robotrock 1.3.4 → 1.5.0

package/dist/eve/tools/identity/my-access.d.ts

@@ -1,5 +1,6 @@
 import * as eve_tools from 'eve/tools';
-import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-C3qrT1In.js';
+import { T as ToolResultUiMeta, a as ToolUiHint } from '../../../tool-result-ui-meta-KT0VafEO.js';
+import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-CJko9liH.js';
 import { z } from 'zod';
 
 /** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */
@@ -8,10 +9,94 @@ declare const myAccessInputSchema: z.ZodObject<{}, z.core.$strip>;
 declare function defineMyAccessTool(): eve_tools.ToolDefinition<Record<string, never>, ToolResultWithReplyGuidance<{
     authenticated: false;
     message: string;
-}> | ToolResultWithReplyGuidance<Record<string, unknown>>>;
+}> | ({
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    replyGuidance: string;
+} & Partial<{
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    ui: ToolResultUiMeta;
+}> & Partial<{
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    uiHint: ToolUiHint;
+}>)>;
 declare const myAccessTool: eve_tools.ToolDefinition<Record<string, never>, ToolResultWithReplyGuidance<{
     authenticated: false;
     message: string;
-}> | ToolResultWithReplyGuidance<Record<string, unknown>>>;
+}> | ({
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    replyGuidance: string;
+} & Partial<{
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    ui: ToolResultUiMeta;
+}> & Partial<{
+    access: {
+        email?: string | undefined;
+        workspace: string;
+        role: string;
+        tenantAdmin: boolean;
+        groups: string;
+        manageSettings: boolean;
+        manageBilling: boolean;
+        manageTeam: boolean;
+        manageIntegrations: boolean;
+    };
+} & {
+    uiHint: ToolUiHint;
+}>)>;
 
 export { MY_ACCESS_TOOL_NAME, defineMyAccessTool, myAccessInputSchema, myAccessTool };

package/dist/eve/tools/identity/my-access.js

@@ -72,9 +72,22 @@ function withUiHint(result, hint) {
   };
 }
 
+// src/eve/tool-result-ui-meta.ts
+var TOOL_UI_FIELD = "ui";
+function withToolUi(result, ui) {
+  const existing = typeof result[TOOL_UI_FIELD] === "object" && result[TOOL_UI_FIELD] !== null && !Array.isArray(result[TOOL_UI_FIELD]) ? result[TOOL_UI_FIELD] : {};
+  return {
+    ...result,
+    [TOOL_UI_FIELD]: {
+      ...existing,
+      ...ui
+    }
+  };
+}
+
 // src/eve/tool-reply-guidance.ts
 var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
-var MY_ACCESS_REPLY_GUIDANCE = "Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds \u2265 $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins \u2014 do not tell them to find an admin manually without offering delegation first.";
+var MY_ACCESS_REPLY_GUIDANCE = "Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds \u2265 $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, query-tasks, or workspace-usage capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins \u2014 do not tell them to find an admin manually without offering delegation first.";
 function withReplyGuidance(result, guidance) {
   return {
     ...result,
@@ -84,11 +97,17 @@ function withReplyGuidance(result, guidance) {
 
 // src/eve/tool-display-format.ts
 function formatToolObjectResult(data, options) {
-  const withGuidance = withReplyGuidance(data, options.replyGuidance);
+  let result = withReplyGuidance(
+    data,
+    options.replyGuidance
+  );
+  if (options.ui) {
+    result = withToolUi(result, options.ui);
+  }
   if (options.uiHint) {
-    return withUiHint(withGuidance, options.uiHint);
+    result = withUiHint(result, options.uiHint);
   }
-  return withGuidance;
+  return result;
 }
 
 // src/eve/tools/identity/format-my-access.ts
@@ -108,7 +127,8 @@ function formatMyAccessResult(input) {
       }
     },
     {
-      replyGuidance: MY_ACCESS_REPLY_GUIDANCE
+      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,
+      ui: { entity: "access" }
     }
   );
 }
@@ -126,7 +146,7 @@ function tenantCapabilities(isAdmin) {
 }
 function defineMyAccessTool() {
   return defineTool({
-    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn \u2014 including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; do not restate role, groups, or capabilities in your reply.",
+    description: "Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks, get_workspace_usage) in the same turn \u2014 including read-only requests like listing users or usage. Results render as a visible access tool card in chat like other tools; do not restate role, groups, or capabilities in your reply.",
     inputSchema: myAccessInputSchema,
     async execute(_input, ctx) {
       const caller = tryResolveTenantCaller(ctx);

package/dist/eve/tools/identity/my-access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-ui-hint.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks) in the same turn — \" +\n      \"including read-only requests like listing users. Results render as a visible access tool card in chat like other tools; \" +\n      \"do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name for optional layout hints on tool execute results. */\nexport const TOOL_UI_HINT_FIELD = \"uiHint\" as const;\n\n/** Top-level layout hint for RobotRock TRL rendering. Optional — omit to let the dashboard infer. */\nexport type ToolUiHint = \"list\" | \"chart\" | \"table\";\n\nconst TOOL_UI_HINTS = new Set<ToolUiHint>([\"list\", \"chart\", \"table\"]);\n\nexport function isToolUiHint(value: unknown): value is ToolUiHint {\n  return typeof value === \"string\" && TOOL_UI_HINTS.has(value as ToolUiHint);\n}\n\n/** Attach an optional layout hint to a tool execute result. */\nexport function withUiHint<T extends Record<string, unknown>>(\n  result: T,\n  hint: ToolUiHint\n): T & { uiHint: ToolUiHint } {\n  return {\n    ...result,\n    [TOOL_UI_HINT_FIELD]: hint,\n  };\n}\n\n/** Read a validated layout hint from tool output; unknown values are ignored. */\nexport function extractToolUiHint(output: unknown): ToolUiHint | undefined {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return undefined;\n  }\n\n  const hint = (output as Record<string, unknown>)[TOOL_UI_HINT_FIELD];\n  return isToolUiHint(hint) ? hint : undefined;\n}\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n","import { withReplyGuidance } from \"./tool-reply-guidance.js\";\nimport { withUiHint, type ToolUiHint } from \"./tool-ui-hint.js\";\n\nexport type FormatToolObjectResultOptions = {\n  replyGuidance: string;\n  /** Optional layout hint for TRL rendering. Omit to let the dashboard infer. */\n  uiHint?: ToolUiHint;\n};\n\nexport type FormatToolListResultOptions = {\n  replyGuidance: string;\n};\n\n/** Attach agent narration hints to plain tool JSON. No display/ui envelope. */\nexport function formatToolObjectResult(\n  data: Record<string, unknown>,\n  options: FormatToolObjectResultOptions\n) {\n  const withGuidance = withReplyGuidance(data, options.replyGuidance);\n  if (options.uiHint) {\n    return withUiHint(withGuidance, options.uiHint);\n  }\n  return withGuidance;\n}\n\n/** Wrap an array field as plain tool JSON with reply guidance and list layout hint. */\nexport function formatToolListResult(\n  listKey: string,\n  items: Record<string, unknown>[],\n  options: FormatToolListResultOptions\n) {\n  return withUiHint(\n    withReplyGuidance({ [listKey]: items }, options.replyGuidance),\n    \"list\"\n  );\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,qBAAqB;AAY3B,SAAS,WACd,QACA,MAC4B;AAC5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,kBAAkB,GAAG;AAAA,EACxB;AACF;;;AClBO,IAAM,4BAA4B;AAKlC,IAAM,2BACX;AA8CK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;ACjDO,SAAS,uBACd,MACA,SACA;AACA,QAAM,eAAe,kBAAkB,MAAM,QAAQ,aAAa;AAClE,MAAI,QAAQ,QAAQ;AAClB,WAAO,WAAW,cAAc,QAAQ,MAAM;AAAA,EAChD;AACA,SAAO;AACT;;;ACNO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;AN1BO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAIF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":[]}
+{"version":3,"sources":["../../../../src/eve/tools/identity/my-access.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-ui-hint.ts","../../../../src/eve/tool-result-ui-meta.ts","../../../../src/eve/tool-reply-guidance.ts","../../../../src/eve/tool-display-format.ts","../../../../src/eve/tools/identity/format-my-access.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  MY_ACCESS_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\nimport { formatMyAccessResult } from \"./format-my-access.js\";\n\n/** Eve tool slug — must match the agent tool filename `get_my_access.ts`. */\nexport const MY_ACCESS_TOOL_NAME = \"get_my_access\";\n\nexport const myAccessInputSchema = z.object({});\n\nfunction tenantCapabilities(isAdmin: boolean) {\n  return {\n    manageSettings: isAdmin,\n    manageBilling: isAdmin,\n    manageTeam: isAdmin,\n    manageIntegrations: isAdmin,\n  };\n}\n\nexport function defineMyAccessTool() {\n  return defineTool({\n    description:\n      \"Check the authenticated user's tenant role, group memberships, and admin capabilities in RobotRock. \" +\n      \"Always call this before tenant-admin tools (manage_team_members, manage_groups, query_tasks, get_workspace_usage) in the same turn — \" +\n      \"including read-only requests like listing users or usage. Results render as a visible access tool card in chat like other tools; \" +\n      \"do not restate role, groups, or capabilities in your reply.\",\n    inputSchema: myAccessInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent access details.\"\n        );\n      }\n\n      return formatMyAccessResult({\n        tenantSlug: caller.tenantSlug,\n        tenantRole: caller.role,\n        isTenantAdmin: caller.isAdmin,\n        groupSlugs: caller.groups,\n        capabilities: tenantCapabilities(caller.isAdmin),\n        email: caller.email,\n      });\n    },\n  });\n}\n\nexport const myAccessTool = defineMyAccessTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","/** Field name for optional layout hints on tool execute results. */\nexport const TOOL_UI_HINT_FIELD = \"uiHint\" as const;\n\n/** Top-level layout hint for RobotRock TRL rendering. Optional — omit to let the dashboard infer. */\nexport type ToolUiHint = \"list\" | \"chart\" | \"table\";\n\nconst TOOL_UI_HINTS = new Set<ToolUiHint>([\"list\", \"chart\", \"table\"]);\n\nexport function isToolUiHint(value: unknown): value is ToolUiHint {\n  return typeof value === \"string\" && TOOL_UI_HINTS.has(value as ToolUiHint);\n}\n\n/** Attach an optional layout hint to a tool execute result. */\nexport function withUiHint<T extends Record<string, unknown>>(\n  result: T,\n  hint: ToolUiHint\n): T & { uiHint: ToolUiHint } {\n  return {\n    ...result,\n    [TOOL_UI_HINT_FIELD]: hint,\n  };\n}\n\n/** Read a validated layout hint from tool output; unknown values are ignored. */\nexport function extractToolUiHint(output: unknown): ToolUiHint | undefined {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return undefined;\n  }\n\n  const hint = (output as Record<string, unknown>)[TOOL_UI_HINT_FIELD];\n  return isToolUiHint(hint) ? hint : undefined;\n}\n","import { isToolUiHint, type ToolUiHint } from \"./tool-ui-hint.js\";\n\n/** Nested agent-only UI metadata on tool execute results. */\nexport const TOOL_UI_FIELD = \"ui\" as const;\n\n/** Free-form entity id: lowercase slug used as cache key (e.g. member, task). */\nexport const TOOL_RESULT_UI_ENTITY_ID_RE = /^[a-z][a-z0-9_]{0,63}$/;\n\n/**\n * Recommended entity ids for RobotRock tools. Not exhaustive — any valid slug is accepted.\n * @deprecated Prefer free-form `ui.entity` strings; this list is documentation only.\n */\nexport const TOOL_RESULT_UI_ENTITIES = [\n  \"product\",\n  \"member\",\n  \"task\",\n  \"group\",\n  \"status\",\n  \"object\",\n] as const;\n\nexport type ToolResultUiEntity = string;\n\n/** Render layout hint (not a cached atom). Derived from uiHint / legacy pattern. */\nexport type ToolResultUiLayout = ToolUiHint;\n\nexport type ToolResultUiMeta = {\n  /** Hybrid presentation override: true = always show card, false = never. */\n  present?: boolean;\n  /** Entity id for row layout cache (free-form slug). */\n  entity?: ToolResultUiEntity;\n  /** Path to row array for list cards (e.g. \"rows\", \"items\"). */\n  rowsPath?: string;\n  /** Viz/collection layout hint — chart | table | list. Not a pattern atom. */\n  layout?: ToolResultUiLayout;\n};\n\nexport function isToolResultUiEntityId(value: unknown): value is string {\n  return typeof value === \"string\" && TOOL_RESULT_UI_ENTITY_ID_RE.test(value);\n}\n\n/** @deprecated Use isToolResultUiEntityId. */\nexport function isToolResultUiEntity(value: unknown): value is string {\n  return isToolResultUiEntityId(value);\n}\n\n/** Map legacy top-level uiHint into a layout hint. */\nexport function uiHintToLayout(hint: ToolUiHint): ToolResultUiLayout {\n  return hint;\n}\n\n/**\n * Map legacy `ui.pattern` values into layout / rowsPath behavior.\n * Patterns are no longer cached atoms.\n */\nexport function legacyPatternToLayout(\n  pattern: string\n): ToolResultUiLayout | undefined {\n  switch (pattern) {\n    case \"chart\":\n      return \"chart\";\n    case \"table\":\n      return \"table\";\n    case \"list\":\n    case \"query\":\n      return \"list\";\n    default:\n      return undefined;\n  }\n}\n\nfunction readPresent(value: unknown): boolean | undefined {\n  return typeof value === \"boolean\" ? value : undefined;\n}\n\nfunction readRowsPath(value: unknown): string | undefined {\n  if (typeof value !== \"string\") {\n    return undefined;\n  }\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction readEntity(value: unknown): string | undefined {\n  if (!isToolResultUiEntityId(value)) {\n    return undefined;\n  }\n  return value;\n}\n\n/** Read and validate nested `ui` metadata (+ legacy uiHint / pattern → layout). */\nexport function extractToolResultUiMeta(\n  output: unknown\n): ToolResultUiMeta | undefined {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return undefined;\n  }\n\n  const record = output as Record<string, unknown>;\n  const rawUi = record[TOOL_UI_FIELD];\n  const meta: ToolResultUiMeta = {};\n\n  if (typeof rawUi === \"object\" && rawUi !== null && !Array.isArray(rawUi)) {\n    const ui = rawUi as Record<string, unknown>;\n    const present = readPresent(ui.present);\n    if (present !== undefined) {\n      meta.present = present;\n    }\n    const entity = readEntity(ui.entity);\n    if (entity) {\n      meta.entity = entity;\n    }\n    const rowsPath = readRowsPath(ui.rowsPath);\n    if (rowsPath) {\n      meta.rowsPath = rowsPath;\n    }\n    if (isToolUiHint(ui.layout)) {\n      meta.layout = ui.layout;\n    } else if (typeof ui.pattern === \"string\") {\n      // Legacy nested pattern → layout hint only.\n      const fromPattern = legacyPatternToLayout(ui.pattern);\n      if (fromPattern) {\n        meta.layout = fromPattern;\n      }\n    }\n  }\n\n  if (!meta.layout && isToolUiHint(record.uiHint)) {\n    meta.layout = uiHintToLayout(record.uiHint);\n  }\n\n  if (\n    meta.present === undefined &&\n    meta.entity === undefined &&\n    meta.rowsPath === undefined &&\n    meta.layout === undefined\n  ) {\n    return undefined;\n  }\n\n  return meta;\n}\n\n/** Attach nested UI metadata to a tool execute result. */\nexport function withToolUi<T extends Record<string, unknown>>(\n  result: T,\n  ui: ToolResultUiMeta\n): T & { ui: ToolResultUiMeta } {\n  const existing =\n    typeof result[TOOL_UI_FIELD] === \"object\" &&\n    result[TOOL_UI_FIELD] !== null &&\n    !Array.isArray(result[TOOL_UI_FIELD])\n      ? (result[TOOL_UI_FIELD] as ToolResultUiMeta)\n      : {};\n\n  return {\n    ...result,\n    [TOOL_UI_FIELD]: {\n      ...existing,\n      ...ui,\n    },\n  };\n}\n","import { TOOL_UI_FIELD } from \"./tool-result-ui-meta.js\";\nimport { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, query-tasks, or workspace-usage capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const GET_WORKSPACE_USAGE_REPLY_GUIDANCE =\n  \"Workspace plan and usage render as a card in chat. Do not restate plan name, task counts, seats, groups, API keys, or rate limits from the card. Only add context not shown (e.g. upgrade options, that LLM token/cost meters are not tracked, or next steps). Never invent token or dollar spend numbers.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const GENERATE_RANDOM_CHART_REPLY_GUIDANCE =\n  \"Chart metrics render as a chart card in chat. Do not restate series values, dates, or categories from the chart. Only add brief context (e.g. that this is demo data).\";\n\nexport const GENERATE_IMAGE_REPLY_GUIDANCE =\n  \"The generated image renders in chat UI. Do not describe the image pixels or restate the prompt. Only add a short acknowledgement or next-step question if useful.\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  delete record[TOOL_UI_FIELD];\n  return record;\n}\n","import { withReplyGuidance } from \"./tool-reply-guidance.js\";\nimport {\n  withToolUi,\n  type ToolResultUiEntity,\n  type ToolResultUiMeta,\n} from \"./tool-result-ui-meta.js\";\nimport { withUiHint, type ToolUiHint } from \"./tool-ui-hint.js\";\n\nexport type FormatToolObjectResultOptions = {\n  replyGuidance: string;\n  /** @deprecated Prefer `ui.layout`. Mapped for backward compatibility. */\n  uiHint?: ToolUiHint;\n  ui?: ToolResultUiMeta;\n};\n\nexport type FormatToolListResultOptions = {\n  replyGuidance: string;\n  entity?: ToolResultUiEntity;\n  present?: boolean;\n  ui?: Omit<ToolResultUiMeta, \"rowsPath\" | \"layout\">;\n};\n\nexport type FormatToolQueryResultOptions = {\n  replyGuidance: string;\n  entity?: ToolResultUiEntity;\n  present?: boolean;\n  rowsPath?: string;\n  ui?: ToolResultUiMeta;\n};\n\ntype WithReplyGuidance<T> = T & { replyGuidance: string };\ntype WithUiMeta<T> = T & { ui: ToolResultUiMeta };\ntype WithUiHintField<T> = T & { uiHint: ToolUiHint };\n\n/** Attach agent narration hints to plain tool JSON. No display/ui envelope. */\nexport function formatToolObjectResult<T extends Record<string, unknown>>(\n  data: T,\n  options: FormatToolObjectResultOptions\n): WithReplyGuidance<T> &\n  Partial<WithUiMeta<T>> &\n  Partial<WithUiHintField<T>> {\n  let result: Record<string, unknown> = withReplyGuidance(\n    data,\n    options.replyGuidance\n  );\n  if (options.ui) {\n    result = withToolUi(result, options.ui);\n  }\n  if (options.uiHint) {\n    result = withUiHint(result, options.uiHint);\n  }\n  return result as WithReplyGuidance<T> &\n    Partial<WithUiMeta<T>> &\n    Partial<WithUiHintField<T>>;\n}\n\n/** Wrap an array field as plain tool JSON with reply guidance and list layout hint.\n *\n * Include `url` on each item when you know a navigable link — the dashboard\n * renders clickable Item rows. Use `attachments` / `files` / `documents` keys\n * for file downloads (Attachment layout). Set `entity` so the dashboard caches\n * a reusable row layout under that name.\n */\nexport function formatToolListResult<\n  const K extends string,\n  T extends Record<string, unknown>,\n>(\n  listKey: K,\n  items: T[],\n  options: FormatToolListResultOptions\n): WithReplyGuidance<Record<K, T[]>> &\n  WithUiMeta<Record<K, T[]>> &\n  WithUiHintField<Record<K, T[]>> {\n  const ui: ToolResultUiMeta = {\n    ...options.ui,\n    layout: \"list\",\n    rowsPath: listKey,\n    ...(options.entity ? { entity: options.entity } : {}),\n    ...(options.present !== undefined ? { present: options.present } : {}),\n  };\n\n  return withUiHint(\n    withToolUi(\n      withReplyGuidance({ [listKey]: items } as Record<K, T[]>, options.replyGuidance),\n      ui\n    ),\n    \"list\"\n  ) as WithReplyGuidance<Record<K, T[]>> &\n    WithUiMeta<Record<K, T[]>> &\n    WithUiHintField<Record<K, T[]>>;\n}\n\n/** Format a query-style result: shared meta fields + typed row array. */\nexport function formatToolQueryResult<\n  M extends Record<string, unknown>,\n  T extends Record<string, unknown>,\n>(\n  meta: M,\n  rows: T[],\n  options: FormatToolQueryResultOptions\n): WithReplyGuidance<M & Record<string, T[]>> & WithUiMeta<M & Record<string, T[]>> {\n  const rowsPath = options.rowsPath ?? options.ui?.rowsPath ?? \"rows\";\n  const ui: ToolResultUiMeta = {\n    ...options.ui,\n    layout: options.ui?.layout ?? \"list\",\n    rowsPath,\n    ...(options.entity ? { entity: options.entity } : {}),\n    ...(options.present !== undefined ? { present: options.present } : {}),\n  };\n\n  return withToolUi(\n    withReplyGuidance(\n      {\n        ...meta,\n        [rowsPath]: rows,\n      } as M & Record<string, T[]>,\n      options.replyGuidance\n    ),\n    ui\n  ) as WithReplyGuidance<M & Record<string, T[]>> &\n    WithUiMeta<M & Record<string, T[]>>;\n}\n\nexport function isAgentAdminErrorResult(\n  result: unknown\n): result is { ok: false; message: string } {\n  return (\n    typeof result === \"object\" &&\n    result !== null &&\n    (result as { ok?: unknown }).ok === false &&\n    typeof (result as { message?: unknown }).message === \"string\"\n  );\n}\n","import { formatToolObjectResult } from \"../../tool-display-format.js\";\nimport { MY_ACCESS_REPLY_GUIDANCE } from \"../../tool-reply-guidance.js\";\n\ntype MyAccessResultInput = {\n  tenantSlug: string;\n  tenantRole?: string;\n  isTenantAdmin: boolean;\n  groupSlugs: string[];\n  capabilities: {\n    manageSettings: boolean;\n    manageBilling: boolean;\n    manageTeam: boolean;\n    manageIntegrations: boolean;\n  };\n  email?: string;\n};\n\nexport function formatMyAccessResult(input: MyAccessResultInput) {\n  return formatToolObjectResult(\n    {\n      access: {\n        workspace: input.tenantSlug,\n        role: input.tenantRole ?? \"member\",\n        tenantAdmin: input.isTenantAdmin,\n        groups: input.groupSlugs.join(\", \") || \"—\",\n        manageSettings: input.capabilities.manageSettings,\n        manageBilling: input.capabilities.manageBilling,\n        manageTeam: input.capabilities.manageTeam,\n        manageIntegrations: input.capabilities.manageIntegrations,\n        ...(input.email ? { email: input.email } : {}),\n      },\n    },\n    {\n      replyGuidance: MY_ACCESS_REPLY_GUIDANCE,\n      ui: { entity: \"access\" },\n    }\n  );\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACvDO,IAAM,qBAAqB;AAY3B,SAAS,WACd,QACA,MAC4B;AAC5B,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,kBAAkB,GAAG;AAAA,EACxB;AACF;;;AClBO,IAAM,gBAAgB;AA6ItB,SAAS,WACd,QACA,IAC8B;AAC9B,QAAM,WACJ,OAAO,OAAO,aAAa,MAAM,YACjC,OAAO,aAAa,MAAM,QAC1B,CAAC,MAAM,QAAQ,OAAO,aAAa,CAAC,IAC/B,OAAO,aAAa,IACrB,CAAC;AAEP,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,aAAa,GAAG;AAAA,MACf,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AAAA,EACF;AACF;;;AC9JO,IAAM,4BAA4B;AAKlC,IAAM,2BACX;AAuDK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;ACtCO,SAAS,uBACd,MACA,SAG4B;AAC5B,MAAI,SAAkC;AAAA,IACpC;AAAA,IACA,QAAQ;AAAA,EACV;AACA,MAAI,QAAQ,IAAI;AACd,aAAS,WAAW,QAAQ,QAAQ,EAAE;AAAA,EACxC;AACA,MAAI,QAAQ,QAAQ;AAClB,aAAS,WAAW,QAAQ,QAAQ,MAAM;AAAA,EAC5C;AACA,SAAO;AAGT;;;ACrCO,SAAS,qBAAqB,OAA4B;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,QACN,WAAW,MAAM;AAAA,QACjB,MAAM,MAAM,cAAc;AAAA,QAC1B,aAAa,MAAM;AAAA,QACnB,QAAQ,MAAM,WAAW,KAAK,IAAI,KAAK;AAAA,QACvC,gBAAgB,MAAM,aAAa;AAAA,QACnC,eAAe,MAAM,aAAa;AAAA,QAClC,YAAY,MAAM,aAAa;AAAA,QAC/B,oBAAoB,MAAM,aAAa;AAAA,QACvC,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,IAAI,EAAE,QAAQ,SAAS;AAAA,IACzB;AAAA,EACF;AACF;;;AP3BO,IAAM,sBAAsB;AAE5B,IAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAE9C,SAAS,mBAAmB,SAAkB;AAC5C,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,oBAAoB;AAAA,EACtB;AACF;AAEO,SAAS,qBAAqB;AACnC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAIF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO,qBAAqB;AAAA,QAC1B,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,YAAY,OAAO;AAAA,QACnB,cAAc,mBAAmB,OAAO,OAAO;AAAA,QAC/C,OAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,eAAe,mBAAmB;","names":[]}

package/dist/eve/tools/identity/whoami.d.ts

@@ -1,6 +1,6 @@
 import * as eve_tools from 'eve/tools';
 import { T as TenantRole } from '../../../tenant-DmN0MMyC.js';
-import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-C3qrT1In.js';
+import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-CJko9liH.js';
 import { z } from 'zod';
 import 'eve/context';
 

package/dist/eve/tools/identity/whoami.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","import { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, or query-tasks capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACrDO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AAiDK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AHvDO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;","names":[]}
+{"version":3,"sources":["../../../../src/eve/tools/identity/whoami.ts","../../../../src/eve/agent/attributes.ts","../../../../src/eve/agent/tenant.ts","../../../../src/eve/tool-reply-guidance.ts"],"sourcesContent":["import { defineTool } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { tryResolveTenantCaller } from \"../../agent/tenant.js\";\nimport {\n  WHOAMI_REPLY_GUIDANCE,\n  withReplyGuidance,\n} from \"../../tool-reply-guidance.js\";\n\nexport const WHOAMI_TOOL_NAME = \"whoami\";\n\nexport const whoamiInputSchema = z.object({});\n\nexport function defineWhoamiTool() {\n  return defineTool({\n    description:\n      \"Return the authenticated RobotRock user, tenant, role, and group memberships for the current chat session. \" +\n      \"The dashboard renders a profile card — do not repeat name, email, workspace, role, or groups in your reply; only add context not shown in the card.\",\n    inputSchema: whoamiInputSchema,\n    async execute(_input, ctx) {\n      const caller = tryResolveTenantCaller(ctx);\n      if (!caller) {\n        return withReplyGuidance(\n          {\n            authenticated: false as const,\n            message:\n              \"No RobotRock user is attached to this session. Dashboard chat supplies user context via the Eve proxy.\",\n          },\n          \"Explain that no user is attached to this session. Do not invent identity details.\"\n        );\n      }\n\n      return withReplyGuidance(\n        {\n          authenticated: true as const,\n          userId: caller.userId,\n          name: caller.name,\n          email: caller.email,\n          tenantSlug: caller.tenantSlug,\n          role: caller.role,\n          isAdmin: caller.isAdmin,\n          groups: caller.groups.map((slug) => ({ slug })),\n          ...(caller.workosUserId ? { workosUserId: caller.workosUserId } : {}),\n          sessionId: ctx.session.id,\n        },\n        WHOAMI_REPLY_GUIDANCE\n      );\n    },\n  });\n}\n\nexport const whoamiTool = defineWhoamiTool();\n","export function readStringAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string | undefined {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return value;\n  }\n  if (Array.isArray(value) && typeof value[0] === \"string\" && value[0].length > 0) {\n    return value[0];\n  }\n  return undefined;\n}\n\nexport function readStringArrayAttribute(\n  attributes: Readonly<Record<string, string | readonly string[]>> | undefined,\n  key: string\n): string[] {\n  const value = attributes?.[key];\n  if (typeof value === \"string\" && value.length > 0) {\n    return [value];\n  }\n  if (Array.isArray(value)) {\n    return value.filter(\n      (entry): entry is string => typeof entry === \"string\" && entry.length > 0\n    );\n  }\n  return [];\n}\n\nexport function parseTenantRole(\n  value: string | undefined\n): \"admin\" | \"member\" | null {\n  if (value === \"admin\" || value === \"member\") {\n    return value;\n  }\n  return null;\n}\n","import type { SessionContext } from \"eve/context\";\nimport {\n  parseTenantRole,\n  readStringArrayAttribute,\n  readStringAttribute,\n} from \"./attributes.js\";\n\nexport type TenantRole = \"admin\" | \"member\";\n\nexport type TenantCaller = {\n  userId: string;\n  email: string;\n  name: string;\n  tenantSlug: string;\n  connectionId?: string;\n  chatId?: string;\n  role: TenantRole;\n  isAdmin: boolean;\n  groups: string[];\n  workosUserId?: string;\n};\n\n/** Resolve the authenticated RobotRock dashboard user for the current session. */\nexport function tryResolveTenantCaller(ctx: SessionContext): TenantCaller | null {\n  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;\n  if (caller?.principalType !== \"user\") {\n    return null;\n  }\n\n  const email = readStringAttribute(caller.attributes, \"email\");\n  const name = readStringAttribute(caller.attributes, \"name\");\n  const tenantSlug =\n    readStringAttribute(caller.attributes, \"tenantSlug\") ??\n    readStringAttribute(caller.attributes, \"tenantId\");\n  const role = parseTenantRole(readStringAttribute(caller.attributes, \"role\"));\n  if (!email || !tenantSlug || !caller.principalId || !role) {\n    return null;\n  }\n\n  const workosUserId = readStringAttribute(caller.attributes, \"workosUserId\");\n  const connectionId = readStringAttribute(caller.attributes, \"connectionId\");\n  const chatId = readStringAttribute(caller.attributes, \"chatId\");\n  const groups = readStringArrayAttribute(caller.attributes, \"groups\");\n\n  return {\n    userId: caller.principalId,\n    email,\n    name: name ?? email.split(\"@\")[0] ?? email,\n    tenantSlug,\n    ...(connectionId ? { connectionId } : {}),\n    ...(chatId ? { chatId } : {}),\n    role,\n    isAdmin: role === \"admin\",\n    groups,\n    ...(workosUserId ? { workosUserId } : {}),\n  };\n}\n\n/** Like {@link tryResolveTenantCaller} but throws when the session has no user. */\nexport function requireTenantCaller(ctx: SessionContext): TenantCaller {\n  const caller = tryResolveTenantCaller(ctx);\n  if (!caller) {\n    throw new Error(\"An authenticated RobotRock tenant user is required.\");\n  }\n  return caller;\n}\n\nexport function isAdminCaller(ctx: SessionContext): boolean {\n  return tryResolveTenantCaller(ctx)?.isAdmin === true;\n}\n\n/** Require an authenticated tenant admin for the current session. */\nexport function requireAdminCaller(ctx: SessionContext): TenantCaller {\n  const caller = requireTenantCaller(ctx);\n  if (!caller.isAdmin) {\n    throw new Error(\"Tenant admin access is required.\");\n  }\n  return caller;\n}\n","import { TOOL_UI_FIELD } from \"./tool-result-ui-meta.js\";\nimport { TOOL_UI_HINT_FIELD } from \"./tool-ui-hint.js\";\n\n/** Field name agents read; dashboard widgets must ignore when rendering. */\nexport const TOOL_REPLY_GUIDANCE_FIELD = \"replyGuidance\" as const;\n\nexport const WHOAMI_REPLY_GUIDANCE =\n  \"The dashboard shows a profile card with name, email, workspace, role, and groups. Do not restate those in your reply. Only add context not in the card (e.g. permissions, refund approval rules, missing group membership).\";\n\nexport const MY_ACCESS_REPLY_GUIDANCE =\n  \"Access details may render in chat UI. Do not restate role, groups, or admin capabilities if already visible. Only explain what the user can or cannot do for their question (e.g. finance group required for refunds ≥ $10,000). When access.tenantAdmin is false and the user needs manageTeam, manageGroups, query-tasks, or workspace-usage capabilities, explain briefly then call ask_question to offer sending an admin request to tenant admins — do not tell them to find an admin manually without offering delegation first.\";\n\nexport const GET_WORKSPACE_USAGE_REPLY_GUIDANCE =\n  \"Workspace plan and usage render as a card in chat. Do not restate plan name, task counts, seats, groups, API keys, or rate limits from the card. Only add context not shown (e.g. upgrade options, that LLM token/cost meters are not tracked, or next steps). Never invent token or dollar spend numbers.\";\n\nexport const CREATE_INBOX_TASK_REPLY_GUIDANCE =\n  \"A task card shows title, assignee, and inbox status in chat. Do not restate task ID, assignee, or delegation details from the card. Only mention next steps or answer the user's question.\";\n\nexport const SEARCH_PRODUCTS_REPLY_GUIDANCE =\n  \"Product results render as a list card in chat. Do not restate product names, prices, or SKUs. Only add context not in the list (e.g. no matches, recommendations).\";\n\nexport const GENERATE_RANDOM_CHART_REPLY_GUIDANCE =\n  \"Chart metrics render as a chart card in chat. Do not restate series values, dates, or categories from the chart. Only add brief context (e.g. that this is demo data).\";\n\nexport const GENERATE_IMAGE_REPLY_GUIDANCE =\n  \"The generated image renders in chat UI. Do not describe the image pixels or restate the prompt. Only add a short acknowledgement or next-step question if useful.\";\n\nexport const MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE =\n  \"Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).\";\n\nexport const MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE =\n  \"Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.\";\n\nexport const MANAGE_GROUPS_LIST_REPLY_GUIDANCE =\n  \"Groups render as a list card in chat. Do not restate group names, slugs, or descriptions from the list. Use slug (not internal id) for get, update, delete, and membership actions. Only add context not shown.\";\n\nexport const MANAGE_GROUPS_DETAIL_REPLY_GUIDANCE =\n  \"Group details render in chat UI. Do not restate fields already visible in the card. Only add next steps.\";\n\nexport const QUERY_TASKS_LIST_REPLY_GUIDANCE =\n  \"Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).\";\n\nexport const QUERY_TASKS_DETAIL_REPLY_GUIDANCE =\n  \"Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.\";\n\nexport const ASSIGN_TASKS_REPLY_GUIDANCE =\n  \"Reassignment results render in chat UI. Do not restate task ids or assignee emails from the card. Only mention failures, partial success, or next steps.\";\n\nexport const REFUND_CHARGE_REPLY_GUIDANCE =\n  \"Refund details render in chat UI. Do not restate charge id, amount, or status from the card. Only add policy context or next steps.\";\n\nexport const DEPLOY_RELEASE_REPLY_GUIDANCE =\n  \"Deploy details render in chat UI. Do not restate service, version, or environment from the card. Only add rollout context or next steps.\";\n\nexport const GET_WEATHER_REPLY_GUIDANCE =\n  \"Weather details render in chat UI. Do not restate city, condition, or temperature from the card. Only add conversational context if needed.\";\n\nexport const ADMIN_MUTATION_REPLY_GUIDANCE =\n  \"The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.\";\n\nexport type ToolResultWithReplyGuidance<T extends Record<string, unknown>> = T & {\n  replyGuidance: string;\n};\n\n/** Attach model-facing narration hints to a tool execute result. */\nexport function withReplyGuidance<T extends Record<string, unknown>>(\n  result: T,\n  guidance: string\n): ToolResultWithReplyGuidance<T> {\n  return {\n    ...result,\n    [TOOL_REPLY_GUIDANCE_FIELD]: guidance,\n  };\n}\n\n/** Remove agent-only fields before showing raw JSON in the dashboard. */\nexport function stripAgentOnlyToolFields(output: unknown): unknown {\n  if (typeof output !== \"object\" || output === null || Array.isArray(output)) {\n    return output;\n  }\n\n  const record = { ...(output as Record<string, unknown>) };\n  delete record[TOOL_REPLY_GUIDANCE_FIELD];\n  delete record[TOOL_UI_HINT_FIELD];\n  delete record[TOOL_UI_FIELD];\n  return record;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;;;ACDX,SAAS,oBACd,YACA,KACoB;AACpB,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,KAAK,OAAO,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,SAAS,GAAG;AAC/E,WAAO,MAAM,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEO,SAAS,yBACd,YACA,KACU;AACV,QAAM,QAAQ,aAAa,GAAG;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,CAAC,KAAK;AAAA,EACf;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MACX,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,SAAS,gBACd,OAC2B;AAC3B,MAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACdO,SAAS,uBAAuB,KAA0C;AAC/E,QAAM,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK;AAC9D,MAAI,QAAQ,kBAAkB,QAAQ;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,oBAAoB,OAAO,YAAY,OAAO;AAC5D,QAAM,OAAO,oBAAoB,OAAO,YAAY,MAAM;AAC1D,QAAM,aACJ,oBAAoB,OAAO,YAAY,YAAY,KACnD,oBAAoB,OAAO,YAAY,UAAU;AACnD,QAAM,OAAO,gBAAgB,oBAAoB,OAAO,YAAY,MAAM,CAAC;AAC3E,MAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,eAAe,CAAC,MAAM;AACzD,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,eAAe,oBAAoB,OAAO,YAAY,cAAc;AAC1E,QAAM,SAAS,oBAAoB,OAAO,YAAY,QAAQ;AAC9D,QAAM,SAAS,yBAAyB,OAAO,YAAY,QAAQ;AAEnE,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,IACrC;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;;;ACpDO,IAAM,4BAA4B;AAElC,IAAM,wBACX;AA0DK,SAAS,kBACd,QACA,UACgC;AAChC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,yBAAyB,GAAG;AAAA,EAC/B;AACF;;;AHjEO,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,EAAE,OAAO,CAAC,CAAC;AAErC,SAAS,mBAAmB;AACjC,SAAO,WAAW;AAAA,IAChB,aACE;AAAA,IAEF,aAAa;AAAA,IACb,MAAM,QAAQ,QAAQ,KAAK;AACzB,YAAM,SAAS,uBAAuB,GAAG;AACzC,UAAI,CAAC,QAAQ;AACX,eAAO;AAAA,UACL;AAAA,YACE,eAAe;AAAA,YACf,SACE;AAAA,UACJ;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL;AAAA,UACE,eAAe;AAAA,UACf,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO;AAAA,UACb,OAAO,OAAO;AAAA,UACd,YAAY,OAAO;AAAA,UACnB,MAAM,OAAO;AAAA,UACb,SAAS,OAAO;AAAA,UAChB,QAAQ,OAAO,OAAO,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;AAAA,UAC9C,GAAI,OAAO,eAAe,EAAE,cAAc,OAAO,aAAa,IAAI,CAAC;AAAA,UACnE,WAAW,IAAI,QAAQ;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,IAAM,aAAa,iBAAiB;","names":[]}

package/dist/eve/tools/inbox/create-task.d.ts

@@ -1,5 +1,5 @@
 import * as eve_tools from 'eve/tools';
-import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-C3qrT1In.js';
+import { T as ToolResultWithReplyGuidance } from '../../../tool-reply-guidance-CJko9liH.js';
 import { z } from 'zod';
 import { a as TenantCaller } from '../../../tenant-DmN0MMyC.js';
 import 'eve/context';

package/dist/eve/tools/inbox/create-task.js

@@ -449,6 +449,40 @@ var agentChatLinkTaskBodySchema = z.object({
   publicTaskId: z.string().min(1),
   toolCallId: z.string().min(1)
 });
+var AGENT_FILE_TAGS_MAX = 20;
+var AGENT_FILE_TAG_MAX_LENGTH = 64;
+function normalizeAgentFileTags(tags) {
+  if (!tags?.length) return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of tags) {
+    const tag = raw.trim().toLowerCase().slice(0, AGENT_FILE_TAG_MAX_LENGTH);
+    if (!tag || seen.has(tag)) continue;
+    seen.add(tag);
+    out.push(tag);
+    if (out.length >= AGENT_FILE_TAGS_MAX) break;
+  }
+  return out.length > 0 ? out : void 0;
+}
+var agentChatUploadImageBodySchema = z.object({
+  mediaType: z.string().min(1),
+  /** Raw base64 (no data: URL prefix). */
+  base64: z.string().min(1),
+  chatId: z.string().min(1).optional(),
+  publicTaskId: z.string().min(1).optional(),
+  source: z.string().min(1).optional(),
+  /** Display / search name (e.g. `sunset-robot.png`). */
+  filename: z.string().min(1).max(255).optional(),
+  /** Human-readable description (e.g. generation prompt). */
+  description: z.string().min(1).max(2e3).optional(),
+  /**
+   * Optional labels for later grouping/filtering.
+   * Normalized to lowercase trimmed unique strings (max 20, 64 chars each).
+   */
+  tags: z.array(z.string().min(1).max(AGENT_FILE_TAG_MAX_LENGTH)).max(AGENT_FILE_TAGS_MAX).optional().transform((tags) => normalizeAgentFileTags(tags))
+}).refine((data) => Boolean(data.chatId || data.publicTaskId), {
+  message: "Provide chatId and/or publicTaskId"
+});
 
 // ../core/src/schemas/tool-result-display.ts
 import { z as z2 } from "zod";
@@ -477,7 +511,8 @@ var tenantRoleSchema = z3.enum(["admin", "member"]);
 var agentAdminUserSchema = z3.object({
   id: z3.string(),
   email: z3.string().email(),
-  name: z3.string()
+  name: z3.string(),
+  profilePictureUrl: z3.string().nullable().optional()
 });
 var agentAdminMemberSchema = z3.object({
   userId: z3.string(),
@@ -562,6 +597,37 @@ var assignTasksBodySchema = z3.object({
     { message: "assignTo needs at least one user email or group slug." }
   )
 });
+var agentAdminPlanLimitsSchema = z3.object({
+  tasksPerDay: z3.number(),
+  members: z3.number(),
+  apiKeys: z3.number(),
+  groups: z3.number(),
+  auditLogRetention: z3.number(),
+  rateLimitPerSecond: z3.number(),
+  taskRetentionDays: z3.number()
+});
+var agentAdminUsageSchema = z3.object({
+  workspace: z3.string(),
+  planName: z3.string(),
+  planType: z3.string(),
+  trialState: z3.enum(["none", "active", "expired"]),
+  daysRemaining: z3.number().nullable(),
+  isPaidPro: z3.boolean(),
+  subscriptionStatus: z3.string().nullable(),
+  tasksToday: z3.number(),
+  maxTasksPerDay: z3.number().nullable(),
+  tasksResetAt: z3.number(),
+  openTasks: z3.number(),
+  totalTasks: z3.number(),
+  seatsCurrent: z3.number(),
+  seatsMax: z3.number().nullable(),
+  groupsCurrent: z3.number(),
+  groupsMax: z3.number().nullable(),
+  apiKeysCurrent: z3.number(),
+  apiKeysMax: z3.number().nullable(),
+  rateLimitPerSecond: z3.number(),
+  limits: agentAdminPlanLimitsSchema
+});
 
 // src/schemas/index.ts
 var handlerUrlSchema2 = z4.string().refine((url) => isAllowedHandlerUrl(url), {
@@ -865,7 +931,11 @@ function resolveRobotRockAuthConfig(overrides) {
       "RobotRock auth is required. Set ROBOTROCK_API_KEY, ROBOTROCK_AGENT_SERVICE_TOKEN with tenant context, or pass auth when creating the client."
     );
   }
-  return { kind: "apiKey", apiKey };
+  return {
+    kind: "apiKey",
+    apiKey,
+    ...overrides?.actingUserId?.trim() ? { actingUserId: overrides.actingUserId.trim() } : {}
+  };
 }
 
 // src/chat-correlation.ts
@@ -1070,6 +1140,51 @@ function createChatsApi(config) {
           data
         );
       }
+    },
+    async uploadImage(input) {
+      const validation = agentChatUploadImageBodySchema.safeParse(input);
+      if (!validation.success) {
+        throw new RobotRockError(
+          `Invalid image upload: ${validation.error.issues[0]?.message}`,
+          400,
+          validation.error.issues
+        );
+      }
+      const response = await fetch(`${config.baseUrl}/agent-chats/images`, {
+        method: "POST",
+        headers: headers(),
+        body: JSON.stringify(validation.data)
+      });
+      const data = await parseResponseBody(response);
+      if (!response.ok) {
+        throw new RobotRockError(
+          getErrorMessage(data, "Failed to upload chat image"),
+          response.status,
+          data
+        );
+      }
+      const uploaded = data;
+      if (typeof uploaded.storageId !== "string" || typeof uploaded.url !== "string" || typeof uploaded.mediaType !== "string") {
+        throw new RobotRockError(
+          "Image upload returned an invalid response",
+          500,
+          data
+        );
+      }
+      return {
+        storageId: uploaded.storageId,
+        url: uploaded.url,
+        mediaType: uploaded.mediaType,
+        ...typeof uploaded.chatId === "string" ? { chatId: uploaded.chatId } : {},
+        ...typeof uploaded.publicTaskId === "string" ? { publicTaskId: uploaded.publicTaskId } : {},
+        ...typeof uploaded.filename === "string" ? { filename: uploaded.filename } : {},
+        ...typeof uploaded.description === "string" ? { description: uploaded.description } : {},
+        ...Array.isArray(uploaded.tags) ? {
+          tags: uploaded.tags.filter(
+            (tag) => typeof tag === "string"
+          )
+        } : {}
+      };
     }
   };
 }
@@ -1139,6 +1254,7 @@ var RobotRock = class {
     }
     this.auth = resolveRobotRockAuthConfig({
       ...apiKey ? { apiKey } : {},
+      ...config.actingUserId ? { actingUserId: config.actingUserId } : {},
       ...agentService ? { agentService } : {}
     });
     this.chatCorrelation = config.chatCorrelation;
@@ -1536,6 +1652,7 @@ function tryCreateBoundRobotRockClient(ctx) {
   if (apiKey) {
     return createClient({
       apiKey,
+      ...caller?.userId ? { actingUserId: caller.userId } : {},
       baseUrl: process.env.ROBOTROCK_BASE_URL?.trim(),
       chatCorrelation
     });