nowaikit 4.4.0 → 4.5.0

package/dist/tools/visualization.js

@@ -0,0 +1,170 @@
+import { ServiceNowError } from '../utils/errors.js';
+const VISUALIZATION_TOOL_NAMES = new Set(['visualize_aggregate', 'visualize_trend']);
+function toPoints(result) {
+    return (result || [])
+        .map((g) => {
+        const gf = (g.groupby_fields && g.groupby_fields[0]) || {};
+        const label = String(gf.display_value ?? gf.value ?? 'unknown');
+        const value = Number((g.stats && g.stats.count) ?? g.count ?? 0);
+        return { label, value };
+    })
+        .filter((p) => Number.isFinite(p.value));
+}
+function markdownTable(header, rows) {
+    const lines = [`| ${header[0]} | ${header[1]} |`, '| --- | ---: |'];
+    for (const r of rows)
+        lines.push(`| ${r.label} | ${r.value} |`);
+    return lines.join('\n');
+}
+function card(title, chart) {
+    return {
+        type: 'AdaptiveCard',
+        $schema: 'http://adaptivecards.io/schemas/adaptive-card.json',
+        version: '1.5',
+        body: [
+            { type: 'TextBlock', text: title, size: 'Large', weight: 'Bolder', wrap: true },
+            chart,
+        ],
+    };
+}
+function breakdownChart(chartType, title, points) {
+    const t = chartType.toLowerCase();
+    if (t === 'pie' || t === 'donut') {
+        const type = t === 'donut' ? 'Chart.Donut' : 'Chart.Pie';
+        return card(title, {
+            type,
+            colorSet: 'categorical',
+            data: points.map((p) => ({ legend: p.label, value: p.value })),
+        });
+    }
+    // bar (horizontal) or column (vertical, default)
+    const type = t === 'bar' ? 'Chart.HorizontalBar' : 'Chart.VerticalBar';
+    return card(title, {
+        type,
+        colorSet: 'categorical',
+        showBarValues: true,
+        data: points.map((p) => ({ x: p.label, y: p.value })),
+    });
+}
+function truncateBucket(dateValue, interval) {
+    const v = String(dateValue);
+    if (interval === 'month')
+        return v.slice(0, 7);
+    if (interval === 'week') {
+        const d = new Date(v.replace(' ', 'T') + 'Z');
+        if (isNaN(d.getTime()))
+            return v.slice(0, 10);
+        const day = (d.getUTCDay() + 6) % 7; // Monday = 0
+        d.setUTCDate(d.getUTCDate() - day);
+        return d.toISOString().slice(0, 10);
+    }
+    return v.slice(0, 10); // day
+}
+export function getVisualizationToolDefinitions() {
+    return [
+        {
+            name: 'visualize_aggregate',
+            description: 'Build a real-time chart of ServiceNow records grouped by a field (e.g. incidents by priority, cases by state). Returns chart-ready data, a Teams Adaptive Card (Chart.*) to drop into a Copilot Studio "Send an adaptive card" step, a markdown table, and a summary. Read-only.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    table: { type: 'string', description: 'Table to aggregate, e.g. "incident", "sn_customerservice_case"' },
+                    group_by: { type: 'string', description: 'Field to group by, e.g. "priority", "state", "category", "assignment_group"' },
+                    query: { type: 'string', description: 'Optional encoded query filter, e.g. "active=true"' },
+                    chart_type: { type: 'string', description: 'column (default) | bar | pie | donut' },
+                    title: { type: 'string', description: 'Optional chart title' },
+                    limit: { type: 'number', description: 'Keep the top N groups by count (default 12)' },
+                },
+                required: ['table', 'group_by'],
+            },
+        },
+        {
+            name: 'visualize_trend',
+            description: 'Build a real-time trend line of ServiceNow record counts over time (e.g. incidents opened per day). Returns chart-ready series, a Teams Adaptive Card line chart, a markdown table, and a summary. Read-only.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    table: { type: 'string', description: 'Table to count, e.g. "incident"' },
+                    date_field: { type: 'string', description: 'Date/time field to bucket on (default "sys_created_on")' },
+                    interval: { type: 'string', description: 'day (default) | week | month' },
+                    query: { type: 'string', description: 'Recommended: a span filter, e.g. "sys_created_onONLast 30 days@..." or "active=true"' },
+                    title: { type: 'string', description: 'Optional chart title' },
+                },
+                required: ['table'],
+            },
+        },
+    ];
+}
+export async function executeVisualizationToolCall(client, name, args) {
+    if (!VISUALIZATION_TOOL_NAMES.has(name))
+        return null;
+    switch (name) {
+        case 'visualize_aggregate': {
+            if (!args.table || !args.group_by)
+                throw new ServiceNowError('table and group_by are required', 'INVALID_REQUEST');
+            const chartType = String(args.chart_type || 'column');
+            const limit = typeof args.limit === 'number' ? args.limit : 12;
+            const result = await client.runAggregateQuery(String(args.table), String(args.group_by), 'COUNT', args.query ? String(args.query) : undefined);
+            let points = toPoints(result).sort((a, b) => b.value - a.value);
+            const total = points.reduce((a, p) => a + p.value, 0);
+            if (points.length > limit)
+                points = points.slice(0, limit);
+            const title = String(args.title || `${args.table} by ${args.group_by}`);
+            const summary = points.length
+                ? `${title}: ${points.map((p) => `${p.label} (${p.value})`).join(', ')}. Total ${total}.`
+                : `No records found for ${args.table}${args.query ? ` where ${args.query}` : ''}.`;
+            return {
+                title,
+                table: args.table,
+                group_by: args.group_by,
+                chart_type: chartType,
+                total,
+                data: points,
+                table_markdown: markdownTable([String(args.group_by), 'count'], points),
+                adaptive_card: breakdownChart(chartType, title, points),
+                summary,
+            };
+        }
+        case 'visualize_trend': {
+            if (!args.table)
+                throw new ServiceNowError('table is required', 'INVALID_REQUEST');
+            const dateField = String(args.date_field || 'sys_created_on');
+            const interval = String(args.interval || 'day');
+            const result = await client.runAggregateQuery(String(args.table), dateField, 'COUNT', args.query ? String(args.query) : undefined);
+            const buckets = new Map();
+            for (const p of toPoints(result)) {
+                const key = truncateBucket(p.label, interval);
+                buckets.set(key, (buckets.get(key) || 0) + p.value);
+            }
+            const series = Array.from(buckets.entries())
+                .map(([label, value]) => ({ label, value }))
+                .sort((a, b) => (a.label < b.label ? -1 : a.label > b.label ? 1 : 0));
+            const total = series.reduce((a, p) => a + p.value, 0);
+            const title = String(args.title || `${args.table} per ${interval}`);
+            const lineCard = card(title, {
+                type: 'Chart.Line',
+                colorSet: 'categorical',
+                xAxisTitle: interval,
+                yAxisTitle: 'count',
+                data: [{ legend: 'count', values: series.map((p) => ({ x: p.label, y: p.value })) }],
+            });
+            const summary = series.length
+                ? `${title}: ${series.length} ${interval}s, total ${total} (from ${series[0].label} to ${series[series.length - 1].label}).`
+                : `No records found for ${args.table}${args.query ? ` where ${args.query}` : ''}.`;
+            return {
+                title,
+                table: args.table,
+                date_field: dateField,
+                interval,
+                total,
+                data: series,
+                table_markdown: markdownTable([interval, 'count'], series),
+                adaptive_card: lineCard,
+                summary,
+            };
+        }
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=visualization.js.map

package/dist/tools/visualization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visualization.js","sourceRoot":"","sources":["../../src/tools/visualization.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAIrF,SAAS,QAAQ,CAAC,MAAa;IAC7B,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,MAAwB,EAAE,IAAa;IAC5D,MAAM,KAAK,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,KAAU;IACrC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;YAC/E,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,KAAa,EAAE,MAAe;IACvE,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,EAAE;YACjB,IAAI;YACJ,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,iDAAiD;IACjD,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACvE,OAAO,IAAI,CAAC,KAAK,EAAE;QACjB,IAAI;QACJ,QAAQ,EAAE,aAAa;QACvB,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,QAAgB;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa;QAClD,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,GAAG,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;AAC/B,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO;QACL;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,kRAAkR;YAC/R,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gEAAgE,EAAE;oBACxG,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6EAA6E,EAAE;oBACxH,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mDAAmD,EAAE;oBAC3F,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;oBACnF,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;oBAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE;iBACtF;gBACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;aAChC;SACF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,+MAA+M;YAC5N,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;oBACzE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yDAAyD,EAAE;oBACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;oBACzE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sFAAsF,EAAE;oBAC9H,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;iBAC/D;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAwB,EACxB,IAAY,EACZ,IAAyB;IAEzB,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAqB,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;YACnH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/I,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;gBAC3B,CAAC,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG;gBACzF,CAAC,CAAC,wBAAwB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YACrF,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,SAAS;gBACrB,KAAK;gBACL,IAAI,EAAE,MAAM;gBACZ,cAAc,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;gBACvE,aAAa,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC;gBACvD,OAAO;aACR,CAAC;QACJ,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;YACnF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnI,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;YAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;iBACzC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;iBAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,KAAK,QAAQ,QAAQ,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE;gBAC3B,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,aAAa;gBACvB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,OAAO;gBACnB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;aACrF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;gBAC3B,CAAC,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,YAAY,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAC5H,CAAC,CAAC,wBAAwB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YACrF,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,SAAS;gBACrB,QAAQ;gBACR,KAAK;gBACL,IAAI,EAAE,MAAM;gBACZ,cAAc,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;gBAC1D,aAAa,EAAE,QAAQ;gBACvB,OAAO;aACR,CAAC;QACJ,CAAC;QAED;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/tools-manifest.json

@@ -9317,7 +9317,7 @@
   },
   {
     "name": "blast_radius_table_configs",
-    "description": "Blast radius: list every configuration artifact scoped to a table (business rules, client scripts, UI policies, ACLs, UI actions, data policies, dictionary fields). Run before altering or removing a table.",
+    "description": "Blast radius (config/metadata impact, not CMDB CI impact): list every configuration artifact scoped to a table (business rules, client scripts, UI policies, ACLs, UI actions, data policies, dictionary fields), with per-type counts. Run before altering or removing a table. Each lane returns {count, records} or {error} if that table/plugin is unavailable.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9337,7 +9337,7 @@
   },
   {
     "name": "blast_radius_field_references",
-    "description": "Blast radius: find where a table field is referenced — its dictionary entry plus any scripts (business rules, script includes, client scripts, UI actions, widgets) that mention the field name. Run before renaming or removing a field.",
+    "description": "Blast radius: find where a table field is referenced — its dictionary entry plus any scripts (business rules, script includes, client scripts, UI actions, widgets) that mention the field name. Run before renaming or removing a field. Script matches are substring (LIKE) hits, so expect false positives (comments, similarly-named symbols) and misses for dynamically-built references; treat results as candidates to review, not a definitive list.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9362,7 +9362,7 @@
   },
   {
     "name": "blast_radius_script_dependents",
-    "description": "Blast radius: find what references a script include / artifact by name — scans script-bearing config tables for textual use of the name. Run before renaming or deleting a Script Include, Script Action, etc.",
+    "description": "Blast radius: find what references a script include / artifact by name — scans script-bearing config tables for textual use of the name. Run before renaming or deleting a Script Include, Script Action, etc. Matches are substring (LIKE) hits, so treat them as candidates to review (false positives from comments/similar names; misses for dynamic references).",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9402,7 +9402,7 @@
   },
   {
     "name": "blast_radius_property_usage",
-    "description": "Blast radius: find scripts that read a system property (sys_properties) by name, plus the property record itself. Run before changing or removing a property.",
+    "description": "Blast radius: find scripts that read a system property (sys_properties) by name, plus the property record itself. Run before changing or removing a property. Matches are substring (LIKE) hits — candidates to review, not definitive.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9431,7 +9431,7 @@
   },
   {
     "name": "pull_artifact",
-    "description": "Local sync: fetch an artifact's editable fields (e.g. a Service Portal widget's template/css/script). Returns the content inline; when NOWAIKIT_SYNC_DIR is set it also writes one file per field and returns the paths.",
+    "description": "Local sync: fetch an artifact's editable fields (e.g. a Service Portal widget's template/css/script) for local editing. Returns the content inline; when NOWAIKIT_SYNC_DIR is set it also writes one file per field and returns the paths. This is config/pro-code editing of a single artifact, not an update-set export.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9441,7 +9441,7 @@
         },
         "sys_id": {
           "type": "string",
-          "description": "sys_id of the record"
+          "description": "sys_id OR name of the record (a name is resolved to its sys_id)"
         }
       },
       "required": [
@@ -9452,7 +9452,7 @@
   },
   {
     "name": "push_artifact",
-    "description": "Local sync: write edited fields back to an artifact (requires WRITE_ENABLED=true). Pass fields inline as {field:value}; if omitted and NOWAIKIT_SYNC_DIR is set, reads them from the pulled files on disk.",
+    "description": "Local sync: write edited fields back to an artifact (requires WRITE_ENABLED=true). Pass fields inline as {field:value}; if omitted and NOWAIKIT_SYNC_DIR is set, reads them from the pulled files on disk. Overwrites the listed fields with NO merge — run sync_status first, and pass expected_updated_on to abort if the instance changed since you pulled.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9462,11 +9462,15 @@
         },
         "sys_id": {
           "type": "string",
-          "description": "sys_id of the record"
+          "description": "sys_id OR name of the record"
         },
         "fields": {
           "type": "object",
           "description": "Optional map of {field: newValue} to update; defaults to the on-disk files under NOWAIKIT_SYNC_DIR"
+        },
+        "expected_updated_on": {
+          "type": "string",
+          "description": "Optional sys_updated_on from your last pull/sync_status; the push aborts with a CONFLICT if the record has changed since."
         }
       },
       "required": [
@@ -9477,7 +9481,7 @@
   },
   {
     "name": "sync_status",
-    "description": "Local sync: compare an artifact's current instance content against your local/edited content field-by-field and report which fields changed.",
+    "description": "Local sync: compare an artifact's current instance content against your local/edited content field-by-field. Each field reports unchanged | changed | not_local (no local copy to compare). Also returns sys_updated_on to feed into push_artifact's conflict check.",
     "inputSchema": {
       "type": "object",
       "properties": {
@@ -9487,7 +9491,7 @@
         },
         "sys_id": {
           "type": "string",
-          "description": "sys_id of the record"
+          "description": "sys_id OR name of the record"
         },
         "fields": {
           "type": "object",
@@ -9499,5 +9503,74 @@
         "sys_id"
       ]
     }
+  },
+  {
+    "name": "visualize_aggregate",
+    "description": "Build a real-time chart of ServiceNow records grouped by a field (e.g. incidents by priority, cases by state). Returns chart-ready data, a Teams Adaptive Card (Chart.*) to drop into a Copilot Studio \"Send an adaptive card\" step, a markdown table, and a summary. Read-only.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Table to aggregate, e.g. \"incident\", \"sn_customerservice_case\""
+        },
+        "group_by": {
+          "type": "string",
+          "description": "Field to group by, e.g. \"priority\", \"state\", \"category\", \"assignment_group\""
+        },
+        "query": {
+          "type": "string",
+          "description": "Optional encoded query filter, e.g. \"active=true\""
+        },
+        "chart_type": {
+          "type": "string",
+          "description": "column (default) | bar | pie | donut"
+        },
+        "title": {
+          "type": "string",
+          "description": "Optional chart title"
+        },
+        "limit": {
+          "type": "number",
+          "description": "Keep the top N groups by count (default 12)"
+        }
+      },
+      "required": [
+        "table",
+        "group_by"
+      ]
+    }
+  },
+  {
+    "name": "visualize_trend",
+    "description": "Build a real-time trend line of ServiceNow record counts over time (e.g. incidents opened per day). Returns chart-ready series, a Teams Adaptive Card line chart, a markdown table, and a summary. Read-only.",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "table": {
+          "type": "string",
+          "description": "Table to count, e.g. \"incident\""
+        },
+        "date_field": {
+          "type": "string",
+          "description": "Date/time field to bucket on (default \"sys_created_on\")"
+        },
+        "interval": {
+          "type": "string",
+          "description": "day (default) | week | month"
+        },
+        "query": {
+          "type": "string",
+          "description": "Recommended: a span filter, e.g. \"sys_created_onONLast 30 days@...\" or \"active=true\""
+        },
+        "title": {
+          "type": "string",
+          "description": "Optional chart title"
+        }
+      },
+      "required": [
+        "table"
+      ]
+    }
   }
 ]

package/dist/utils/permissions.d.ts

@@ -8,10 +8,11 @@
  * Tier AI – NOW_ASSIST_ENABLED=true (generative AI tools)
  * Tier ATF – ATF_ENABLED=true (test execution)
  *
- * Source of truth: process.env by default. When a request runs under a
- * delegated-auth context (DELEGATED_AUTH mode, e.g. behind NowAIKit Gateway),
- * the per-user policy on that context takes precedence — so capability is
- * governed per user/request, not per server.
+ * Source of truth: process.env sets the server's capability CEILING. When a request
+ * runs under a delegated-auth context (DELEGATED_AUTH mode, e.g. behind a trusted
+ * gateway), the per-user policy can only NARROW that ceiling, never widen it — a
+ * forged/over-permissive delegated flag can never enable a tier the operator left
+ * disabled. So the effective capability is (env AND delegated).
  */
 export declare function isWriteEnabled(): boolean;
 export declare function isCmdbWriteEnabled(): boolean;

package/dist/utils/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,wBAAgB,cAAc,IAAI,OAAO,CAIxC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,YAAY,IAAI,OAAO,CAItC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED,wBAAgB,UAAU,IAAI,IAAI,CAOjC;AAID,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,wBAAgB,cAAc,IAAI,OAAO,CAIxC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAI5C;AAED,wBAAgB,YAAY,IAAI,OAAO,CAItC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAOnC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAOvC;AAED,wBAAgB,UAAU,IAAI,IAAI,CAOjC;AAID,wBAAgB,aAAa,IAAI,IAAI,CAOpC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/utils/permissions.js

@@ -10,40 +10,36 @@ import { getDelegatedAuth } from './request-context.js';
  * Tier AI – NOW_ASSIST_ENABLED=true (generative AI tools)
  * Tier ATF – ATF_ENABLED=true (test execution)
  *
- * Source of truth: process.env by default. When a request runs under a
- * delegated-auth context (DELEGATED_AUTH mode, e.g. behind NowAIKit Gateway),
- * the per-user policy on that context takes precedence — so capability is
- * governed per user/request, not per server.
+ * Source of truth: process.env sets the server's capability CEILING. When a request
+ * runs under a delegated-auth context (DELEGATED_AUTH mode, e.g. behind a trusted
+ * gateway), the per-user policy can only NARROW that ceiling, never widen it — a
+ * forged/over-permissive delegated flag can never enable a tier the operator left
+ * disabled. So the effective capability is (env AND delegated).
  */
 export function isWriteEnabled() {
+    const env = process.env.WRITE_ENABLED === 'true';
     const d = getDelegatedAuth();
-    if (d)
-        return d.flags?.write === true;
-    return process.env.WRITE_ENABLED === 'true';
+    return d ? env && d.flags?.write === true : env;
 }
 export function isCmdbWriteEnabled() {
+    const env = process.env.WRITE_ENABLED === 'true' && process.env.CMDB_WRITE_ENABLED === 'true';
     const d = getDelegatedAuth();
-    if (d)
-        return d.flags?.write === true && d.flags?.cmdbWrite === true;
-    return process.env.WRITE_ENABLED === 'true' && process.env.CMDB_WRITE_ENABLED === 'true';
+    return d ? env && d.flags?.write === true && d.flags?.cmdbWrite === true : env;
 }
 export function isScriptingEnabled() {
+    const env = process.env.WRITE_ENABLED === 'true' && process.env.SCRIPTING_ENABLED === 'true';
     const d = getDelegatedAuth();
-    if (d)
-        return d.flags?.write === true && d.flags?.scripting === true;
-    return process.env.WRITE_ENABLED === 'true' && process.env.SCRIPTING_ENABLED === 'true';
+    return d ? env && d.flags?.write === true && d.flags?.scripting === true : env;
 }
 export function isNowAssistEnabled() {
+    const env = process.env.NOW_ASSIST_ENABLED === 'true';
     const d = getDelegatedAuth();
-    if (d)
-        return d.flags?.nowAssist === true;
-    return process.env.NOW_ASSIST_ENABLED === 'true';
+    return d ? env && d.flags?.nowAssist === true : env;
 }
 export function isAtfEnabled() {
+    const env = process.env.ATF_ENABLED === 'true';
     const d = getDelegatedAuth();
-    if (d)
-        return d.flags?.atf === true;
-    return process.env.ATF_ENABLED === 'true';
+    return d ? env && d.flags?.atf === true : env;
 }
 export function requireWrite() {
     if (!isWriteEnabled()) {

package/dist/utils/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACrE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACrE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,kEAAkE,EAClE,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,mGAAmG,EACnG,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,iGAAiG,EACjG,uBAAuB,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,+EAA+E,EAC/E,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iEAAiE,EACjE,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,wCAAwC;AACxC,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,4EAA4E,EAC5E,oBAAoB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/utils/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC;IACjD,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;IAC9F,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;IAC7F,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;IACtD,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC;IAC/C,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,kEAAkE,EAClE,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,mGAAmG,EACnG,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,YAAY,EAAE,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,iGAAiG,EACjG,uBAAuB,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,+EAA+E,EAC/E,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,iEAAiE,EACjE,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,wCAAwC;AACxC,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CACvB,4EAA4E,EAC5E,oBAAoB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC"}

package/dist/utils/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID,oDAAoD;AACpD,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE1E;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAE5D;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,aAAa,CAmBf"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAID,oDAAoD;AACpD,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE1E;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,IAAI,aAAa,GAAG,SAAS,CAE5D;AAkBD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,aAAa,CAwBf"}

package/dist/utils/request-context.js

@@ -12,6 +12,7 @@
  * identical to before (env-var driven).
  */
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { timingSafeEqual } from 'node:crypto';
 const store = new AsyncLocalStorage();
 /** True when delegated-auth mode is switched on. */
 export function isDelegatedAuthEnabled() {
@@ -25,12 +26,33 @@ export function runWithDelegatedAuth(ctx, fn) {
 export function getDelegatedAuth() {
     return store.getStore();
 }
+/**
+ * When NOWAIKIT_DELEGATED_SECRET is set, delegated-auth headers are only trusted if the
+ * request carries a matching x-nowaikit-gateway-secret (constant-time compared). This
+ * proves the request came from the trusted gateway and not from a client forging its own
+ * permission flags. If the secret is unset, behaviour is unchanged (back-compat), and the
+ * permission tiers still cap every delegated flag to the server's env ceiling.
+ */
+function gatewaySecretOk(get) {
+    const expected = process.env.NOWAIKIT_DELEGATED_SECRET;
+    if (!expected)
+        return true;
+    const got = get('x-nowaikit-gateway-secret') || '';
+    const a = Buffer.from(got);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
 /** Build a delegated-auth context from inbound (lowercased) HTTP headers. */
 export function parseDelegatedAuthHeaders(headers) {
     const h = (k) => {
         const v = headers[k];
         return Array.isArray(v) ? v[0] : v;
     };
+    // Fail closed: a request without the gateway secret gets no token and no flags, so it
+    // can neither reach ServiceNow as a delegated user nor self-assert a capability tier.
+    if (!gatewaySecretOk(h)) {
+        return { flags: {} };
+    }
     const bool = (k) => h(k) === 'true';
     return {
         bearerToken: h('x-servicenow-token'),

package/dist/utils/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAuBrD,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAErD,oDAAoD;AACpD,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAI,GAAkB,EAAE,EAAW;IACrE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,OAAsD;IAEtD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,oBAAoB,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,2BAA2B,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,IAAI,CAAC,0BAA0B,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,8BAA8B,CAAC;YAC/C,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;SACjD;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/utils/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAuB9C,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAErD,oDAAoD;AACpD,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAI,GAAkB,EAAE,EAAW;IACrE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAsC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,OAAsD;IAEtD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,sFAAsF;IACtF,sFAAsF;IACtF,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,oBAAoB,CAAC;QACpC,WAAW,EAAE,CAAC,CAAC,2BAA2B,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,IAAI,CAAC,0BAA0B,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,8BAA8B,CAAC;YAC/C,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,+BAA+B,CAAC;SACjD;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nowaikit",
   "mcpName": "io.github.aartiq/nowaikit",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "The Most Comprehensive ServiceNow AI Toolkit — 450+ MCP tools + 26 AI capabilities (scan, review, build, ops, docs) + direct BYOK mode. Integrates with Claude, ChatGPT, Gemini, Cursor, GitHub Copilot and any LLM.",
   "main": "dist/server.js",
   "types": "dist/server.d.ts",