robotrock 0.9.0 → 1.1.0

package/dist/eve/tools/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tools/identity/my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return {\n          authenticated: false as const,\n          message:\n            \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n        };\n      }\n\n      return {\n        authenticated: true as const,\n        userId: caller.userId,\n        name: caller.name,\n        email: caller.email,\n        tenantSlug: caller.tenantSlug,\n        role: caller.role,\n        isAdmin: caller.isAdmin,\n        groups: caller.groups.map((slug) => ({ slug })),\n        ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n        sessionId: ctx.session.id,\n      };\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return {\n          authenticated: false as const,\n          message:\n            \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n        };\n      }\n\n      return {\n        authenticated: true as const,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n        tenantSlug: caller.tenantSlug,\n      };\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACfO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;AFjDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IACF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,eAAe;AAAA,UACf,SACE;AAAA,QACJ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,MAAM,OAAO;AAAA,QACb,OAAO,OAAO;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,QAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,WAAW,IAAI,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;;;AGvC3C,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,KAAAC,UAAS;AAIX,IAAM,sBAAsB;AAE5B,IAAM,sBAAsBC,GAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAOC,YAAW;AAAA,IAChB,aACE;AAAA,IACF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,eAAe;AAAA,UACf,SACE;AAAA,QACJ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,eAAe;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,QACd,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":["defineTool","z","z","defineTool"]}

package/dist/eve/tools/identity/my-access.d.ts

@@ -0,0 +1,58 @@
+import * as eve_tools from 'eve/tools';
+import { T as TenantRole } from '../../../tenant-5YKDrdC-.js';
+import { z } from 'zod';
+import 'eve/context';
+
+/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */
+declare const MY_ACCESS_TOOL_NAME = "get_my_access";
+declare const myAccessInputSchema: z.ZodObject<{}, z.core.$strip>;
+declare function defineMyAccessTool(): eve_tools.ToolDefinition<Record<string, never>, {
+    authenticated: false;
+    message: string;
+    tenantRole?: undefined;
+    isTenantAdmin?: undefined;
+    groupSlugs?: undefined;
+    capabilities?: undefined;
+    email?: undefined;
+    tenantSlug?: undefined;
+} | {
+    authenticated: true;
+    tenantRole: TenantRole;
+    isTenantAdmin: boolean;
+    groupSlugs: string[];
+    capabilities: {
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+    email: string;
+    tenantSlug: string;
+    message?: undefined;
+}>;
+declare const myAccessTool: eve_tools.ToolDefinition<Record<string, never>, {
+    authenticated: false;
+    message: string;
+    tenantRole?: undefined;
+    isTenantAdmin?: undefined;
+    groupSlugs?: undefined;
+    capabilities?: undefined;
+    email?: undefined;
+    tenantSlug?: undefined;
+} | {
+    authenticated: true;
+    tenantRole: TenantRole;
+    isTenantAdmin: boolean;
+    groupSlugs: string[];
+    capabilities: {
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+    email: string;
+    tenantSlug: string;
+    message?: undefined;
+}>;
+
+export { MY_ACCESS_TOOL_NAME, defineMyAccessTool, myAccessInputSchema, myAccessTool };

package/dist/eve/tools/identity/my-access.js

@@ -0,0 +1,106 @@
+// src/eve/tools/identity/my-access.ts
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+
+// src/eve/agent/attributes.ts
+function readStringAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function readStringArrayAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+  }
+  return [];
+}
+function parseTenantRole(value) {
+  if (value === "admin" || value === "member") {
+    return value;
+  }
+  return null;
+}
+
+// src/eve/agent/tenant.ts
+function tryResolveTenantCaller(ctx) {
+  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;
+  if (caller?.principalType !== "user") {
+    return null;
+  }
+  const email = readStringAttribute(caller.attributes, "email");
+  const name = readStringAttribute(caller.attributes, "name");
+  const tenantSlug = readStringAttribute(caller.attributes, "tenantSlug") ?? readStringAttribute(caller.attributes, "tenantId");
+  const role = parseTenantRole(readStringAttribute(caller.attributes, "role"));
+  if (!email || !tenantSlug || !caller.principalId || !role) {
+    return null;
+  }
+  const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
+  const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const groups = readStringArrayAttribute(caller.attributes, "groups");
+  return {
+    userId: caller.principalId,
+    email,
+    name: name ?? email.split("@")[0] ?? email,
+    tenantSlug,
+    ...connectionId ? { connectionId } : {},
+    role,
+    isAdmin: role === "admin",
+    groups,
+    ...workosUserId ? { workosUserId } : {}
+  };
+}
+
+// src/eve/tools/identity/my-access.ts
+var MY_ACCESS_TOOL_NAME = "get_my_access";
+var myAccessInputSchema = z.object({});
+function tenantCapabilities(isAdmin) {
+  return {
+    manageSettings: isAdmin,
+    manageBilling: isAdmin,
+    manageTeam: isAdmin,
+    manageIntegrations: isAdmin
+  };
+}
+function defineMyAccessTool() {
+  return defineTool({
+    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock.",
+    inputSchema: myAccessInputSchema,
+    async execute(_input, ctx) {
+      const caller = tryResolveTenantCaller(ctx);
+      if (!caller) {
+        return {
+          authenticated: false,
+          message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
+        };
+      }
+      return {
+        authenticated: true,
+        tenantRole: caller.role,
+        isTenantAdmin: caller.isAdmin,
+        groupSlugs: caller.groups,
+        capabilities: tenantCapabilities(caller.isAdmin),
+        email: caller.email,
+        tenantSlug: caller.tenantSlug
+      };
+    }
+  });
+}
+var myAccessTool = defineMyAccessTool();
+export {
+  MY_ACCESS_TOOL_NAME,
+  defineMyAccessTool,
+  myAccessInputSchema,
+  myAccessTool
+};
+//# sourceMappingURL=my-access.js.map

package/dist/eve/tools/identity/my-access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return {\n          authenticated: false as const,\n          message:\n            \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n        };\n      }\n\n      return {\n        authenticated: true as const,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n        tenantSlug: caller.tenantSlug,\n      };\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACfO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;AFhDO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IACF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,eAAe;AAAA,UACf,SACE;AAAA,QACJ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,eAAe;AAAA,QACf,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,QACd,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":[]}

package/dist/eve/tools/identity/whoami.d.ts

@@ -0,0 +1,45 @@
+import * as eve_tools from 'eve/tools';
+import { T as TenantRole } from '../../../tenant-5YKDrdC-.js';
+import { z } from 'zod';
+import 'eve/context';
+
+declare const WHOAMI_TOOL_NAME = "whoami";
+declare const whoamiInputSchema: z.ZodObject<{}, z.core.$strip>;
+declare function defineWhoamiTool(): eve_tools.ToolDefinition<Record<string, never>, {
+    authenticated: false;
+    message: string;
+} | {
+    sessionId: string;
+    workosUserId?: string | undefined;
+    authenticated: true;
+    userId: string;
+    name: string;
+    email: string;
+    tenantSlug: string;
+    role: TenantRole;
+    isAdmin: boolean;
+    groups: {
+        slug: string;
+    }[];
+    message?: undefined;
+}>;
+declare const whoamiTool: eve_tools.ToolDefinition<Record<string, never>, {
+    authenticated: false;
+    message: string;
+} | {
+    sessionId: string;
+    workosUserId?: string | undefined;
+    authenticated: true;
+    userId: string;
+    name: string;
+    email: string;
+    tenantSlug: string;
+    role: TenantRole;
+    isAdmin: boolean;
+    groups: {
+        slug: string;
+    }[];
+    message?: undefined;
+}>;
+
+export { WHOAMI_TOOL_NAME, defineWhoamiTool, whoamiInputSchema, whoamiTool };

package/dist/eve/tools/identity/whoami.js

@@ -0,0 +1,101 @@
+// src/eve/tools/identity/whoami.ts
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+
+// src/eve/agent/attributes.ts
+function readStringAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function readStringArrayAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+  }
+  return [];
+}
+function parseTenantRole(value) {
+  if (value === "admin" || value === "member") {
+    return value;
+  }
+  return null;
+}
+
+// src/eve/agent/tenant.ts
+function tryResolveTenantCaller(ctx) {
+  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;
+  if (caller?.principalType !== "user") {
+    return null;
+  }
+  const email = readStringAttribute(caller.attributes, "email");
+  const name = readStringAttribute(caller.attributes, "name");
+  const tenantSlug = readStringAttribute(caller.attributes, "tenantSlug") ?? readStringAttribute(caller.attributes, "tenantId");
+  const role = parseTenantRole(readStringAttribute(caller.attributes, "role"));
+  if (!email || !tenantSlug || !caller.principalId || !role) {
+    return null;
+  }
+  const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
+  const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const groups = readStringArrayAttribute(caller.attributes, "groups");
+  return {
+    userId: caller.principalId,
+    email,
+    name: name ?? email.split("@")[0] ?? email,
+    tenantSlug,
+    ...connectionId ? { connectionId } : {},
+    role,
+    isAdmin: role === "admin",
+    groups,
+    ...workosUserId ? { workosUserId } : {}
+  };
+}
+
+// src/eve/tools/identity/whoami.ts
+var WHOAMI_TOOL_NAME = "whoami";
+var whoamiInputSchema = z.object({});
+function defineWhoamiTool() {
+  return defineTool({
+    description: "Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session.",
+    inputSchema: whoamiInputSchema,
+    async execute(_input, ctx) {
+      const caller = tryResolveTenantCaller(ctx);
+      if (!caller) {
+        return {
+          authenticated: false,
+          message: "No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy."
+        };
+      }
+      return {
+        authenticated: true,
+        userId: caller.userId,
+        name: caller.name,
+        email: caller.email,
+        tenantSlug: caller.tenantSlug,
+        role: caller.role,
+        isAdmin: caller.isAdmin,
+        groups: caller.groups.map((slug) => ({ slug })),
+        ...caller.workosUserId ? { workosUserId: caller.workosUserId } : {},
+        sessionId: ctx.session.id
+      };
+    }
+  });
+}
+var whoamiTool = defineWhoamiTool();
+export {
+  WHOAMI_TOOL_NAME,
+  defineWhoamiTool,
+  whoamiInputSchema,
+  whoamiTool
+};
+//# sourceMappingURL=whoami.js.map

package/dist/eve/tools/identity/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return {\n          authenticated: false as const,\n          message:\n            \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n        };\n      }\n\n      return {\n        authenticated: true as const,\n        userId: caller.userId,\n        name: caller.name,\n        email: caller.email,\n        tenantSlug: caller.tenantSlug,\n        role: caller.role,\n        isAdmin: caller.isAdmin,\n        groups: caller.groups.map((slug) => ({ slug })),\n        ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n        sessionId: ctx.session.id,\n      };\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACfO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;AFjDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IACF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL,eAAe;AAAA,UACf,SACE;AAAA,QACJ;AAAA,MACF;AAEA,aAAO;AAAA,QACL,eAAe;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,MAAM,OAAO;AAAA,QACb,OAAO,OAAO;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,QAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,QACnE,WAAW,IAAI,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;","names":[]}

package/dist/eve/tools/inbox/create-task.d.ts

@@ -0,0 +1,113 @@
+import * as eve_tools from 'eve/tools';
+import { z } from 'zod';
+import { a as TenantCaller } from '../../../tenant-5YKDrdC-.js';
+import 'eve/context';
+
+/** Eve tool slug — must match the agent tool filename `create_robotrock_task.ts`. */
+declare const CREATE_INBOX_TASK_TOOL_NAME = "create_robotrock_task";
+declare const createInboxTaskInputSchema: z.ZodObject<{
+    type: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    actions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    assignTo: z.ZodOptional<z.ZodObject<{
+        users: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    context: z.ZodOptional<z.ZodObject<{
+        data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        ui: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    validUntilHours: z.ZodOptional<z.ZodNumber>;
+    priority: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        normal: "normal";
+        high: "high";
+        urgent: "urgent";
+    }>>;
+    updateMessage: z.ZodOptional<z.ZodString>;
+    delegationReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type CreateInboxTaskToolInput = z.infer<typeof createInboxTaskInputSchema>;
+type DefineCreateInboxTaskToolOptions = {
+    defaultApp?: string;
+    resolveDelegationReason?: (input: CreateInboxTaskToolInput, caller: TenantCaller) => string | undefined;
+};
+declare function defineCreateInboxTaskTool(options?: DefineCreateInboxTaskToolOptions): eve_tools.ToolDefinition<{
+    type: string;
+    name: string;
+    actions: {
+        id: string;
+        title: string;
+        description?: string | undefined;
+    }[];
+    description?: string | undefined;
+    assignTo?: {
+        users?: string[] | undefined;
+        groups?: string[] | undefined;
+    } | undefined;
+    context?: {
+        data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
+    } | undefined;
+    validUntilHours?: number | undefined;
+    priority?: "low" | "normal" | "high" | "urgent" | undefined;
+    updateMessage?: string | undefined;
+    delegationReason?: string | undefined;
+}, {
+    name: string;
+    assignedTo: {
+        users?: string[] | undefined;
+        groups?: string[] | undefined;
+    } | null;
+    requestedBy: string;
+    delegationReason: string | null;
+    message: string;
+    taskId: string;
+    threadId: string;
+    status: "pending" | "open";
+    validUntil: string;
+    submittedAt: string;
+}>;
+declare const createInboxTaskTool: eve_tools.ToolDefinition<{
+    type: string;
+    name: string;
+    actions: {
+        id: string;
+        title: string;
+        description?: string | undefined;
+    }[];
+    description?: string | undefined;
+    assignTo?: {
+        users?: string[] | undefined;
+        groups?: string[] | undefined;
+    } | undefined;
+    context?: {
+        data?: Record<string, unknown> | undefined;
+        ui?: Record<string, unknown> | undefined;
+    } | undefined;
+    validUntilHours?: number | undefined;
+    priority?: "low" | "normal" | "high" | "urgent" | undefined;
+    updateMessage?: string | undefined;
+    delegationReason?: string | undefined;
+}, {
+    name: string;
+    assignedTo: {
+        users?: string[] | undefined;
+        groups?: string[] | undefined;
+    } | null;
+    requestedBy: string;
+    delegationReason: string | null;
+    message: string;
+    taskId: string;
+    threadId: string;
+    status: "pending" | "open";
+    validUntil: string;
+    submittedAt: string;
+}>;
+
+export { CREATE_INBOX_TASK_TOOL_NAME, type CreateInboxTaskToolInput, type DefineCreateInboxTaskToolOptions, createInboxTaskInputSchema, createInboxTaskTool, defineCreateInboxTaskTool };