            for (const [k, v] of dutiesByPrivilege) {
+                dutiesCounts.set(k, v.length);
+                dutiesByPrivilege.set(k, v.slice(0, 5));
+            }
+            // All roles for all duty names at once
+            const allDutyNames = [...new Set(allDutyRows.map(d => d.duty_name))];
+            if (allDutyNames.length > 0) {
+                const dutyPH = allDutyNames.map(() => '?').join(',');
+                const allRoleRows = db.prepare(`SELECT duty_name, role_name FROM security_role_duties
+           WHERE duty_name IN (${dutyPH})
+           ORDER BY role_name`).all(...allDutyNames);
+                for (const r of allRoleRows) {
+                    if (!rolesByDuty.has(r.duty_name))
+                        rolesByDuty.set(r.duty_name, []);
+                    rolesByDuty.get(r.duty_name).push(r.role_name);
+                }
+                for (const [k, v] of rolesByDuty) {
+                    rolesCounts.set(k, v.length);
+                    rolesByDuty.set(k, v.slice(0, 3));
+                }
+            }
+        }
+        // Build output from pre-fetched data — no DB queries inside these loops
+        for (const mi of menuItems) {
+            const typeLabel = mi.menu_item_type === 'menu-item-display' ? 'MenuItemDisplay'
+                : mi.menu_item_type === 'menu-item-action' ? 'MenuItemAction'
+                    : mi.menu_item_type === 'MenuItemAction' ? 'MenuItemAction'
+                        : mi.menu_item_type === 'MenuItemDisplay' ? 'MenuItemDisplay'
+                            : mi.menu_item_type || 'MenuItem';
+            output += `  ${mi.menu_item_name} (${typeLabel}):\n`;
+            const privileges = privilegesByMi.get(mi.menu_item_name) || [];
+            if (privileges.length === 0) {
+                output += `    No privileges found granting this menu item\n`;
+            }
+            else {
+                output += `    Privileges (${privileges.length}):\n`;
+                for (const priv of privileges) {
+                    allPrivileges.add(priv.privilege_name);
+                    output += `      ${priv.privilege_name} [${priv.access_level}]`;
+                    const duties = dutiesByPrivilege.get(priv.privilege_name) || [];
+                    const totalDuties = dutiesCounts.get(priv.privilege_name) ?? 0;
+                    if (duties.length > 0) {
+                        output += ` → Duty: ${duties.join(', ')}`;
+                        if (totalDuties > 5)
+                            output += ` (+${totalDuties - 5} more)`;
+                        for (const dutyName of duties) {
+                            allDuties.add(dutyName);
+                            const roleNames = rolesByDuty.get(dutyName) || [];
+                            const totalRoles = rolesCounts.get(dutyName) ?? 0;
+                            for (const roleName of roleNames)
+                                allRoles.add(roleName);
+                            if (roleNames.length > 0) {
+                                output += ` → Role: ${roleNames.join(', ')}`;
+                                if (totalRoles > 3)
+                                    output += ` (+${totalRoles - 3} more)`;
+                            }
+                        }
+                    }
+                    output += '\n';
+                }
+            }
+            output += '\n';
+        }
+        // Summary
+        output += `Summary:\n`;
+        output += `  Total privileges with any access: ${allPrivileges.size}\n`;
+        output += `  Total duties: ${allDuties.size}\n`;
+        output += `  Total roles with any access: ${allRoles.size}\n`;
+        if (allRoles.size > 0) {
+            const roleList = [...allRoles].slice(0, 5).join(', ');
+            output += `  Roles: ${roleList}${allRoles.size > 5 ? ` (+${allRoles.size - 5} more)` : ''}\n`;
+        }
+        return { content: [{ type: 'text', text: output }] };
+    }
+    catch (error) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Error getting security coverage: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                },
+            ],
+            isError: true,
+        };
+    }
+}
+//# sourceMappingURL=securityCoverageInfo.js.map

package/dist/tools/securityCoverageInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityCoverageInfo.js","sourceRoot":"","sources":["../../src/tools/securityCoverageInfo.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6EAA6E,CAAC;IAC9G,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SAC3F,QAAQ,CAAC,oDAAoD,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;AAEtF,4DAA4D;AAC5D,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,eAAe,CAAC;IACvD,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;IACjF,OAAO,CAAC,UAAU,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GACf,qGAAqG;IACrG,kHAAkH;IAClH,0FAA0F,CAAC;AAE7F;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,EAA+D;IACtF,OAAO,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAE,KAAK,SAAS,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAwB,EAAE,OAAyB;IAChG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QAC3C,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;eACpF,IAAI,CAAC,UAAU,CAAC;QAErB,IAAI,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB;0GACkG,CACnG,CAAC,GAAG,CAAC,OAAO,CAAQ,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAW,CAAC;YAClF,CAAC;QACH,CAAC;QAED,IAAI,MAAM,GAAG,0BAA0B,OAAO,EAAE,CAAC;QACjD,IAAI,YAAY,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,YAAY,GAAG,CAAC;QAC5D,MAAM,IAAI,MAAM,CAAC;QAEjB,6GAA6G;QAC7G,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CACzB;+EACqE,CACtE,CAAC,GAAG,CAAC,OAAO,CAAU,CAAC;gBACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,UAAU,IAAI,8BAA8B,QAAQ,CAAC,MAAM,gCAAgC,OAAO,KAAK,CAAC;oBACxG,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACzB,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;wBACtC,UAAU,IAAI,KAAK,CAAC,CAAC,SAAS,IAAI,eAAe,GAAG,CAAC;wBACrD,IAAI,CAAC,CAAC,UAAU;4BAAE,UAAU,IAAI,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC;wBAC7D,IAAI,CAAC,CAAC,iBAAiB;4BAAE,UAAU,IAAI,gBAAgB,CAAC;wBACxD,UAAU,IAAI,IAAI,CAAC;oBACrB,CAAC;oBACD,UAAU,IAAI,IAAI,CAAC;gBACrB,CAAC;qBAAM,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;oBAChC,UAAU,IAAI,WAAW,CAAC;gBAC5B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,iEAAiE;gBACjE,kEAAkE;gBAClE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC,CAAC;gBACpH,UAAU,IAAI,WAAW,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,SAAS,GAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,OAAO,CACpB;;iDAEyC,CAC1C,CAAC,GAAG,CAAC,OAAO,CAAU,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uEAAuE;YACvE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC,CAAC;QACtH,CAAC;QAED,0DAA0D;QAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,WAAW,IAAI,YAAY,KAAK,MAAM,CAAC,EAAE,CAAC;YACxF,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC/B;wGACgG,CACjG,CAAC,GAAG,CAAC,OAAO,CAAQ,CAAC;YACtB,IAAI,cAAc,EAAE,CAAC;gBACnB,SAAS,GAAG,CAAC,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QAED,iGAAiG;QACjG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAC,OAAO,CAClC;gGACwF,CACzF,CAAC,GAAG,CAAC,OAAO,CAAU,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,UAAU;gBAAE,MAAM,IAAI,UAAU,CAAC;YACrC,MAAM,IAAI,kCAAkC,OAAO,IAAI,CAAC;YACxD,MAAM,IAAI,oGAAoG,CAAC;YAC/G,MAAM,IAAI,yGAAyG,CAAC;YACpH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC;QAErC,MAAM,IAAI,eAAe,SAAS,CAAC,MAAM,oBAAoB,CAAC;QAE9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAEnC,yGAAyG;QAEzG,4CAA4C;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC/B;;oCAE8B,IAAI;iDACS,CAC5C,CAAC,GAAG,CAAC,GAAG,OAAO,CAAU,CAAC;QAE3B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAiB,CAAC;QAChD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC;gBAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC1F,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,6CAA6C;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;QAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE9C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;oCAC4B,MAAM;4BACd,CACrB,CAAC,GAAG,CAAC,GAAG,YAAY,CAAU,CAAC;YAEhC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;oBAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAC1F,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;gBACvC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC9B,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;YAED,uCAAuC;YACvC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B;iCACuB,MAAM;8BACT,CACrB,CAAC,GAAG,CAAC,GAAG,YAAY,CAAU,CAAC;gBAEhC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;wBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACpE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClD,CAAC;gBACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;oBACjC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;oBAC7B,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,EAAE,CAAC,cAAc,KAAK,mBAAmB,CAAC,CAAC,CAAC,iBAAiB;gBAC7E,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,kBAAkB,CAAC,CAAC,CAAC,gBAAgB;oBAC7D,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;wBAC3D,CAAC,CAAC,EAAE,CAAC,cAAc,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;4BAC7D,CAAC,CAAC,EAAE,CAAC,cAAc,IAAI,UAAU,CAAC;YAEpC,MAAM,IAAI,KAAK,EAAE,CAAC,cAAc,KAAK,SAAS,MAAM,CAAC;YAErD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAE/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,mDAAmD,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,mBAAmB,UAAU,CAAC,MAAM,MAAM,CAAC;gBAErD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACvC,MAAM,IAAI,SAAS,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,YAAY,GAAG,CAAC;oBAEhE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBAChE,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;oBAE/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,MAAM,IAAI,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,WAAW,GAAG,CAAC;4BAAE,MAAM,IAAI,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC;wBAE7D,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;4BAC9B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BACxB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;4BAClD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;4BAClD,KAAK,MAAM,QAAQ,IAAI,SAAS;gCAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BACzD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCACzB,MAAM,IAAI,YAAY,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC7C,IAAI,UAAU,GAAG,CAAC;oCAAE,MAAM,IAAI,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC;4BAC7D,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,MAAM,IAAI,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QAED,UAAU;QACV,MAAM,IAAI,YAAY,CAAC;QACvB,MAAM,IAAI,uCAAuC,aAAa,CAAC,IAAI,IAAI,CAAC;QACxE,MAAM,IAAI,mBAAmB,SAAS,CAAC,IAAI,IAAI,CAAC;QAChD,MAAM,IAAI,kCAAkC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAE9D,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,IAAI,YAAY,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAChG,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACrG;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tools/securityInfo.d.ts

@@ -0,0 +1,22 @@
+/**
+ * security_info Tool — unified security-lookup entry point.
+ *
+ * Replaces two security tools with one discriminated by `mode`:
+ *   • artifact → details + full hierarchy of a privilege/duty/role
+ *                (Role → Duties → Privileges → Entry Points)
+ *   • coverage → reverse chain: which roles/duties/privileges cover an object
+ *
+ * Handler files stay where they are — only the MCP surface is consolidated.
+ */
+import type { CallToolRequest } from '@modelcontextprotocol/sdk/types.js';
+import type { XppServerContext } from '../types/context.js';
+export declare const SECURITY_MODES: readonly ['artifact', 'coverage'];
+export type SecurityMode = (typeof SECURITY_MODES)[number];
+export declare function securityInfoTool(request: CallToolRequest, context: XppServerContext): Promise<{
+    content: {
+        type: string;
+        text: string;
+    }[];
+    isError?: boolean;
+}>;
+//# sourceMappingURL=securityInfo.d.ts.map

package/dist/tools/securityInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityInfo.d.ts","sourceRoot":"","sources":["../../src/tools/securityInfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAI5D,eAAO,MAAM,cAAc,YAAI,UAAU,EAAE,UAAU,CAAU,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAU3D,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB;;;;;;GAoBzF"}

package/dist/tools/securityInfo.js

@@ -0,0 +1,43 @@
+/**
+ * security_info Tool — unified security-lookup entry point.
+ *
+ * Replaces two security tools with one discriminated by `mode`:
+ *   • artifact → details + full hierarchy of a privilege/duty/role
+ *                (Role → Duties → Privileges → Entry Points)
+ *   • coverage → reverse chain: which roles/duties/privileges cover an object
+ *
+ * Handler files stay where they are — only the MCP surface is consolidated.
+ */
+import { securityArtifactInfoTool } from './securityArtifactInfo.js';
+import { securityCoverageInfoTool } from './securityCoverageInfo.js';
+export const SECURITY_MODES = ['artifact', 'coverage'];
+function subRequest(name, args) {
+    return { method: 'tools/call', params: { name, arguments: args } };
+}
+function err(text) {
+    return { content: [{ type: 'text', text }], isError: true };
+}
+export async function securityInfoTool(request, context) {
+    const a = (request.params.arguments ?? {});
+    const mode = a.mode;
+    const { mode: _mode, ...rest } = a;
+    switch (mode) {
+        case 'artifact':
+            // Validate per-mode required params here so the agent gets a guided
+            // message instead of the underlying handler's raw ZodError.
+            if (!a.name)
+                return err('security_info(mode="artifact") requires `name` (the privilege/duty/role name).');
+            if (!a.artifactType)
+                return err('security_info(mode="artifact") requires `artifactType` (privilege, duty, or role).');
+            return securityArtifactInfoTool(subRequest('get_security_artifact_info', rest), context);
+        case 'coverage':
+            if (!a.objectName)
+                return err('security_info(mode="coverage") requires `objectName` (the form/table/class/menu-item name).');
+            return securityCoverageInfoTool(subRequest('get_security_coverage_for_object', rest), context);
+        default:
+            return err(`security_info: unknown mode "${mode ?? '(missing)'}". Use one of: ${SECURITY_MODES.join(', ')}.`);
+    }
+}
+// Tool registration (name, description, inputSchema) lives inline in
+// src/server/mcpServer.ts — the single source of truth for tool instructions.
+//# sourceMappingURL=securityInfo.js.map

package/dist/tools/securityInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityInfo.js","sourceRoot":"","sources":["../../src/tools/securityInfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAGhE,SAAS,UAAU,CAAC,IAAY,EAAE,IAA6B;IAC7D,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAwB,EAAE,OAAyB;IACxF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAwB,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,CAAC,IAA0B,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,oEAAoE;YACpE,4DAA4D;YAC5D,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;YAC1G,IAAI,CAAC,CAAC,CAAC,YAAY;gBAAE,OAAO,GAAG,CAAC,oFAAoF,CAAC,CAAC;YACtH,OAAO,wBAAwB,CAAC,UAAU,CAAC,4BAA4B,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAE3F,KAAK,UAAU;YACb,IAAI,CAAC,CAAC,CAAC,UAAU;gBAAE,OAAO,GAAG,CAAC,6FAA6F,CAAC,CAAC;YAC7H,OAAO,wBAAwB,CAAC,UAAU,CAAC,kCAAkC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAEjG;YACE,OAAO,GAAG,CAAC,gCAAgC,IAAI,IAAI,WAAW,kBAAkB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClH,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,8EAA8E"}

package/dist/tools/securityPolicyInfo.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Get Security Policy Info Tool
+ * Reads an AxSecurityPolicy (row-level / OLS) from the SQLite index: the primary
+ * (constrained) table, the policy query, the operation it covers, and whether
+ * the primary table itself is constrained. Azure-safe READ tool.
+ */
+import type { CallToolRequest } from '@modelcontextprotocol/sdk/types.js';
+import type { XppServerContext } from '../types/context.js';
+export declare function getSecurityPolicyInfoTool(request: CallToolRequest, context: XppServerContext): Promise<{
+    content: {
+        type: string;
+        text: string;
+    }[];
+    isError: boolean;
+} | {
+    isError?: undefined;
+    content: {
+        type: string;
+        text: string;
+    }[];
+}>;
+//# sourceMappingURL=securityPolicyInfo.d.ts.map

package/dist/tools/securityPolicyInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityPolicyInfo.d.ts","sourceRoot":"","sources":["../../src/tools/securityPolicyInfo.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM5D,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB;;;;;;;;;;;;GA8ClG"}