nowaikit 4.1.6 → 4.4.0

package/dist/tools-manifest.json

@@ -347,7 +347,7 @@
   },
   {
     "name": "natural_language_search",
-    "description": "Search ServiceNow using plain English (experimental)",
+    "description": "Search ServiceNow using plain English",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -367,7 +367,7 @@
   },
   {
     "name": "natural_language_update",
-    "description": "Update a record using natural language (experimental, requires WRITE_ENABLED=true)",
+    "description": "Update a record using natural language (requires WRITE_ENABLED=true)",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -1914,22 +1914,28 @@
   },
   {
     "name": "get_performance_analytics",
-    "description": "Get Performance Analytics widget data (requires PA plugin; latest release: /api/now/pa/widget/{sys_id})",
+    "description": "Read Performance Analytics scorecard/indicator data (requires PA plugin; GET /api/now/pa/scorecards). Pass an indicator sys_id, or a PA widget sys_id to resolve its indicator.",
     "inputSchema": {
       "type": "object",
       "properties": {
+        "indicator_sys_id": {
+          "type": "string",
+          "description": "sys_id of the PA indicator (pa_indicators)"
+        },
         "widget_sys_id": {
           "type": "string",
-          "description": "sys_id of the PA widget"
+          "description": "sys_id of a PA widget (pa_widgets); its indicator is resolved automatically"
+        },
+        "from": {
+          "type": "string",
+          "description": "Optional score-series start date (YYYY-MM-DD)"
         },
-        "time_range": {
+        "to": {
           "type": "string",
-          "description": "Time range (e.g., \"last_30_days\", \"last_quarter\")"
+          "description": "Optional score-series end date (YYYY-MM-DD)"
         }
       },
-      "required": [
-        "widget_sys_id"
-      ]
+      "required": []
     }
   },
   {
@@ -2523,46 +2529,9 @@
       ]
     }
   },
-  {
-    "name": "generate_summary",
-    "description": "Generate an AI summary of any record using Now Assist (latest release: sn_assist/skill/summarize)",
-    "inputSchema": {
-      "type": "object",
-      "properties": {
-        "table": {
-          "type": "string",
-          "description": "Table name (e.g., \"incident\", \"change_request\")"
-        },
-        "sys_id": {
-          "type": "string",
-          "description": "System ID of the record"
-        }
-      },
-      "required": [
-        "table",
-        "sys_id"
-      ]
-    }
-  },
-  {
-    "name": "suggest_resolution",
-    "description": "Get AI-powered resolution suggestion for an incident based on similar past incidents",
-    "inputSchema": {
-      "type": "object",
-      "properties": {
-        "incident_sys_id": {
-          "type": "string",
-          "description": "System ID of the incident"
-        }
-      },
-      "required": [
-        "incident_sys_id"
-      ]
-    }
-  },
   {
     "name": "categorize_incident",
-    "description": "Use Predictive Intelligence to predict category, assignment group, and priority (latest release: LightGBM algorithm)",
+    "description": "Suggest category, assignment group, and priority for an incident by analysing similar resolved incidents (Table API). Predictive Intelligence has no public REST prediction endpoint; for model-based scoring run PI on-record and read the predicted field.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -2572,7 +2541,7 @@
         },
         "description": {
           "type": "string",
-          "description": "Optional full description for better accuracy"
+          "description": "Optional full description (not required for the heuristic)"
         }
       },
       "required": [
@@ -2582,7 +2551,7 @@
   },
   {
     "name": "get_virtual_agent_topics",
-    "description": "List Virtual Agent topics available in the instance (latest release: streaming VA API)",
+    "description": "List Virtual Agent topics available in the instance (sys_cs_topic)",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -2602,29 +2571,9 @@
       "required": []
     }
   },
-  {
-    "name": "trigger_agentic_playbook",
-    "description": "Invoke an Agentic Playbook — context-aware AI agents that complete tasks autonomously ",
-    "inputSchema": {
-      "type": "object",
-      "properties": {
-        "playbook_sys_id": {
-          "type": "string",
-          "description": "System ID of the Agentic Playbook"
-        },
-        "context": {
-          "type": "object",
-          "description": "Context key-value pairs to pass to the playbook"
-        }
-      },
-      "required": [
-        "playbook_sys_id"
-      ]
-    }
-  },
   {
     "name": "get_ms_copilot_topics",
-    "description": "List VA topics exposed to Microsoft Copilot 365 via Custom Engine Agent integration ",
+    "description": "List the Virtual Agent topics (sys_cs_topic) that back a Microsoft Copilot integration. Copilot topic mapping itself is configured in Copilot Studio on the Microsoft side, not exposed via ServiceNow REST.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -2636,31 +2585,6 @@
       "required": []
     }
   },
-  {
-    "name": "generate_work_notes",
-    "description": "Generate AI-drafted work notes for a record based on its current context",
-    "inputSchema": {
-      "type": "object",
-      "properties": {
-        "table": {
-          "type": "string",
-          "description": "Table name"
-        },
-        "sys_id": {
-          "type": "string",
-          "description": "System ID of the record"
-        },
-        "context": {
-          "type": "string",
-          "description": "Additional context to include in the draft"
-        }
-      },
-      "required": [
-        "table",
-        "sys_id"
-      ]
-    }
-  },
   {
     "name": "get_pi_models",
     "description": "List available Predictive Intelligence solutions (classification/similarity models)",
@@ -9390,5 +9314,190 @@
         "table"
       ]
     }
+  },
+  {
+    "name": "blast_radius_table_configs",
+    "description": "Blast radius: list every configuration artifact scoped to a table (business rules, client scripts, UI policies, ACLs, UI actions, data policies, dictionary fields). Run before altering or removing a table.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Table name, e.g. \"incident\""
+        },
+        "limit": {
+          "type": "number",
+          "description": "Max records per artifact type (default 50)"
+        }
+      },
+      "required": [
+        "table"
+      ]
+    }
+  },
+  {
+    "name": "blast_radius_field_references",
+    "description": "Blast radius: find where a table field is referenced — its dictionary entry plus any scripts (business rules, script includes, client scripts, UI actions, widgets) that mention the field name. Run before renaming or removing a field.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Table name, e.g. \"incident\""
+        },
+        "field": {
+          "type": "string",
+          "description": "Field (column) name, e.g. \"u_custom_field\""
+        },
+        "limit": {
+          "type": "number",
+          "description": "Max matches per source (default 50)"
+        }
+      },
+      "required": [
+        "table",
+        "field"
+      ]
+    }
+  },
+  {
+    "name": "blast_radius_script_dependents",
+    "description": "Blast radius: find what references a script include / artifact by name — scans script-bearing config tables for textual use of the name. Run before renaming or deleting a Script Include, Script Action, etc.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Artifact name to search for, e.g. a Script Include class name"
+        },
+        "limit": {
+          "type": "number",
+          "description": "Max matches per source (default 50)"
+        }
+      },
+      "required": [
+        "name"
+      ]
+    }
+  },
+  {
+    "name": "blast_radius_update_sets",
+    "description": "Blast radius: list the update sets that contain changes to an artifact (by name), so you know what is in-flight or already captured for promotion before you touch it.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Artifact name (or partial) to match against captured updates"
+        },
+        "limit": {
+          "type": "number",
+          "description": "Max update records to scan (default 100)"
+        }
+      },
+      "required": [
+        "name"
+      ]
+    }
+  },
+  {
+    "name": "blast_radius_property_usage",
+    "description": "Blast radius: find scripts that read a system property (sys_properties) by name, plus the property record itself. Run before changing or removing a property.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "System property name, e.g. \"glide.ui.incident_reassignment_action\""
+        },
+        "limit": {
+          "type": "number",
+          "description": "Max matches per source (default 50)"
+        }
+      },
+      "required": [
+        "name"
+      ]
+    }
+  },
+  {
+    "name": "list_supported_artifacts",
+    "description": "Local sync: list the artifact types (tables) that support pull/push to local files and which fields sync for each.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {},
+      "required": []
+    }
+  },
+  {
+    "name": "pull_artifact",
+    "description": "Local sync: fetch an artifact's editable fields (e.g. a Service Portal widget's template/css/script). Returns the content inline; when NOWAIKIT_SYNC_DIR is set it also writes one file per field and returns the paths.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Artifact table, e.g. \"sp_widget\", \"sys_script_include\""
+        },
+        "sys_id": {
+          "type": "string",
+          "description": "sys_id of the record"
+        }
+      },
+      "required": [
+        "table",
+        "sys_id"
+      ]
+    }
+  },
+  {
+    "name": "push_artifact",
+    "description": "Local sync: write edited fields back to an artifact (requires WRITE_ENABLED=true). Pass fields inline as {field:value}; if omitted and NOWAIKIT_SYNC_DIR is set, reads them from the pulled files on disk.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Artifact table"
+        },
+        "sys_id": {
+          "type": "string",
+          "description": "sys_id of the record"
+        },
+        "fields": {
+          "type": "object",
+          "description": "Optional map of {field: newValue} to update; defaults to the on-disk files under NOWAIKIT_SYNC_DIR"
+        }
+      },
+      "required": [
+        "table",
+        "sys_id"
+      ]
+    }
+  },
+  {
+    "name": "sync_status",
+    "description": "Local sync: compare an artifact's current instance content against your local/edited content field-by-field and report which fields changed.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Artifact table"
+        },
+        "sys_id": {
+          "type": "string",
+          "description": "sys_id of the record"
+        },
+        "fields": {
+          "type": "object",
+          "description": "Optional {field: localValue} to compare; defaults to files under NOWAIKIT_SYNC_DIR"
+        }
+      },
+      "required": [
+        "table",
+        "sys_id"
+      ]
+    }
   }
 ]

package/dist/transport/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAIxE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAErD,wBAAgB,gBAAgB,IAAI,aAAa,CAIhD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAqBpC;AAyFD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAIxE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG7E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAErD,wBAAgB,gBAAgB,IAAI,aAAa,CAIhD;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAqBpC;AAuGD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/transport/index.js

@@ -2,6 +2,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { logger } from '../utils/logging.js';
 import { VERSION, SERVER_NAME } from '../utils/version.js';
 import { createHttpServer } from './http-server.js';
+import { isDelegatedAuthEnabled, parseDelegatedAuthHeaders, runWithDelegatedAuth } from '../utils/request-context.js';
 export function getTransportType() {
     const transport = (process.env.TRANSPORT || 'stdio').toLowerCase();
     if (transport === 'sse' || transport === 'http')
@@ -57,7 +58,9 @@ async function setupSseTransport(server, httpServer) {
             return;
         }
         const transport = sessions.get(sessionId);
-        await transport.handlePostMessage(req, res);
+        // Pass the already-parsed body (the HTTP server drained the stream) — same
+        // reason as the streamable-HTTP path below.
+        await transport.handlePostMessage(req, res, req.body);
     }, true);
     // Health endpoint (no auth required)
     addHealthRoute(httpServer);
@@ -74,7 +77,20 @@ async function setupStreamableHttpTransport(server, httpServer) {
     });
     // Mount transport on /mcp
     httpServer.post('/mcp', async (req, res) => {
-        await transport.handleRequest(req, res);
+        // DELEGATED_AUTH: bind the per-user identity/policy from headers for this
+        // request's lifetime (used by the ServiceNow client + permission checks).
+        // The HTTP server already drains + parses the POST body into req.body, so the
+        // stream is consumed by the time we get here. Pass that parsed body through to
+        // the MCP transport (3rd arg) — otherwise it re-reads an empty stream and the
+        // request fails with a JSON-RPC parse error (-32700).
+        const parsedBody = req.body;
+        if (isDelegatedAuthEnabled()) {
+            const ctx = parseDelegatedAuthHeaders(req.headers);
+            await runWithDelegatedAuth(ctx, () => transport.handleRequest(req, res, parsedBody));
+        }
+        else {
+            await transport.handleRequest(req, res, parsedBody);
+        }
     }, true);
     httpServer.get('/mcp', async (req, res) => {
         await transport.handleRequest(req, res);

package/dist/transport/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAA2B,MAAM,kBAAkB,CAAC;AAI7E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,SAAiB;IAEjB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IAEtC,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,KAAK,SAAS,SAAS,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAA8B;IAC7E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE5E,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QAC3C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,qCAAqC;IACrC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,4BAA4B,CAAC,MAAc,EAAE,UAA8B;IACxF,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;IAC7G,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;KACvC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,iDAAiD;AACjD,SAAS,cAAc,CAAC,UAA8B;IACpD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,gBAAgB,EAAE;YAC7B,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAA2B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAItH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,SAAiB;IAEjB,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,qCAAqC,SAAS,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IAEtC,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,8BAA8B,aAAa,KAAK,SAAS,SAAS,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAA8B;IAC7E,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmD,CAAC;IAE5E,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QAC3C,2EAA2E;QAC3E,4CAA4C;QAC5C,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAG,GAA0B,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,qCAAqC;IACrC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,4BAA4B,CAAC,MAAc,EAAE,UAA8B;IACxF,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;IAC7G,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;KACvC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,+EAA+E;QAC/E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAM,UAAU,GAAI,GAA0B,CAAC,IAAI,CAAC;QACpD,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAwD,CAAC,CAAC;YACpG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,iDAAiD;AACjD,SAAS,cAAc,CAAC,UAA8B;IACpD,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,gBAAgB,EAAE;YAC7B,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/utils/permissions.d.ts

@@ -7,7 +7,17 @@
  * Tier 3 – WRITE_ENABLED=true + SCRIPTING_ENABLED=true (scripts/changesets)
  * Tier AI – NOW_ASSIST_ENABLED=true (generative AI tools)
  * Tier ATF – ATF_ENABLED=true (test execution)
+ *
+ * Source of truth: process.env by default. When a request runs under a
+ * delegated-auth context (DELEGATED_AUTH mode, e.g. behind NowAIKit Gateway),
+ * the per-user policy on that context takes precedence — so capability is
+ * governed per user/request, not per server.
  */
+export declare function isWriteEnabled(): boolean;
+export declare function isCmdbWriteEnabled(): boolean;
+export declare function isScriptingEnabled(): boolean;
+export declare function isNowAssistEnabled(): boolean;
+export declare function isAtfEnabled(): boolean;
 export declare function requireWrite(): void;
 export declare function requireCmdbWrite(): void;
 export declare function requireScripting(): void;
@@ -15,9 +25,4 @@ export declare function requireNowAssist(): void;
 export declare function requireAtf(): void;
 export declare function requireFluent(): void;
 export declare function isFluentEnabled(): boolean;
-export declare function isWriteEnabled(): boolean;
-export declare function isCmdbWriteEnabled(): boolean;
-export declare function isScriptingEnabled(): boolean;
-export declare function isNowAssistEnabled(): boolean;
-export declare function isAtfEnabled(): boolean;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/utils/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED,wBAAgB,UAAU,IAAI,IAAI,CAOjC;AAED,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,wBAAgB,cAAc,IAAI,OAAO,CAIxC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,YAAY,IAAI,OAAO,CAItC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED,wBAAgB,UAAU,IAAI,IAAI,CAOjC;AAID,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/utils/permissions.js

@@ -1,4 +1,5 @@
 import { ServiceNowError } from './errors.js';
+import { getDelegatedAuth } from './request-context.js';
 /**
  * Permission tier utilities for NowAIKit tools.
  *
@@ -8,34 +9,71 @@ import { ServiceNowError } from './errors.js';
  * Tier 3 – WRITE_ENABLED=true + SCRIPTING_ENABLED=true (scripts/changesets)
  * Tier AI – NOW_ASSIST_ENABLED=true (generative AI tools)
  * Tier ATF – ATF_ENABLED=true (test execution)
+ *
+ * Source of truth: process.env by default. When a request runs under a
+ * delegated-auth context (DELEGATED_AUTH mode, e.g. behind NowAIKit Gateway),
+ * the per-user policy on that context takes precedence — so capability is
+ * governed per user/request, not per server.
  */
+export function isWriteEnabled() {
+    const d = getDelegatedAuth();
+    if (d)
+        return d.flags?.write === true;
+    return process.env.WRITE_ENABLED === 'true';
+}
+export function isCmdbWriteEnabled() {
+    const d = getDelegatedAuth();
+    if (d)
+        return d.flags?.write === true && d.flags?.cmdbWrite === true;
+    return process.env.WRITE_ENABLED === 'true' && process.env.CMDB_WRITE_ENABLED === 'true';
+}
+export function isScriptingEnabled() {
+    const d = getDelegatedAuth();
+    if (d)
+        return d.flags?.write === true && d.flags?.scripting === true;
+    return process.env.WRITE_ENABLED === 'true' && process.env.SCRIPTING_ENABLED === 'true';
+}
+export function isNowAssistEnabled() {
+    const d = getDelegatedAuth();
+    if (d)
+        return d.flags?.nowAssist === true;
+    return process.env.NOW_ASSIST_ENABLED === 'true';
+}
+export function isAtfEnabled() {
+    const d = getDelegatedAuth();
+    if (d)
+        return d.flags?.atf === true;
+    return process.env.ATF_ENABLED === 'true';
+}
 export function requireWrite() {
-    if (process.env.WRITE_ENABLED !== 'true') {
+    if (!isWriteEnabled()) {
         throw new ServiceNowError('Write operations are disabled. Set WRITE_ENABLED=true to enable.', 'WRITE_NOT_ENABLED');
     }
 }
 export function requireCmdbWrite() {
     requireWrite();
-    if (process.env.CMDB_WRITE_ENABLED !== 'true') {
+    if (!isCmdbWriteEnabled()) {
         throw new ServiceNowError('CMDB write operations are disabled. Set WRITE_ENABLED=true and CMDB_WRITE_ENABLED=true to enable.', 'CMDB_WRITE_NOT_ENABLED');
     }
 }
 export function requireScripting() {
     requireWrite();
-    if (process.env.SCRIPTING_ENABLED !== 'true') {
+    if (!isScriptingEnabled()) {
         throw new ServiceNowError('Scripting operations are disabled. Set WRITE_ENABLED=true and SCRIPTING_ENABLED=true to enable.', 'SCRIPTING_NOT_ENABLED');
     }
 }
 export function requireNowAssist() {
-    if (process.env.NOW_ASSIST_ENABLED !== 'true') {
+    if (!isNowAssistEnabled()) {
         throw new ServiceNowError('Now Assist / AI features are disabled. Set NOW_ASSIST_ENABLED=true to enable.', 'NOW_ASSIST_NOT_ENABLED');
     }
 }
 export function requireAtf() {
-    if (process.env.ATF_ENABLED !== 'true') {
+    if (!isAtfEnabled()) {
         throw new ServiceNowError('ATF test execution is disabled. Set ATF_ENABLED=true to enable.', 'ATF_NOT_ENABLED');
     }
 }
+// Fluent/now-sdk availability is a local server concern, not a per-user policy —
+// it always reads from the environment.
 export function requireFluent() {
     if (process.env.FLUENT_ENABLED !== 'true') {
         throw new ServiceNowError('Fluent/now-sdk operations are disabled. Set FLUENT_ENABLED=true to enable.', 'FLUENT_NOT_ENABLED');
@@ -44,19 +82,4 @@ export function requireFluent() {
 export function isFluentEnabled() {
     return process.env.FLUENT_ENABLED === 'true';
 }
-export function isWriteEnabled() {
-    return process.env.WRITE_ENABLED === 'true';
-}
-export function isCmdbWriteEnabled() {
-    return process.env.WRITE_ENABLED === 'true' && process.env.CMDB_WRITE_ENABLED === 'true';
-}
-export function isScriptingEnabled() {
-    return process.env.WRITE_ENABLED === 'true' && process.env.SCRIPTING_ENABLED === 'true';
-}
-export function isNowAssistEnabled() {
-    return process.env.NOW_ASSIST_ENABLED === 'true';
-}
-export function isAtfEnabled() {
-    return process.env.ATF_ENABLED === 'true';
-}
 //# sourceMappingURL=permissions.js.map

package/dist/utils/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;GASG;AAEH,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CACvB,kEAAkE,EAClE,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CACvB,mGAAmG,EACnG,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CACvB,iGAAiG,EACjG,uBAAuB,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CACvB,+EAA+E,EAC/E,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CACvB,iEAAiE,EACjE,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,4EAA4E,EAC5E,oBAAoB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACrE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACrE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,kEAAkE,EAClE,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,mGAAmG,EACnG,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,iGAAiG,EACjG,uBAAuB,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,+EAA+E,EAC/E,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iEAAiE,EACjE,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,wCAAwC;AACxC,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,4EAA4E,EAC5E,oBAAoB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC"}

package/dist/utils/request-context.d.ts

@@ -0,0 +1,28 @@
+export interface DelegatedFlags {
+    write?: boolean;
+    cmdbWrite?: boolean;
+    scripting?: boolean;
+    nowAssist?: boolean;
+    atf?: boolean;
+}
+export interface DelegatedAuth {
+    /** The user's ServiceNow access token (OBO-exchanged upstream). */
+    bearerToken?: string;
+    /** Instance URL the upstream resolved for this user (multi-instance routing). */
+    instanceUrl?: string;
+    /** Per-user capability policy resolved by the upstream gateway. */
+    flags?: DelegatedFlags;
+    /** Resolved tool package / persona (informational). */
+    toolPackage?: string;
+    /** User identifier (for audit/logging only). */
+    user?: string;
+}
+/** True when delegated-auth mode is switched on. */
+export declare function isDelegatedAuthEnabled(): boolean;
+/** Run `fn` with the given delegated-auth context bound for its async lifetime. */
+export declare function runWithDelegatedAuth<T>(ctx: DelegatedAuth, fn: () => T): T;
+/** The current request's delegated-auth context, or undefined outside one. */
+export declare function getDelegatedAuth(): DelegatedAuth | undefined;
+/** Build a delegated-auth context from inbound (lowercased) HTTP headers. */
+export declare function parseDelegatedAuthHeaders(headers: Record<string, string | string[] | undefined>): DelegatedAuth;
+//# sourceMappingURL=request-context.d.ts.map

package/dist/utils/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID,oDAAoD;AACpD,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE1E;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAE5D;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,aAAa,CAmBf"}