nowaikit 4.11.0 → 4.12.0

package/dist/tools/access-admin.js

@@ -0,0 +1,216 @@
+import { ServiceNowError } from '../utils/errors.js';
+import { requireWrite } from '../utils/permissions.js';
+async function resolveUser(client, user) {
+    if (/^[0-9a-f]{32}$/i.test(user))
+        return user;
+    const resp = await client.queryRecords({ table: 'sys_user', query: `user_name=${user}^ORemail=${user}`, limit: 1 });
+    if (resp.count === 0)
+        throw new ServiceNowError(`User not found: ${user}`, 'NOT_FOUND');
+    return resp.records[0].sys_id;
+}
+async function resolveRole(client, role) {
+    if (/^[0-9a-f]{32}$/i.test(role))
+        return role;
+    const resp = await client.queryRecords({ table: 'sys_user_role', query: `name=${role}`, limit: 1 });
+    if (resp.count === 0)
+        throw new ServiceNowError(`Role not found: ${role}`, 'NOT_FOUND');
+    return resp.records[0].sys_id;
+}
+export function getAccessAdminToolDefinitions() {
+    return [
+        {
+            name: 'list_user_roles',
+            description: 'List roles granted to a user (sys_user_has_role), including inherited flag',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User sys_id, user_name, or email' },
+                },
+                required: ['user'],
+            },
+        },
+        {
+            name: 'grant_role',
+            description: 'Grant a role to a user (sys_user_has_role). Requires WRITE_ENABLED=true',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User sys_id, user_name, or email' },
+                    role: { type: 'string', description: 'Role sys_id or name (e.g. "itil")' },
+                },
+                required: ['user', 'role'],
+            },
+        },
+        {
+            name: 'revoke_role',
+            description: 'Revoke a directly-granted role from a user. Requires WRITE_ENABLED=true',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User sys_id, user_name, or email' },
+                    role: { type: 'string', description: 'Role sys_id or name' },
+                },
+                required: ['user', 'role'],
+            },
+        },
+        {
+            name: 'create_role',
+            description: 'Create a new role (sys_user_role). Requires WRITE_ENABLED=true',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Role name (e.g. "x_acme.approver")' },
+                    description: { type: 'string', description: 'Role description' },
+                    fields: { type: 'object', description: 'Additional field values' },
+                },
+                required: ['name'],
+            },
+        },
+        {
+            name: 'deactivate_user',
+            description: 'Deactivate (offboard) a user by setting active=false. Requires WRITE_ENABLED=true',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User sys_id, user_name, or email' },
+                },
+                required: ['user'],
+            },
+        },
+        {
+            name: 'create_delegation',
+            description: 'Create an approval/coverage delegation (sys_user_delegate). Requires WRITE_ENABLED=true',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User delegating (sys_id/user_name/email)' },
+                    delegate: { type: 'string', description: 'User receiving the delegation' },
+                    starts: { type: 'string', description: 'Start datetime (YYYY-MM-DD HH:MM:SS)' },
+                    ends: { type: 'string', description: 'End datetime (YYYY-MM-DD HH:MM:SS)' },
+                    approvals: { type: 'boolean', description: 'Delegate approvals (default true)' },
+                    assignments: { type: 'boolean', description: 'Delegate assignments' },
+                },
+                required: ['user', 'delegate'],
+            },
+        },
+        {
+            name: 'list_group_members',
+            description: 'List the members of a group (sys_user_grmember)',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    group: { type: 'string', description: 'Group sys_id or name' },
+                    limit: { type: 'number', description: 'Max records (default 100)' },
+                },
+                required: ['group'],
+            },
+        },
+        {
+            name: 'get_user_entitlements',
+            description: 'Summarize what a user can access: their roles, groups, and active status',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    user: { type: 'string', description: 'User sys_id, user_name, or email' },
+                },
+                required: ['user'],
+            },
+        },
+    ];
+}
+export async function executeAccessAdminToolCall(client, name, args) {
+    switch (name) {
+        case 'list_user_roles': {
+            const userId = await resolveUser(client, args.user);
+            return await client.queryRecords({
+                table: 'sys_user_has_role',
+                query: `user=${userId}`,
+                fields: 'role,role.name,inherited,granted_by,state',
+                limit: 200,
+            });
+        }
+        case 'grant_role': {
+            requireWrite();
+            const userId = await resolveUser(client, args.user);
+            const roleId = await resolveRole(client, args.role);
+            const existing = await client.queryRecords({ table: 'sys_user_has_role', query: `user=${userId}^role=${roleId}`, limit: 1 });
+            if (existing.count > 0)
+                return { already_granted: true, summary: `User already has role ${args.role}` };
+            const result = await client.createRecord('sys_user_has_role', { user: userId, role: roleId });
+            return { ...result, summary: `Granted role ${args.role} to ${args.user}` };
+        }
+        case 'revoke_role': {
+            requireWrite();
+            const userId = await resolveUser(client, args.user);
+            const roleId = await resolveRole(client, args.role);
+            const existing = await client.queryRecords({ table: 'sys_user_has_role', query: `user=${userId}^role=${roleId}^inherited=false`, limit: 1 });
+            if (existing.count === 0)
+                throw new ServiceNowError(`No directly-granted role ${args.role} on ${args.user} to revoke`, 'NOT_FOUND');
+            await client.deleteRecord('sys_user_has_role', existing.records[0].sys_id);
+            return { success: true, summary: `Revoked role ${args.role} from ${args.user}` };
+        }
+        case 'create_role': {
+            requireWrite();
+            if (!args.name)
+                throw new ServiceNowError('name is required', 'INVALID_REQUEST');
+            const payload = { name: args.name, ...(args.fields ?? {}) };
+            if (args.description)
+                payload.description = args.description;
+            const result = await client.createRecord('sys_user_role', payload);
+            return { ...result, summary: `Created role "${args.name}"` };
+        }
+        case 'deactivate_user': {
+            requireWrite();
+            const userId = await resolveUser(client, args.user);
+            const result = await client.updateRecord('sys_user', userId, { active: 'false' });
+            return { ...result, summary: `Deactivated user ${args.user}` };
+        }
+        case 'create_delegation': {
+            requireWrite();
+            const userId = await resolveUser(client, args.user);
+            const delegateId = await resolveUser(client, args.delegate);
+            const payload = {
+                user: userId,
+                delegate: delegateId,
+                approvals: args.approvals === false ? 'false' : 'true',
+            };
+            if (args.assignments !== undefined)
+                payload.assignments = args.assignments ? 'true' : 'false';
+            if (args.starts)
+                payload.starts = args.starts;
+            if (args.ends)
+                payload.ends = args.ends;
+            const result = await client.createRecord('sys_user_delegate', payload);
+            return { ...result, summary: `Delegated from ${args.user} to ${args.delegate}` };
+        }
+        case 'list_group_members': {
+            let groupId = args.group;
+            if (!/^[0-9a-f]{32}$/i.test(groupId)) {
+                const g = await client.queryRecords({ table: 'sys_user_group', query: `name=${args.group}`, limit: 1 });
+                if (g.count === 0)
+                    throw new ServiceNowError(`Group not found: ${args.group}`, 'NOT_FOUND');
+                groupId = g.records[0].sys_id;
+            }
+            return await client.queryRecords({
+                table: 'sys_user_grmember',
+                query: `group=${groupId}`,
+                fields: 'user,user.name,user.user_name,user.email,user.active',
+                limit: args.limit ?? 100,
+            });
+        }
+        case 'get_user_entitlements': {
+            const userId = await resolveUser(client, args.user);
+            const user = await client.getRecord('sys_user', userId);
+            const roles = await client.queryRecords({ table: 'sys_user_has_role', query: `user=${userId}`, fields: 'role.name,inherited', limit: 200 }).catch(() => ({ records: [] }));
+            const groups = await client.queryRecords({ table: 'sys_user_grmember', query: `user=${userId}`, fields: 'group.name', limit: 200 }).catch(() => ({ records: [] }));
+            return {
+                user: { sys_id: userId, name: user.name, user_name: user.user_name, active: user.active },
+                roles: roles.records,
+                groups: groups.records,
+            };
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=access-admin.js.map

package/dist/tools/access-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-admin.js","sourceRoot":"","sources":["../../src/tools/access-admin.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,KAAK,UAAU,WAAW,CAAC,MAAwB,EAAE,IAAY;IAC/D,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,IAAI,YAAY,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpH,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACxF,OAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAwB,EAAE,IAAY;IAC/D,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACxF,OAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC,MAAM,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,4EAA4E;YACzF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;iBAC1E;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;oBACzE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;iBAC3E;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aAC3B;SACF;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;oBACzE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;iBAC7D;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;aAC3B;SACF;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,gEAAgE;YAC7E,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;oBAC3E,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;oBAChE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yBAAyB,EAAE;iBACnE;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,mFAAmF;YAChG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;iBAC1E;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,yFAAyF;YACtG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;oBACjF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;oBAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;oBAC/E,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oCAAoC,EAAE;oBAC3E,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE;oBAChF,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,EAAE;iBACtE;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;aAC/B;SACF;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,iDAAiD;YAC9D,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;oBAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,EAAE;iBACpE;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;aACpB;SACF;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,0EAA0E;YACvF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE;iBAC1E;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAwB,EACxB,IAAY,EACZ,IAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC/B,KAAK,EAAE,mBAAmB;gBAC1B,KAAK,EAAE,QAAQ,MAAM,EAAE;gBACvB,MAAM,EAAE,2CAA2C;gBACnD,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7H,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC;gBAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACxG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,MAAM,SAAS,MAAM,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7I,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,YAAY,EAAE,WAAW,CAAC,CAAC;YACpI,MAAM,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC,MAAM,CAAC,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;YACjF,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACjF,IAAI,IAAI,CAAC,WAAW;gBAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACnE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAC/D,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjE,CAAC;QACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,YAAY,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAwB;gBACnC,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,UAAU;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aACvD,CAAC;YACF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9F,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC9C,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACvE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;gBAC5F,OAAO,GAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC,MAAM,CAAC;YACzC,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC/B,KAAK,EAAE,mBAAmB;gBAC1B,KAAK,EAAE,SAAS,OAAO,EAAE;gBACzB,MAAM,EAAE,sDAAsD;gBAC9D,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG;aACzB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3K,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACnK,OAAO;gBACL,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAG,IAAY,CAAC,IAAI,EAAE,SAAS,EAAG,IAAY,CAAC,SAAS,EAAE,MAAM,EAAG,IAAY,CAAC,MAAM,EAAE;gBACpH,KAAK,EAAG,KAAa,CAAC,OAAO;gBAC7B,MAAM,EAAG,MAAc,CAAC,OAAO;aAChC,CAAC;QACJ,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/tools/ai-agent-exec.d.ts

@@ -0,0 +1,70 @@
+/**
+ * AI Agent (Now Assist AI Agents) execution observability. Read-only: Tier 0.
+ * Strategic for an MCP product — surface how ServiceNow's own agents ran.
+ *
+ * Tables (Now Assist AI Agents, sn_aia scope; availability depends on release/plugins):
+ *   sn_aia_execution_plan       — agent execution plans/runs
+ *   sn_aia_execution_plan_step  — steps/tool calls within a plan
+ *   sn_aia_usecase              — AI Agent Studio use cases
+ */
+import type { ServiceNowClient } from '../servicenow/client.js';
+export declare function getAiAgentExecToolDefinitions(): ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            status: {
+                type: string;
+                description: string;
+            };
+            query: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+            sys_id?: undefined;
+        };
+        required: never[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            sys_id: {
+                type: string;
+                description: string;
+            };
+            status?: undefined;
+            query?: undefined;
+            limit?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            query: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+            status?: undefined;
+            sys_id?: undefined;
+        };
+        required: never[];
+    };
+})[];
+export declare function executeAiAgentExecToolCall(client: ServiceNowClient, name: string, args: Record<string, any>): Promise<any>;
+//# sourceMappingURL=ai-agent-exec.d.ts.map

package/dist/tools/ai-agent-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-agent-exec.d.ts","sourceRoot":"","sources":["../../src/tools/ai-agent-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,wBAAgB,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAuC5C;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,OAAO,CAAC,GAAG,CAAC,CA2Bd"}

package/dist/tools/ai-agent-exec.js

@@ -0,0 +1,73 @@
+import { ServiceNowError } from '../utils/errors.js';
+export function getAiAgentExecToolDefinitions() {
+    return [
+        {
+            name: 'list_ai_agent_executions',
+            description: 'List recent Now Assist AI Agent execution plans (sn_aia_execution_plan)',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    status: { type: 'string', description: 'Filter by execution status' },
+                    query: { type: 'string', description: 'Encoded query for additional filtering' },
+                    limit: { type: 'number', description: 'Max records (default 25)' },
+                },
+                required: [],
+            },
+        },
+        {
+            name: 'get_ai_agent_execution',
+            description: 'Get an AI Agent execution plan with its steps/tool calls (sn_aia_execution_plan + _step)',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    sys_id: { type: 'string', description: 'sys_id of the execution plan' },
+                },
+                required: ['sys_id'],
+            },
+        },
+        {
+            name: 'list_agent_use_cases',
+            description: 'List AI Agent Studio use cases (sn_aia_usecase) and their configuration',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    query: { type: 'string', description: 'Search use cases by name' },
+                    limit: { type: 'number', description: 'Max records (default 50)' },
+                },
+                required: [],
+            },
+        },
+    ];
+}
+export async function executeAiAgentExecToolCall(client, name, args) {
+    switch (name) {
+        case 'list_ai_agent_executions': {
+            const parts = [];
+            if (args.status)
+                parts.push(`status=${args.status}`);
+            if (args.query)
+                parts.push(args.query);
+            return await client.queryRecords({
+                table: 'sn_aia_execution_plan',
+                query: parts.join('^') + (parts.length ? '^' : '') + 'ORDERBYDESCsys_created_on',
+                limit: args.limit ?? 25,
+            });
+        }
+        case 'get_ai_agent_execution': {
+            if (!args.sys_id)
+                throw new ServiceNowError('sys_id is required', 'INVALID_REQUEST');
+            const plan = await client.getRecord('sn_aia_execution_plan', args.sys_id);
+            const steps = await client
+                .queryRecords({ table: 'sn_aia_execution_plan_step', query: `execution_plan=${args.sys_id}^ORDERBYorder`, limit: 200 })
+                .catch(() => ({ records: [] }));
+            return { execution_plan: plan, steps: steps.records };
+        }
+        case 'list_agent_use_cases': {
+            const query = args.query ? `nameCONTAINS${args.query}` : '';
+            return await client.queryRecords({ table: 'sn_aia_usecase', query, limit: args.limit ?? 50 });
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=ai-agent-exec.js.map

package/dist/tools/ai-agent-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-agent-exec.js","sourceRoot":"","sources":["../../src/tools/ai-agent-exec.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;oBACrE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE;oBAChF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;iBACnE;gBACD,QAAQ,EAAE,EAAE;aACb;SACF;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,0FAA0F;YACvG,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;iBACxE;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;SACF;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,yEAAyE;YACtF,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;oBAClE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;iBACnE;gBACD,QAAQ,EAAE,EAAE;aACb;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAwB,EACxB,IAAY,EACZ,IAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,0BAA0B,CAAC,CAAC,CAAC;YAChC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC/B,KAAK,EAAE,uBAAuB;gBAC9B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,2BAA2B;gBAChF,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,MAAM;iBACvB,YAAY,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,kBAAkB,IAAI,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;iBACtH,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAG,KAAa,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/tools/approvals-extra.d.ts

@@ -0,0 +1,202 @@
+/**
+ * Approval-management parity tools — matches ServiceNow's Advanced Approval Management AI
+ * MCP surface (quotes, ad-hoc approvers, routing preview, recall, history) but generalized
+ * to any approvable record, not just CPQ quotes. Read: Tier 0. Actions: Tier 1 (WRITE_ENABLED).
+ *
+ * Tables:
+ *   sysapproval_approver — approval requests (the approver rows)
+ *   sysapproval_group    — approval groups
+ *   sn_quote / sn_sales_quote / quote — CPQ quotes (name varies by version)
+ *   wf_approval / sys_approval_rule — routing definitions
+ */
+import type { ServiceNowClient } from '../servicenow/client.js';
+export declare function getApprovalsExtraToolDefinitions(): ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            number: {
+                type: string;
+                description: string;
+            };
+            sys_id: {
+                type: string;
+                description: string;
+            };
+            table: {
+                type: string;
+                description: string;
+            };
+            state?: undefined;
+            account?: undefined;
+            limit?: undefined;
+            record?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+            approval_field?: undefined;
+        };
+        required: never[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            table: {
+                type: string;
+                description: string;
+            };
+            state: {
+                type: string;
+                description: string;
+            };
+            account: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            sys_id?: undefined;
+            record?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+            approval_field?: undefined;
+        };
+        required: never[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            record: {
+                type: string;
+                description: string;
+            };
+            limit: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            sys_id?: undefined;
+            table?: undefined;
+            state?: undefined;
+            account?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+            approval_field?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            record: {
+                type: string;
+                description: string;
+            };
+            table: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            sys_id?: undefined;
+            state?: undefined;
+            account?: undefined;
+            limit?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+            approval_field?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            record: {
+                type: string;
+                description: string;
+            };
+            approver: {
+                type: string;
+                description: string;
+            };
+            source_table: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            sys_id?: undefined;
+            table?: undefined;
+            state?: undefined;
+            account?: undefined;
+            limit?: undefined;
+            approval_field?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            record: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            sys_id?: undefined;
+            table?: undefined;
+            state?: undefined;
+            account?: undefined;
+            limit?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+            approval_field?: undefined;
+        };
+        required: string[];
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            table: {
+                type: string;
+                description: string;
+            };
+            sys_id: {
+                type: string;
+                description: string;
+            };
+            approval_field: {
+                type: string;
+                description: string;
+            };
+            number?: undefined;
+            state?: undefined;
+            account?: undefined;
+            limit?: undefined;
+            record?: undefined;
+            approver?: undefined;
+            source_table?: undefined;
+        };
+        required: string[];
+    };
+})[];
+export declare function executeApprovalsExtraToolCall(client: ServiceNowClient, name: string, args: Record<string, any>): Promise<any>;
+//# sourceMappingURL=approvals-extra.d.ts.map

package/dist/tools/approvals-extra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-extra.d.ts","sourceRoot":"","sources":["../../src/tools/approvals-extra.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAMhE,wBAAgB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2F/C;AAYD,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACxB,OAAO,CAAC,GAAG,CAAC,CAuFd"}