robotrock 1.3.2 → 1.3.4

package/dist/eve/tools/catalog/search-products.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/catalog/search-products.ts","../../../../src/eve/tool-result-display.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { toolDisplayResult } from \"../../tool-result-display.js\";\nimport {\n  SEARCH_PRODUCTS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const SEARCH_PRODUCTS_TOOL_NAME = \"search_products\";\n\nexport const searchProductsInputSchema = z.object({\n  query: z.string().min(1).describe(\"Product name or SKU to search for.\"),\n});\n\nconst DEMO_PRODUCTS = [\n  {\n    id: \"sku-1001\",\n    name: \"Wireless Keyboard\",\n    price: 79.99,\n    currency: \"USD\",\n    inStock: true,\n  },\n  {\n    id: \"sku-2042\",\n    name: \"USB-C Hub\",\n    price: 45.99,\n    currency: \"USD\",\n    inStock: true,\n  },\n  {\n    id: \"sku-3308\",\n    name: \"Monitor Stand\",\n    price: 129.99,\n    currency: \"USD\",\n    inStock: false,\n  },\n] as const;\n\nexport function defineSearchProductsTool() {\n  return defineTool({\n    description:\n      \"Search the product catalog and return matching items with rich list UI. \" +\n      \"Results render as a product list card — do not restate product names, prices, or SKUs in your reply.\",\n    inputSchema: searchProductsInputSchema,\n    async execute({ query }) {\n      const normalized = query.trim().toLowerCase();\n      const items = DEMO_PRODUCTS.filter(\n        (product) =>\n          product.name.toLowerCase().includes(normalized) ||\n          product.id.toLowerCase().includes(normalized)\n      );\n\n      return withReplyGuidance(\n        toolDisplayResult(\n          { items: [...items] },\n          {\n            title: items.length === 1 ? \"1 product\" : `${items.length} products`,\n            ui: {\n              items: {\n                \"ui:widget\": \"list\",\n                \"ui:title\": \"Results\",\n                items: {\n                  \"ui:widget\": \"productInfo\",\n                },\n              },\n            },\n          }\n        ),\n        SEARCH_PRODUCTS_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const searchProductsTool = defineSearchProductsTool();\n","import type {\n  ToolDisplayEnvelope,\n  ToolDisplayMetadata,\n  UiSchema,\n} from \"@robotrock/core/schemas\";\n\nexport type ToolDisplayResultOptions = {\n  widget?: string;\n  title?: string;\n  description?: string;\n  ui?: Record<string, UiSchema>;\n};\n\n/**\n * Wrap tool execute output with optional dashboard display hints.\n * Agents return plain JSON by default; use this when schema-driven widgets help.\n */\nexport function toolDisplayResult<T extends Record<string, unknown>>(\n  data: T,\n  options?: ToolDisplayResultOptions\n): ToolDisplayEnvelope<T> {\n  const display: ToolDisplayMetadata | undefined =\n    options?.widget || options?.title || options?.description\n      ? {\n          ...(options.widget ? { widget: options.widget } : {}),\n          ...(options.title ? { title: options.title } : {}),\n          ...(options.description ? { description: options.description } : {}),\n        }\n      : undefined;\n\n  return {\n    ...(display ? { display } : {}),\n    data,\n    ...(options?.ui ? { ui: options.ui } : {}),\n  };\n}\n","/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACgBX,SAAS,kBACd,MACA,SACwB;AACxB,QAAM,UACJ,SAAS,UAAU,SAAS,SAAS,SAAS,cAC1C;AAAA,IACE,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACnD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE,IACA;AAEN,SAAO;AAAA,IACL,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B;AAAA,IACA,GAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC;AAAA,EAC1C;AACF;;;AClCO,IAAM,4BAA4B;AAWlC,IAAM,iCACX;AAwCK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AFrDO,IAAM,4BAA4B;AAElC,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,oCAAoC;AACxE,CAAC;AAED,IAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AACF;AAEO,SAAS,2BAA2B;AACzC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,EAAE,MAAM,GAAG;AACvB,YAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,YAAM,QAAQ,cAAc;AAAA,QAC1B,CAAC,YACC,QAAQ,KAAK,YAAY,EAAE,SAAS,UAAU,KAC9C,QAAQ,GAAG,YAAY,EAAE,SAAS,UAAU;AAAA,MAChD;AAEA,aAAO;AAAA,QACL;AAAA,UACE,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE;AAAA,UACpB;AAAA,YACE,OAAO,MAAM,WAAW,IAAI,cAAc,GAAG,MAAM,MAAM;AAAA,YACzD,IAAI;AAAA,cACF,OAAO;AAAA,gBACL,aAAa;AAAA,gBACb,YAAY;AAAA,gBACZ,OAAO;AAAA,kBACL,aAAa;AAAA,gBACf;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,qBAAqB,yBAAyB;","names":[]}
+{"version":3,"sources":["../../../../src/eve/tools/catalog/search-products.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport {\n  SEARCH_PRODUCTS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const SEARCH_PRODUCTS_TOOL_NAME = \"search_products\";\n\nexport const searchProductsInputSchema = z.object({\n  query: z.string().min(1).describe(\"Product name or SKU to search for.\"),\n});\n\nconst DEMO_PRODUCTS = [\n  {\n    id: \"sku-1001\",\n    name: \"Wireless Keyboard\",\n    price: 79.99,\n    currency: \"USD\",\n    inStock: true,\n  },\n  {\n    id: \"sku-2042\",\n    name: \"USB-C Hub\",\n    price: 45.99,\n    currency: \"USD\",\n    inStock: true,\n  },\n  {\n    id: \"sku-3308\",\n    name: \"Monitor Stand\",\n    price: 129.99,\n    currency: \"USD\",\n    inStock: false,\n  },\n] as const;\n\nexport function defineSearchProductsTool() {\n  return defineTool({\n    description:\n      \"Search the product catalog and return matching items. \" +\n      \"Results render in chat UI — do not restate product names, prices, or SKUs in your reply.\",\n    inputSchema: searchProductsInputSchema,\n    async execute({ query }) {\n      const normalized = query.trim().toLowerCase();\n      const items = DEMO_PRODUCTS.filter(\n        (product) =>\n          product.name.toLowerCase().includes(normalized) ||\n          product.id.toLowerCase().includes(normalized)\n      );\n\n      return withReplyGuidance({ items: [...items] }, SEARCH_PRODUCTS_REPLY_GUIDANCE);\n    },\n  });\n}\n\nexport const searchProductsTool = defineSearchProductsTool();\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACEX,IAAM,4BAA4B;AAWlC,IAAM,iCACX;AAwCK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;ADxDO,IAAM,4BAA4B;AAElC,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,oCAAoC;AACxE,CAAC;AAED,IAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,IACP,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AACF;AAEO,SAAS,2BAA2B;AACzC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,EAAE,MAAM,GAAG;AACvB,YAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,YAAM,QAAQ,cAAc;AAAA,QAC1B,CAAC,YACC,QAAQ,KAAK,YAAY,EAAE,SAAS,UAAU,KAC9C,QAAQ,GAAG,YAAY,EAAE,SAAS,UAAU;AAAA,MAChD;AAEA,aAAO,kBAAkB,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,8BAA8B;AAAA,IAChF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,qBAAqB,yBAAyB;","names":[]}

package/dist/eve/tools/identity/index.d.ts

@@ -5,4 +5,3 @@ import '../../../tenant-DmN0MMyC.js';
 import 'eve/context';
 import '../../../tool-reply-guidance-C3qrT1In.js';
 import 'zod';
-import '@robotrock/core';

package/dist/eve/tools/identity/index.js

@@ -63,6 +63,15 @@ function tryResolveTenantCaller(ctx) {
   };
 }
 
+// src/eve/tool-ui-hint.ts
+var TOOL_UI_HINT_FIELD = "uiHint";
+function withUiHint(result, hint) {
+  return {
+    ...result,
+    [TOOL_UI_HINT_FIELD]: hint
+  };
+}
+
 // src/eve/tool-reply-guidance.ts
 var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
 var WHOAMI_REPLY_GUIDANCE = "The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).";
@@ -116,47 +125,16 @@ var whoamiTool = defineWhoamiTool();
 import { defineTool as defineTool2 } from "eve/tools";
 import { z as z2 } from "zod";
 
-// src/eve/tool-result-display.ts
-function toolDisplayResult(data, options) {
-  const display = options?.widget || options?.title || options?.description ? {
-    ...options.widget ? { widget: options.widget } : {},
-    ...options.title ? { title: options.title } : {},
-    ...options.description ? { description: options.description } : {}
-  } : void 0;
-  return {
-    ...display ? { display } : {},
-    data,
-    ...options?.ui ? { ui: options.ui } : {}
-  };
-}
-
 // src/eve/tool-display-format.ts
 function formatToolObjectResult(data, options) {
-  return withReplyGuidance(
-    toolDisplayResult(data, {
-      title: options.title,
-      description: options.description,
-      ui: options.ui
-    }),
-    options.replyGuidance
-  );
+  const withGuidance = withReplyGuidance(data, options.replyGuidance);
+  if (options.uiHint) {
+    return withUiHint(withGuidance, options.uiHint);
+  }
+  return withGuidance;
 }
 
 // src/eve/tools/identity/format-my-access.ts
-var ACCESS_FIELD_UI = {
-  workspace: { "ui:title": "Workspace" },
-  role: { "ui:title": "Role" },
-  tenantAdmin: { "ui:title": "Tenant admin", "ui:widget": "boolean" },
-  groups: { "ui:title": "Groups" },
-  manageSettings: { "ui:title": "Manage settings", "ui:widget": "boolean" },
-  manageBilling: { "ui:title": "Manage billing", "ui:widget": "boolean" },
-  manageTeam: { "ui:title": "Manage team", "ui:widget": "boolean" },
-  manageIntegrations: {
-    "ui:title": "Manage integrations",
-    "ui:widget": "boolean"
-  },
-  email: { "ui:title": "Email" }
-};
 function formatMyAccessResult(input) {
   return formatToolObjectResult(
     {
@@ -173,13 +151,6 @@ function formatMyAccessResult(input) {
       }
     },
     {
-      ui: {
-        access: {
-          "ui:widget": "access",
-          "ui:title": "Your access",
-          items: ACCESS_FIELD_UI
-        }
-      },
       replyGuidance: MY_ACCESS_REPLY_GUIDANCE
     }
   );
@@ -198,7 +169,7 @@ function tenantCapabilities(isAdmin) {
 }
 function defineMyAccessTool() {
   return defineTool2({
-    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Results render as an access card in chat \u2014 do not restate role, groups, or capabilities in your reply.",
+    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn \u2014 including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; do not restate role, groups, or capabilities in your reply.",
     inputSchema: myAccessInputSchema,
     async execute(_input, ctx) {
       const caller = tryResolveTenantCaller(ctx);

package/dist/eve/tools/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/tool-result-display.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  return record;\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Results render as an access card in chat — do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","import type {\n  ToolDisplayEnvelope,\n  ToolDisplayMetadata,\n  UiSchema,\n} from \"@robotrock/core/schemas\";\n\nexport type ToolDisplayResultOptions = {\n  widget?: string;\n  title?: string;\n  description?: string;\n  ui?: Record<string, UiSchema>;\n};\n\n/**\n * Wrap tool execute output with optional dashboard display hints.\n * Agents return plain JSON by default; use this when schema-driven widgets help.\n */\nexport function toolDisplayResult<T extends Record<string, unknown>>(\n  data: T,\n  options?: ToolDisplayResultOptions\n): ToolDisplayEnvelope<T> {\n  const display: ToolDisplayMetadata | undefined =\n    options?.widget || options?.title || options?.description\n      ? {\n          ...(options.widget ? { widget: options.widget } : {}),\n          ...(options.title ? { title: options.title } : {}),\n          ...(options.description ? { description: options.description } : {}),\n        }\n      : undefined;\n\n  return {\n    ...(display ? { display } : {}),\n    data,\n    ...(options?.ui ? { ui: options.ui } : {}),\n  };\n}\n","import type { UiSchema } from \"@robotrock/core/schemas\";\nimport { toolDisplayResult } from \"./tool-result-display.js\";\nimport { withReplyGuidance } from \"./tool-reply-guidance.js\";\n\nexport type FormatToolObjectResultOptions = {\n  title?: string;\n  description?: string;\n  ui?: Record<string, UiSchema>;\n  replyGuidance: string;\n};\n\nexport type FormatToolListResultOptions = {\n  title: string;\n  itemUi?: UiSchema;\n  /** Composite widget for each row (uses list layout instead of table). */\n  itemWidget?: string;\n  replyGuidance: string;\n};\n\n/** Wrap a flat object for schema-driven chat rendering. */\nexport function formatToolObjectResult(\n  data: Record<string, unknown>,\n  options: FormatToolObjectResultOptions\n) {\n  return withReplyGuidance(\n    toolDisplayResult(data, {\n      title: options.title,\n      description: options.description,\n      ui: options.ui,\n    }),\n    options.replyGuidance\n  );\n}\n\n/** Wrap an array field as a list widget inside a display envelope. */\nexport function formatToolListResult(\n  listKey: string,\n  items: Record<string, unknown>[],\n  options: FormatToolListResultOptions\n) {\n  const listFieldUi = options.itemWidget\n    ? {\n        \"ui:widget\": \"list\" as const,\n        items: {\n          \"ui:widget\": options.itemWidget,\n          ...(options.itemUi ?? {}),\n        },\n      }\n    : {\n        \"ui:widget\": \"table\" as const,\n        ...(options.itemUi ? { items: options.itemUi } : {}),\n      };\n\n  return formatToolObjectResult(\n    { [listKey]: items },\n    {\n      title: options.title,\n      ui: {\n        [listKey]: listFieldUi,\n      },\n      replyGuidance: options.replyGuidance,\n    }\n  );\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nconst ACCESS_FIELD_UI = {\n  workspace: { \"ui:title\": \"Workspace\" },\n  role: { \"ui:title\": \"Role\" },\n  tenantAdmin: { \"ui:title\": \"Tenant admin\", \"ui:widget\": \"boolean\" },\n  groups: { \"ui:title\": \"Groups\" },\n  manageSettings: { \"ui:title\": \"Manage settings\", \"ui:widget\": \"boolean\" },\n  manageBilling: { \"ui:title\": \"Manage billing\", \"ui:widget\": \"boolean\" },\n  manageTeam: { \"ui:title\": \"Manage team\", \"ui:widget\": \"boolean\" },\n  manageIntegrations: {\n    \"ui:title\": \"Manage integrations\",\n    \"ui:widget\": \"boolean\",\n  },\n  email: { \"ui:title\": \"Email\" },\n} as const;\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      ui: {\n        access: {\n          \"ui:widget\": \"access\",\n          \"ui:title\": \"Your access\",\n          items: ACCESS_FIELD_UI,\n        },\n      },\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AAEK,IAAM,2BACX;AA8CK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AHrDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;;;AIlD3C,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,KAAAC,UAAS;;;ACgBX,SAAS,kBACd,MACA,SACwB;AACxB,QAAM,UACJ,SAAS,UAAU,SAAS,SAAS,SAAS,cAC1C;AAAA,IACE,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACnD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE,IACA;AAEN,SAAO;AAAA,IACL,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B;AAAA,IACA,GAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC;AAAA,EAC1C;AACF;;;ACfO,SAAS,uBACd,MACA,SACA;AACA,SAAO;AAAA,IACL,kBAAkB,MAAM;AAAA,MACtB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,IAAI,QAAQ;AAAA,IACd,CAAC;AAAA,IACD,QAAQ;AAAA,EACV;AACF;;;ACfA,IAAM,kBAAkB;AAAA,EACtB,WAAW,EAAE,YAAY,YAAY;AAAA,EACrC,MAAM,EAAE,YAAY,OAAO;AAAA,EAC3B,aAAa,EAAE,YAAY,gBAAgB,aAAa,UAAU;AAAA,EAClE,QAAQ,EAAE,YAAY,SAAS;AAAA,EAC/B,gBAAgB,EAAE,YAAY,mBAAmB,aAAa,UAAU;AAAA,EACxE,eAAe,EAAE,YAAY,kBAAkB,aAAa,UAAU;AAAA,EACtE,YAAY,EAAE,YAAY,eAAe,aAAa,UAAU;AAAA,EAChE,oBAAoB;AAAA,IAClB,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ;AAC/B;AAEO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,QACF,QAAQ;AAAA,UACN,aAAa;AAAA,UACb,YAAY;AAAA,UACZ,OAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;AHhDO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsBC,GAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAOC,YAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":["defineTool","z","z","defineTool"]}
+{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-ui-hint.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name for optional layout hints on tool execute results. */\nexport const TOOL_UI_HINT_FIELD = \"uiHint\" as const;\n\n/** Top-level layout hint for RobotRock TRL rendering. Optional — omit to let the dashboard infer. */\nexport type ToolUiHint = \"list\" | \"chart\" | \"table\";\n\nconst TOOL_UI_HINTS = new Set<ToolUiHint>([\"list\", \"chart\", \"table\"]);\n\nexport function isToolUiHint(value: unknown): value is ToolUiHint {\n  return typeof value === \"string\" && TOOL_UI_HINTS.has(value as ToolUiHint);\n}\n\n/** Attach an optional layout hint to a tool execute result. */\nexport function withUiHint<T extends Record<string, unknown>>(\n  result: T,\n  hint: ToolUiHint\n): T & { uiHint: ToolUiHint } {\n  return {\n    ...result,\n    [TOOL_UI_HINT_FIELD]: hint,\n  };\n}\n\n/** Read a validated layout hint from tool output; unknown values are ignored. */\nexport function extractToolUiHint(output: unknown): ToolUiHint | undefined {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return undefined;\n  }\n\n  const hint = (output as Record<string, unknown>)[TOOL_UI_HINT_FIELD];\n  return isToolUiHint(hint) ? hint : undefined;\n}\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n","import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn — \" +\n      \"including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; \" +\n      \"do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","import { withReplyGuidance } from \"./tool-reply-guidance.js\";\nimport { withUiHint, type ToolUiHint } from \"./tool-ui-hint.js\";\n\nexport type FormatToolObjectResultOptions = {\n  replyGuidance: string;\n  /** Optional layout hint for TRL rendering. Omit to let the dashboard infer. */\n  uiHint?: ToolUiHint;\n};\n\nexport type FormatToolListResultOptions = {\n  replyGuidance: string;\n};\n\n/** Attach agent narration hints to plain tool JSON. No display/ui envelope. */\nexport function formatToolObjectResult(\n  data: Record<string, unknown>,\n  options: FormatToolObjectResultOptions\n) {\n  const withGuidance = withReplyGuidance(data, options.replyGuidance);\n  if (options.uiHint) {\n    return withUiHint(withGuidance, options.uiHint);\n  }\n  return withGuidance;\n}\n\n/** Wrap an array field as plain tool JSON with reply guidance and list layout hint. */\nexport function formatToolListResult(\n  listKey: string,\n  items: Record<string, unknown>[],\n  options: FormatToolListResultOptions\n) {\n  return withUiHint(\n    withReplyGuidance({ [listKey]: items }, options.replyGuidance),\n    \"list\"\n  );\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,qBAAqB;AAY3B,SAAS,WACd,QACA,MAC4B;AAC5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,kBAAkB,GAAG;AAAA,EACxB;AACF;;;AClBO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AAEK,IAAM,2BACX;AA8CK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AJvDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;;;AKlD3C,SAAS,cAAAA,mBAAkB;AAC3B,SAAS,KAAAC,UAAS;;;ACaX,SAAS,uBACd,MACA,SACA;AACA,QAAM,eAAe,kBAAkB,MAAM,QAAQ,aAAa;AAClE,MAAI,QAAQ,QAAQ;AAClB,WAAO,WAAW,cAAc,QAAQ,MAAM;AAAA,EAChD;AACA,SAAO;AACT;;;ACNO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;AF1BO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsBC,GAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAOC,YAAW;AAAA,IAChB,aACE;AAAA,IAIF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":["defineTool","z","z","defineTool"]}

package/dist/eve/tools/identity/my-access.d.ts

@@ -1,5 +1,4 @@
 import * as eve_tools from 'eve/tools';
-import * as _robotrock_core from '@robotrock/core';
 import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-C3qrT1In.js';
 import { z } from 'zod';
 
@@ -9,10 +8,10 @@ declare const myAccessInputSchema: z.ZodObject<{}, z.core.$strip>;
 declare function defineMyAccessTool(): eve_tools.ToolDefinition<Record<string, never>, ToolResultWithReplyGuidance<{
     authenticated: false;
     message: string;
-}> | ToolResultWithReplyGuidance<_robotrock_core.ToolDisplayEnvelope<Record<string, unknown>>>>;
+}> | ToolResultWithReplyGuidance<Record<string, unknown>>>;
 declare const myAccessTool: eve_tools.ToolDefinition<Record<string, never>, ToolResultWithReplyGuidance<{
     authenticated: false;
     message: string;
-}> | ToolResultWithReplyGuidance<_robotrock_core.ToolDisplayEnvelope<Record<string, unknown>>>>;
+}> | ToolResultWithReplyGuidance<Record<string, unknown>>>;
 
 export { MY_ACCESS_TOOL_NAME, defineMyAccessTool, myAccessInputSchema, myAccessTool };

package/dist/eve/tools/identity/my-access.js

@@ -63,6 +63,15 @@ function tryResolveTenantCaller(ctx) {
   };
 }
 
+// src/eve/tool-ui-hint.ts
+var TOOL_UI_HINT_FIELD = "uiHint";
+function withUiHint(result, hint) {
+  return {
+    ...result,
+    [TOOL_UI_HINT_FIELD]: hint
+  };
+}
+
 // src/eve/tool-reply-guidance.ts
 var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
 var MY_ACCESS_REPLY_GUIDANCE = "Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds \u2265 $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins \u2014 do not tell them to find an admin manually without offering delegation first.";
@@ -73,47 +82,16 @@ function withReplyGuidance(result, guidance) {
   };
 }
 
-// src/eve/tool-result-display.ts
-function toolDisplayResult(data, options) {
-  const display = options?.widget || options?.title || options?.description ? {
-    ...options.widget ? { widget: options.widget } : {},
-    ...options.title ? { title: options.title } : {},
-    ...options.description ? { description: options.description } : {}
-  } : void 0;
-  return {
-    ...display ? { display } : {},
-    data,
-    ...options?.ui ? { ui: options.ui } : {}
-  };
-}
-
 // src/eve/tool-display-format.ts
 function formatToolObjectResult(data, options) {
-  return withReplyGuidance(
-    toolDisplayResult(data, {
-      title: options.title,
-      description: options.description,
-      ui: options.ui
-    }),
-    options.replyGuidance
-  );
+  const withGuidance = withReplyGuidance(data, options.replyGuidance);
+  if (options.uiHint) {
+    return withUiHint(withGuidance, options.uiHint);
+  }
+  return withGuidance;
 }
 
 // src/eve/tools/identity/format-my-access.ts
-var ACCESS_FIELD_UI = {
-  workspace: { "ui:title": "Workspace" },
-  role: { "ui:title": "Role" },
-  tenantAdmin: { "ui:title": "Tenant admin", "ui:widget": "boolean" },
-  groups: { "ui:title": "Groups" },
-  manageSettings: { "ui:title": "Manage settings", "ui:widget": "boolean" },
-  manageBilling: { "ui:title": "Manage billing", "ui:widget": "boolean" },
-  manageTeam: { "ui:title": "Manage team", "ui:widget": "boolean" },
-  manageIntegrations: {
-    "ui:title": "Manage integrations",
-    "ui:widget": "boolean"
-  },
-  email: { "ui:title": "Email" }
-};
 function formatMyAccessResult(input) {
   return formatToolObjectResult(
     {
@@ -130,13 +108,6 @@ function formatMyAccessResult(input) {
       }
     },
     {
-      ui: {
-        access: {
-          "ui:widget": "access",
-          "ui:title": "Your access",
-          items: ACCESS_FIELD_UI
-        }
-      },
       replyGuidance: MY_ACCESS_REPLY_GUIDANCE
     }
   );
@@ -155,7 +126,7 @@ function tenantCapabilities(isAdmin) {
 }
 function defineMyAccessTool() {
   return defineTool({
-    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Results render as an access card in chat \u2014 do not restate role, groups, or capabilities in your reply.",
+    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn \u2014 including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; do not restate role, groups, or capabilities in your reply.",
     inputSchema: myAccessInputSchema,
     async execute(_input, ctx) {
       const caller = tryResolveTenantCaller(ctx);

package/dist/eve/tools/identity/my-access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tool-result-display.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Results render as an access card in chat — do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  return record;\n}\n","import type {\n  ToolDisplayEnvelope,\n  ToolDisplayMetadata,\n  UiSchema,\n} from \"@robotrock/core/schemas\";\n\nexport type ToolDisplayResultOptions = {\n  widget?: string;\n  title?: string;\n  description?: string;\n  ui?: Record<string, UiSchema>;\n};\n\n/**\n * Wrap tool execute output with optional dashboard display hints.\n * Agents return plain JSON by default; use this when schema-driven widgets help.\n */\nexport function toolDisplayResult<T extends Record<string, unknown>>(\n  data: T,\n  options?: ToolDisplayResultOptions\n): ToolDisplayEnvelope<T> {\n  const display: ToolDisplayMetadata | undefined =\n    options?.widget || options?.title || options?.description\n      ? {\n          ...(options.widget ? { widget: options.widget } : {}),\n          ...(options.title ? { title: options.title } : {}),\n          ...(options.description ? { description: options.description } : {}),\n        }\n      : undefined;\n\n  return {\n    ...(display ? { display } : {}),\n    data,\n    ...(options?.ui ? { ui: options.ui } : {}),\n  };\n}\n","import type { UiSchema } from \"@robotrock/core/schemas\";\nimport { toolDisplayResult } from \"./tool-result-display.js\";\nimport { withReplyGuidance } from \"./tool-reply-guidance.js\";\n\nexport type FormatToolObjectResultOptions = {\n  title?: string;\n  description?: string;\n  ui?: Record<string, UiSchema>;\n  replyGuidance: string;\n};\n\nexport type FormatToolListResultOptions = {\n  title: string;\n  itemUi?: UiSchema;\n  /** Composite widget for each row (uses list layout instead of table). */\n  itemWidget?: string;\n  replyGuidance: string;\n};\n\n/** Wrap a flat object for schema-driven chat rendering. */\nexport function formatToolObjectResult(\n  data: Record<string, unknown>,\n  options: FormatToolObjectResultOptions\n) {\n  return withReplyGuidance(\n    toolDisplayResult(data, {\n      title: options.title,\n      description: options.description,\n      ui: options.ui,\n    }),\n    options.replyGuidance\n  );\n}\n\n/** Wrap an array field as a list widget inside a display envelope. */\nexport function formatToolListResult(\n  listKey: string,\n  items: Record<string, unknown>[],\n  options: FormatToolListResultOptions\n) {\n  const listFieldUi = options.itemWidget\n    ? {\n        \"ui:widget\": \"list\" as const,\n        items: {\n          \"ui:widget\": options.itemWidget,\n          ...(options.itemUi ?? {}),\n        },\n      }\n    : {\n        \"ui:widget\": \"table\" as const,\n        ...(options.itemUi ? { items: options.itemUi } : {}),\n      };\n\n  return formatToolObjectResult(\n    { [listKey]: items },\n    {\n      title: options.title,\n      ui: {\n        [listKey]: listFieldUi,\n      },\n      replyGuidance: options.replyGuidance,\n    }\n  );\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nconst ACCESS_FIELD_UI = {\n  workspace: { \"ui:title\": \"Workspace\" },\n  role: { \"ui:title\": \"Role\" },\n  tenantAdmin: { \"ui:title\": \"Tenant admin\", \"ui:widget\": \"boolean\" },\n  groups: { \"ui:title\": \"Groups\" },\n  manageSettings: { \"ui:title\": \"Manage settings\", \"ui:widget\": \"boolean\" },\n  manageBilling: { \"ui:title\": \"Manage billing\", \"ui:widget\": \"boolean\" },\n  manageTeam: { \"ui:title\": \"Manage team\", \"ui:widget\": \"boolean\" },\n  manageIntegrations: {\n    \"ui:title\": \"Manage integrations\",\n    \"ui:widget\": \"boolean\",\n  },\n  email: { \"ui:title\": \"Email\" },\n} as const;\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      ui: {\n        access: {\n          \"ui:widget\": \"access\",\n          \"ui:title\": \"Your access\",\n          items: ACCESS_FIELD_UI,\n        },\n      },\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,4BAA4B;AAKlC,IAAM,2BACX;AA8CK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AC5CO,SAAS,kBACd,MACA,SACwB;AACxB,QAAM,UACJ,SAAS,UAAU,SAAS,SAAS,SAAS,cAC1C;AAAA,IACE,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACnD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE,IACA;AAEN,SAAO;AAAA,IACL,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B;AAAA,IACA,GAAI,SAAS,KAAK,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC;AAAA,EAC1C;AACF;;;ACfO,SAAS,uBACd,MACA,SACA;AACA,SAAO;AAAA,IACL,kBAAkB,MAAM;AAAA,MACtB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,IAAI,QAAQ;AAAA,IACd,CAAC;AAAA,IACD,QAAQ;AAAA,EACV;AACF;;;ACfA,IAAM,kBAAkB;AAAA,EACtB,WAAW,EAAE,YAAY,YAAY;AAAA,EACrC,MAAM,EAAE,YAAY,OAAO;AAAA,EAC3B,aAAa,EAAE,YAAY,gBAAgB,aAAa,UAAU;AAAA,EAClE,QAAQ,EAAE,YAAY,SAAS;AAAA,EAC/B,gBAAgB,EAAE,YAAY,mBAAmB,aAAa,UAAU;AAAA,EACxE,eAAe,EAAE,YAAY,kBAAkB,aAAa,UAAU;AAAA,EACtE,YAAY,EAAE,YAAY,eAAe,aAAa,UAAU;AAAA,EAChE,oBAAoB;AAAA,IAClB,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AAAA,EACA,OAAO,EAAE,YAAY,QAAQ;AAC/B;AAEO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,QACF,QAAQ;AAAA,UACN,aAAa;AAAA,UACb,YAAY;AAAA,UACZ,OAAO;AAAA,QACT;AAAA,MACF;AAAA,MACA,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;ANhDO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":[]}
+{"version":3,"sources":["../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-ui-hint.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn — \" +\n      \"including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; \" +\n      \"do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name for optional layout hints on tool execute results. */\nexport const TOOL_UI_HINT_FIELD = \"uiHint\" as const;\n\n/** Top-level layout hint for RobotRock TRL rendering. Optional — omit to let the dashboard infer. */\nexport type ToolUiHint = \"list\" | \"chart\" | \"table\";\n\nconst TOOL_UI_HINTS = new Set<ToolUiHint>([\"list\", \"chart\", \"table\"]);\n\nexport function isToolUiHint(value: unknown): value is ToolUiHint {\n  return typeof value === \"string\" && TOOL_UI_HINTS.has(value as ToolUiHint);\n}\n\n/** Attach an optional layout hint to a tool execute result. */\nexport function withUiHint<T extends Record<string, unknown>>(\n  result: T,\n  hint: ToolUiHint\n): T & { uiHint: ToolUiHint } {\n  return {\n    ...result,\n    [TOOL_UI_HINT_FIELD]: hint,\n  };\n}\n\n/** Read a validated layout hint from tool output; unknown values are ignored. */\nexport function extractToolUiHint(output: unknown): ToolUiHint | undefined {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return undefined;\n  }\n\n  const hint = (output as Record<string, unknown>)[TOOL_UI_HINT_FIELD];\n  return isToolUiHint(hint) ? hint : undefined;\n}\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n","import { withReplyGuidance } from \"./tool-reply-guidance.js\";\nimport { withUiHint, type ToolUiHint } from \"./tool-ui-hint.js\";\n\nexport type FormatToolObjectResultOptions = {\n  replyGuidance: string;\n  /** Optional layout hint for TRL rendering. Omit to let the dashboard infer. */\n  uiHint?: ToolUiHint;\n};\n\nexport type FormatToolListResultOptions = {\n  replyGuidance: string;\n};\n\n/** Attach agent narration hints to plain tool JSON. No display/ui envelope. */\nexport function formatToolObjectResult(\n  data: Record<string, unknown>,\n  options: FormatToolObjectResultOptions\n) {\n  const withGuidance = withReplyGuidance(data, options.replyGuidance);\n  if (options.uiHint) {\n    return withUiHint(withGuidance, options.uiHint);\n  }\n  return withGuidance;\n}\n\n/** Wrap an array field as plain tool JSON with reply guidance and list layout hint. */\nexport function formatToolListResult(\n  listKey: string,\n  items: Record<string, unknown>[],\n  options: FormatToolListResultOptions\n) {\n  return withUiHint(\n    withReplyGuidance({ [listKey]: items }, options.replyGuidance),\n    \"list\"\n  );\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,qBAAqB;AAY3B,SAAS,WACd,QACA,MAC4B;AAC5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,kBAAkB,GAAG;AAAA,EACxB;AACF;;;AClBO,IAAM,4BAA4B;AAKlC,IAAM,2BACX;AA8CK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;ACjDO,SAAS,uBACd,MACA,SACA;AACA,QAAM,eAAe,kBAAkB,MAAM,QAAQ,aAAa;AAClE,MAAI,QAAQ,QAAQ;AAClB,WAAO,WAAW,cAAc,QAAQ,MAAM;AAAA,EAChD;AACA,SAAO;AACT;;;ACNO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;AN1BO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAIF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":[]}

package/dist/eve/tools/identity/whoami.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AAiDK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AHrDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;","names":[]}
+{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACrDO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AAiDK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AHvDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;","names":[]}