run402-mcp 4.97.0 → 4.99.0

package/dist/tools/rest-query.js

@@ -1,61 +0,0 @@
-import { z } from "zod";
-import { getSdk } from "../sdk.js";
-import { mapSdkError } from "../errors.js";
-import { resolveProjectId } from "../active-project.js";
-export const restQuerySchema = {
-    project_id: z.string().optional().describe("The project ID (defaults to the active project)"),
-    table: z.string().describe("Table name to query"),
-    method: z
-        .enum(["GET", "POST", "PATCH", "DELETE"])
-        .default("GET")
-        .describe("HTTP method"),
-    params: z
-        .record(z.string())
-        .optional()
-        .describe("PostgREST query params (e.g. {select: 'id,name', order: 'id.asc', limit: '10'})"),
-    body: z
-        .unknown()
-        .optional()
-        .describe("Request body for POST/PATCH (JSON object or array)"),
-    key_type: z
-        .enum(["anon", "service"])
-        .default("anon")
-        .describe("Which key to use: anon (default, respects RLS) or service (bypasses RLS)"),
-};
-export async function handleRestQuery(args) {
-    const project = await resolveProjectId(args.project_id);
-    if (typeof project !== "string")
-        return project;
-    const method = (args.method || "GET");
-    let status;
-    let body;
-    try {
-        const response = await getSdk().projects.restResponse(project, args.table, {
-            method,
-            query: args.params,
-            body: args.body,
-            keyType: args.key_type === "service" ? "service" : "anon",
-        });
-        status = response.status;
-        body = response.body;
-    }
-    catch (err) {
-        return mapSdkError(err, "querying REST API");
-    }
-    const text = typeof body === "string"
-        ? body
-        : JSON.stringify(body, null, 2);
-    // Service keys hit the admin REST route; reflect the real path in the label.
-    const restPath = args.key_type === "service"
-        ? `/admin/v1/rest/${args.table}`
-        : `/rest/v1/${args.table}`;
-    return {
-        content: [
-            {
-                type: "text",
-                text: `**${method} ${restPath}** → ${status}\n\n\`\`\`json\n${text}\n\`\`\``,
-            },
-        ],
-    };
-}
-//# sourceMappingURL=rest-query.js.map

package/dist/tools/rest-query.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rest-query.js","sourceRoot":"","sources":["../../src/tools/rest-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACjD,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;SACxC,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,aAAa,CAAC;IAC1B,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,IAAI,EAAE,CAAC;SACJ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,oDAAoD,CAAC;IACjE,QAAQ,EAAE,CAAC;SACR,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;SACzB,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,0EAA0E,CAAC;CACxF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAOrC;IACC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAsB,CAAC;IAC3D,IAAI,MAAc,CAAC;IACnB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE;YACzE,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SAC1D,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpC,6EAA6E;IAC7E,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,KAAK,SAAS;QACzB,CAAC,CAAC,kBAAkB,IAAI,CAAC,KAAK,EAAE;QAChC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;IAE/B,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,KAAK,MAAM,IAAI,QAAQ,QAAQ,MAAM,mBAAmB,IAAI,UAAU;aAC7E;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/rooms-shared.d.ts

@@ -1,39 +0,0 @@
-export interface RoomAddressArgs {
-    project_id?: string;
-    org_id?: string;
-    room_key?: string;
-}
-export interface ResolvedRoom {
-    orgId: string;
-    roomKey: string;
-}
-export type RoomAddressResult = {
-    ok: true;
-    room: ResolvedRoom;
-} | {
-    ok: false;
-    error: string;
-};
-export declare function resolveRoomArgs(args: RoomAddressArgs, opts?: {
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-}): Promise<RoomAddressResult>;
-export declare function cachedPresenceId(room: ResolvedRoom): string | undefined;
-export declare function rememberPresence(room: ResolvedRoom, presence: unknown, requestedName?: string): void;
-export declare function forgetPresence(room: ResolvedRoom): void;
-/**
- * Retry-once on PRESENCE_EXPIRED: drop the cached session presence, REGISTER
- * a replacement (asking for the same name — it suffixes honestly), and retry
- * with it. Registration is explicit because a bare call cannot mean "me".
- *
- * Every call also carries this SERVER PROCESS's resolved session identity
- * (see `../harness-context.js`) alongside any cached `presence_id` — the
- * gateway tries the session identity first, so a presence whose TTL lapsed
- * BETWEEN tool calls (or across a server restart, which starts with an empty
- * in-memory presence cache) revives under its own name via that path rather
- * than 410ing. The retry below is now reached only when no resolvable
- * session identity exists, or the presence aged past the 90-day retention
- * sweep — not on an ordinary period of the server sitting idle.
- */
-export declare function withPresenceRetry<T>(room: ResolvedRoom, call: (presenceId: string | undefined, sessionKey: string) => Promise<T>): Promise<T>;
-//# sourceMappingURL=rooms-shared.d.ts.map

package/dist/tools/rooms-shared.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rooms-shared.d.ts","sourceRoot":"","sources":["../../src/tools/rooms-shared.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA6EjC,wBAAsB,eAAe,CACnC,IAAI,EAAE,eAAe,EACrB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACnD,OAAO,CAAC,iBAAiB,CAAC,CAmC5B;AAQD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAIvE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAOpG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAEvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACvE,OAAO,CAAC,CAAC,CAAC,CAyBZ"}

package/dist/tools/rooms-shared.js

@@ -1,194 +0,0 @@
-/**
- * Shared room addressing + session presence for the agent-messaging MCP tools.
- *
- * Every rooms tool addresses a room the same way: project_id (that project's
- * DEFAULT room — the zero-config path) OR org_id + room_key (named org rooms)
- * OR, when neither is passed, the checkout's own ambient context — RUN402_ROOM,
- * or a `room`/`org` binding in .run402.json, or the wallet profile's selected
- * organization. Both explicit forms outrank the ambient
- * chain, so a call that names a room still reaches exactly that room.
- * The MCP server is a long-lived process, so the session's presence per room
- * lives in an in-memory map — tool calls after the first reuse it. The cache is
- * what makes those calls ONE session: the gateway never infers a session from
- * the credential (a bare call registers a fresh presence rather than adopting a
- * sibling session's), so a lost cache means a new presence
- * with a new, honestly-suffixed name, not silent reuse of an old one.
- */
-import { getSdk } from "../sdk.js";
-import { mapSdkError } from "../errors.js";
-import { findBindingKey } from "../../core/dist/binding-file.js";
-import { getActiveOrgId } from "../../core/dist/profile-state.js";
-import { describeRejectedValue } from "../../core/dist/redact.js";
-import { getSessionKey, resolveHarnessLabels } from "../harness-context.js";
-const ORG_ENV = "RUN402_ORG";
-const ROOM_ENV = "RUN402_ROOM";
-const trimmed = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
-/**
- * Address a room from the ambient context, when nothing was passed explicitly.
- *
- * This mirrors the CLI's precedence (run402 4.27.0) but is a SEPARATE
- * implementation on purpose, for two reasons the CLI's version cannot satisfy:
- *
- *  1. The CLI resolver calls `fail()`, which is `process.exit(1)`. In a
- *     long-lived MCP server that turns "you didn't name an org" into a dead
- *     server for every subsequent tool call. Everything here RETURNS.
- *  2. `run402-mcp` ships `dist` + `core/dist` + `sdk/dist`; `cli/` is not in
- *     the published package, so the CLI's copy is not importable at runtime.
- *
- * What IS shared is the thing worth sharing — the binding-file reader and the
- * profile-state getter, both in core. Precedence is a short, explicit list
- * here rather than a second general resolver.
- *
- * The directory walked is the SERVER's working directory. An MCP server is
- * spawned once, typically in the checkout the agent is working in, and its cwd
- * does not follow the agent afterwards. That is the right default and a real
- * limit: a server spawned outside the checkout finds no binding and falls
- * through to the environment and the profile, which is a graceful miss rather
- * than a wrong room.
- */
-function resolveAmbientRoom(cwd, env) {
-    // The compound env form names both halves and outranks the rest — a harness
-    // wired with RUN402_ROOM reaches exactly the room it names.
-    const envRoom = trimmed(env[ROOM_ENV]);
-    if (envRoom) {
-        const slash = envRoom.indexOf("/");
-        if (slash <= 0 || slash === envRoom.length - 1) {
-            // A malformed env value is a value we know nothing about — see
-            // core/dist/redact.js's doc comment:
-            // it must not be echoed raw, since the same class of mistake that put
-            // a private key into RUN402_WALLET can put one into RUN402_ROOM.
-            return { ok: false, error: `${ROOM_ENV} must be "<org_id>/<room_key>" — got ${JSON.stringify(describeRejectedValue(envRoom))}.` };
-        }
-        return { ok: true, room: { orgId: envRoom.slice(0, slash), roomKey: envRoom.slice(slash + 1) } };
-    }
-    const bindingRoom = findBindingKey(cwd, "room");
-    const roomKey = trimmed(bindingRoom?.value);
-    if (!roomKey)
-        return null; // No room key anywhere — the caller reports how to address one.
-    // The org half, highest first: environment, then the checkout's binding,
-    // then the wallet profile's selection.
-    const envOrg = trimmed(env[ORG_ENV]);
-    const bindingOrg = findBindingKey(cwd, "org");
-    // An ambient variable disagreeing with a committed file is the surprise
-    // worth stopping on — the CLI stops here too, and for the same reason. A
-    // binding outranking the PROFILE stays silent; that is what a binding is for.
-    if (envOrg && bindingOrg && envOrg !== bindingOrg.value) {
-        // envOrg is unvalidated here (this resolver does no org-id shape check —
-        // see the module doc comment on why it's a deliberately separate, minimal
-        // implementation), so it must be redacted the same way a rejected value
-        // would be. bindingOrg.value comes from a committed .run402.json, which
-        // by convention never holds a secret.
-        return {
-            ok: false,
-            error: `Ambiguous organization: ${ORG_ENV}=${describeRejectedValue(envOrg)} but ${bindingOrg.file} binds ${bindingOrg.value}. `
-                + "Pass org_id + room_key on this call, unset the variable, or edit the binding file.",
-        };
-    }
-    const orgId = envOrg ?? trimmed(bindingOrg?.value) ?? trimmed(getActiveOrgId());
-    if (!orgId)
-        return null;
-    return { ok: true, room: { orgId, roomKey } };
-}
-export async function resolveRoomArgs(args, opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    const env = opts.env ?? process.env;
-    const hasProject = typeof args.project_id === "string" && args.project_id.length > 0;
-    const hasOrg = typeof args.org_id === "string" && args.org_id.length > 0;
-    const hasRoom = typeof args.room_key === "string" && args.room_key.length > 0;
-    if (hasProject && (hasOrg || hasRoom)) {
-        return { ok: false, error: "Pass either project_id (the project's default room) or org_id + room_key (a named org room) — not both." };
-    }
-    if (hasRoom !== hasOrg) {
-        return { ok: false, error: "org_id and room_key go together — a named room is addressed as org_id + room_key. For a project's default room pass project_id alone." };
-    }
-    // Both explicit forms keep outranking the ambient chain, exactly as they do
-    // in the CLI: a tool call that names a room reaches that room, always.
-    if (hasOrg && hasRoom) {
-        return { ok: true, room: { orgId: args.org_id, roomKey: args.room_key } };
-    }
-    if (!hasProject) {
-        const ambient = resolveAmbientRoom(cwd, env);
-        if (ambient)
-            return ambient;
-        return {
-            ok: false,
-            error: "Address the room: project_id for the project's default room, or org_id + room_key for a named org room. "
-                + `This checkout can also bind one — \`{"org":"<org_id>","room":"<key>"}\` in .run402.json — or set ${ROOM_ENV}="<org_id>/<room_key>".`,
-        };
-    }
-    try {
-        const scoped = await getSdk().rooms.forProject(args.project_id);
-        return { ok: true, room: { orgId: scoped.orgId, roomKey: scoped.roomKey } };
-    }
-    catch (err) {
-        // Surface the real SDK error (project not found, auth, network) instead of
-        // a generic addressing hint — resolveRoomArgs never throws.
-        const mapped = mapSdkError(err, "resolving the project's default room");
-        return { ok: false, error: mapped.content[0]?.text ?? String(err) };
-    }
-}
-const presenceByRoom = new Map();
-/** The name this session asked for, so a replacement presence asks again. */
-const requestedNameByRoom = new Map();
-const roomKeyOf = (room) => `${room.orgId}/${room.roomKey}`;
-export function cachedPresenceId(room) {
-    const env = (process.env.RUN402_PRESENCE_ID ?? "").trim();
-    if (env)
-        return env;
-    return presenceByRoom.get(roomKeyOf(room));
-}
-export function rememberPresence(room, presence, requestedName) {
-    const id = presence?.presence_id;
-    if (typeof id === "string" && id)
-        presenceByRoom.set(roomKeyOf(room), id);
-    // Remember the name ASKED FOR, not the one granted: a replacement should ask
-    // for `Opus` again (-> Opus-3), never for the granted `Opus-2` (-> Opus-2-2).
-    const asked = requestedName ?? presence?.requested_name;
-    if (typeof asked === "string" && asked)
-        requestedNameByRoom.set(roomKeyOf(room), asked);
-}
-export function forgetPresence(room) {
-    presenceByRoom.delete(roomKeyOf(room));
-}
-/**
- * Retry-once on PRESENCE_EXPIRED: drop the cached session presence, REGISTER
- * a replacement (asking for the same name — it suffixes honestly), and retry
- * with it. Registration is explicit because a bare call cannot mean "me".
- *
- * Every call also carries this SERVER PROCESS's resolved session identity
- * (see `../harness-context.js`) alongside any cached `presence_id` — the
- * gateway tries the session identity first, so a presence whose TTL lapsed
- * BETWEEN tool calls (or across a server restart, which starts with an empty
- * in-memory presence cache) revives under its own name via that path rather
- * than 410ing. The retry below is now reached only when no resolvable
- * session identity exists, or the presence aged past the 90-day retention
- * sweep — not on an ordinary period of the server sitting idle.
- */
-export async function withPresenceRetry(room, call) {
-    const presenceId = cachedPresenceId(room);
-    const sessionKey = getSessionKey().key;
-    try {
-        return await call(presenceId, sessionKey);
-    }
-    catch (err) {
-        const code = err?.body?.code
-            ?? err?.code;
-        if (code === "PRESENCE_EXPIRED" && presenceId) {
-            forgetPresence(room);
-            const requestedName = requestedNameByRoom.get(roomKeyOf(room));
-            // kygit-invite design D8: a replacement registration carries
-            // harness-derived labels too.
-            const { program, model } = resolveHarnessLabels();
-            const replacement = await getSdk().rooms.registerPresence(room.orgId, room.roomKey, {
-                ...(requestedName ? { requestedName } : {}),
-                ...(program !== null ? { program } : {}),
-                ...(model !== null ? { model } : {}),
-                sessionKey,
-            });
-            rememberPresence(room, replacement, requestedName);
-            return call(replacement?.presence_id, sessionKey);
-        }
-        throw err;
-    }
-}
-//# sourceMappingURL=rooms-shared.js.map

package/dist/tools/rooms-shared.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rooms-shared.js","sourceRoot":"","sources":["../../src/tools/rooms-shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAiB5E,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,MAAM,OAAO,GAAG,CAAC,CAAU,EAAiB,EAAE,CAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,kBAAkB,CAAC,GAAW,EAAE,GAAsB;IAC7D,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,+DAA+D;YAC/D,qCAAqC;YACrC,sEAAsE;YACtE,iEAAiE;YACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,wCAAwC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QACpI,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,gEAAgE;IAE3F,yEAAyE;IACzE,uCAAuC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE9C,wEAAwE;IACxE,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,MAAM,IAAI,UAAU,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;QACxD,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sCAAsC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,UAAU,CAAC,IAAI,UAAU,UAAU,CAAC,KAAK,IAAI;kBAC3H,oFAAoF;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,OAAkD,EAAE;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,IAAI,UAAU,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yGAAyG,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uIAAuI,EAAE,CAAC;IACvK,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAS,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0GAA0G;kBAC7G,oGAAoG,QAAQ,yBAAyB;SAC1I,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAW,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AACjD,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD,MAAM,SAAS,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AAElF,MAAM,UAAU,gBAAgB,CAAC,IAAkB;IACjD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,QAAiB,EAAE,aAAsB;IAC5F,MAAM,EAAE,GAAI,QAAyD,EAAE,WAAW,CAAC;IACnF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE;QAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,aAAa,IAAK,QAA4D,EAAE,cAAc,CAAC;IAC7G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;QAAE,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAkB,EAClB,IAAwE;IAExE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC,GAAG,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAmD,EAAE,IAAI,EAAE,IAAI;eACvE,GAAyB,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI,KAAK,kBAAkB,IAAI,UAAU,EAAE,CAAC;YAC9C,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,6DAA6D;YAC7D,8BAA8B;YAC9B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,oBAAoB,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;gBAClF,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,UAAU;aACX,CAAC,CAAC;YACH,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/tools/rotate-webhook-secret.d.ts

@@ -1,9 +0,0 @@
-export declare const rotateWebhookSecretSchema: {};
-export declare function handleRotateWebhookSecret(_args: Record<string, never>): Promise<{
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-}>;
-//# sourceMappingURL=rotate-webhook-secret.d.ts.map

package/dist/tools/rotate-webhook-secret.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotate-webhook-secret.d.ts","sourceRoot":"","sources":["../../src/tools/rotate-webhook-secret.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,IAAK,CAAC;AAE5C,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBhF"}

package/dist/tools/rotate-webhook-secret.js

@@ -1,26 +0,0 @@
-import { getSdk } from "../sdk.js";
-import { mapSdkError } from "../errors.js";
-import { requireWalletAuth } from "../wallet-auth.js";
-export const rotateWebhookSecretSchema = {};
-export async function handleRotateWebhookSecret(_args) {
-    const auth = requireWalletAuth("/agent/v1/webhook-secret/rotate");
-    if ("error" in auth)
-        return auth.error;
-    try {
-        const result = await getSdk().admin.rotateWebhookSecret();
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: `${JSON.stringify(result, null, 2)}\n\n` +
-                        `IMPORTANT: this secret will not be shown again. Store it securely (vault, env file, secret manager).\n` +
-                        `The previous secret remains valid for ${result.grace_window_hours} hours so webhook receivers can update without downtime.`,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        return mapSdkError(err, "rotating webhook signing secret");
-    }
-}
-//# sourceMappingURL=rotate-webhook-secret.js.map

package/dist/tools/rotate-webhook-secret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rotate-webhook-secret.js","sourceRoot":"","sources":["../../src/tools/rotate-webhook-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA4B;IAE5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;IAClE,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC1D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM;wBACxC,wGAAwG;wBACxG,yCAAyC,MAAM,CAAC,kBAAkB,0DAA0D;iBAC/H;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC"}

package/dist/tools/run-sql.d.ts

@@ -1,18 +0,0 @@
-import { z } from "zod";
-export declare const runSqlSchema: {
-    project_id: z.ZodOptional<z.ZodString>;
-    sql: z.ZodString;
-    params: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
-};
-export declare function handleRunSql(args: {
-    project_id?: string;
-    sql: string;
-    params?: unknown[];
-}): Promise<{
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-}>;
-//# sourceMappingURL=run-sql.d.ts.map

package/dist/tools/run-sql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-sql.d.ts","sourceRoot":"","sources":["../../src/tools/run-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,YAAY;;;;CAIxB,CAAC;AAyBF,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA+CjF"}

package/dist/tools/run-sql.js

@@ -1,68 +0,0 @@
-import { z } from "zod";
-import { getSdk } from "../sdk.js";
-import { mapSdkError } from "../errors.js";
-import { resolveProjectId } from "../active-project.js";
-export const runSqlSchema = {
-    project_id: z.string().optional().describe("The project ID to run SQL against (defaults to the active project)"),
-    sql: z.string().describe("SQL statement to execute (DDL or DML)"),
-    params: z.array(z.unknown()).optional().describe("Bind parameters for parameterized queries (e.g. [42, \"hello\"])"),
-};
-function formatMarkdownTable(rows) {
-    if (rows.length === 0)
-        return "_0 rows returned_";
-    const columns = Object.keys(rows[0]);
-    const header = `| ${columns.join(" | ")} |`;
-    const separator = `| ${columns.map(() => "---").join(" | ")} |`;
-    const body = rows.map((row) => `| ${columns.map((c) => String(row[c] ?? "NULL")).join(" | ")} |`);
-    return [header, separator, ...body].join("\n");
-}
-/** Render the result column descriptors as a compact "Columns:" line. */
-function formatColumns(fields) {
-    if (!fields || fields.length === 0)
-        return null;
-    return ("Columns: " + fields.map((f) => (f.type ? `${f.name} (${f.type})` : f.name)).join(", "));
-}
-export async function handleRunSql(args) {
-    const project = await resolveProjectId(args.project_id);
-    if (typeof project !== "string")
-        return project;
-    let body;
-    try {
-        body = await getSdk().projects.sql(project, args.sql, args.params);
-    }
-    catch (err) {
-        return mapSdkError(err, "running SQL");
-    }
-    // The wire field is snake_case `row_count` (docs/style.md).
-    const { rows, row_count: rowCount, schema, fields } = body;
-    const columns = formatColumns(fields);
-    // The gateway distinguishes statement kinds by `row_count`: a result set
-    // (SELECT / ... RETURNING) populates `rows`; an INSERT/UPDATE/DELETE returns
-    // `rows: []` with a numeric affected-row count; DDL returns `row_count: null`.
-    // Surface each kind explicitly — never report a mutation that changed rows
-    // as "0 rows returned", which reads to an agent like the statement no-op'd.
-    // `fields` (present only for result-set queries) carries the column names +
-    // types, so an empty SELECT still conveys its shape.
-    let text;
-    if (rows.length > 0) {
-        const head = `**${rows.length} row${rows.length !== 1 ? "s" : ""} returned** (schema: ${schema})`;
-        text = `${head}${columns ? `\n${columns}` : ""}\n\n${formatMarkdownTable(rows)}`;
-    }
-    else if (typeof rowCount === "number" && rowCount > 0) {
-        text = `**${rowCount} row${rowCount !== 1 ? "s" : ""} affected** (schema: ${schema})`;
-    }
-    else if (rowCount === 0) {
-        // An empty result set OR a no-match mutation. When `fields` is present the
-        // statement was a SELECT / ... RETURNING, so surface the column shape — an
-        // empty SELECT still teaches the agent what it would have returned, instead
-        // of a blind "0 rows". Absent fields ⇒ a mutation that matched nothing.
-        const head = `**0 rows** (schema: ${schema})`;
-        text = columns ? `${head}\n${columns}` : head;
-    }
-    else {
-        // DDL and other statements with no row semantics (row_count === null).
-        text = `**Statement executed** (schema: ${schema})`;
-    }
-    return { content: [{ type: "text", text }] };
-}
-//# sourceMappingURL=run-sql.js.map

package/dist/tools/run-sql.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-sql.js","sourceRoot":"","sources":["../../src/tools/run-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IAChH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;CACrH,CAAC;AAEF,SAAS,mBAAmB,CAAC,IAA+B;IAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAElD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAC3E,CAAC;IAEF,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CACpB,MAAqD;IAErD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,CACL,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAIlC;IACC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAEhD,IAAI,IAMH,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAgB,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACzC,CAAC;IAED,4DAA4D;IAC5D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtC,yEAAyE;IACzE,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,qDAAqD;IACrD,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,MAAM,GAAG,CAAC;QAClG,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;IACnF,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,GAAG,KAAK,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,MAAM,GAAG,CAAC;IACxF,CAAC;SAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,IAAI,GAAG,uBAAuB,MAAM,GAAG,CAAC;QAC9C,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,IAAI,GAAG,mCAAmC,MAAM,GAAG,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/tools/scaffold-roles.d.ts

@@ -1,22 +0,0 @@
-import { z } from "zod";
-export declare const scaffoldRolesSchema: {
-    table: z.ZodOptional<z.ZodString>;
-    user_col: z.ZodOptional<z.ZodString>;
-    role_col: z.ZodOptional<z.ZodString>;
-    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    cache_ttl: z.ZodOptional<z.ZodNumber>;
-};
-export declare function handleScaffoldRoles(args: {
-    table?: string;
-    user_col?: string;
-    role_col?: string;
-    roles?: string[];
-    cache_ttl?: number;
-}): {
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-};
-//# sourceMappingURL=scaffold-roles.d.ts.map

package/dist/tools/scaffold-roles.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scaffold-roles.d.ts","sourceRoot":"","sources":["../../src/tools/scaffold-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,mBAAmB;;;;;;CA2B/B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAuDxE"}

package/dist/tools/scaffold-roles.js

@@ -1,88 +0,0 @@
-import { z } from "zod";
-// Pure, offline generator — no SDK / network / project. Emits the conventional
-// role-table migration, the matching requireRole gate snippet, and a
-// first-operator bootstrap. (Keep in sync with the CLI `auth scaffold-roles`
-// command in cli/lib/auth.mjs — same artifacts, different presentation.)
-const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
-export const scaffoldRolesSchema = {
-    table: z
-        .string()
-        .regex(IDENT)
-        .optional()
-        .describe("Role table name (unquoted SQL identifier). Default: app_roles."),
-    user_col: z
-        .string()
-        .regex(IDENT)
-        .optional()
-        .describe("User-id column — matches the tenant user id (internal.users.id / JWT 'sub'). Default: user_id."),
-    role_col: z
-        .string()
-        .regex(IDENT)
-        .optional()
-        .describe("Role column. Default: role."),
-    roles: z
-        .array(z.string().min(1))
-        .optional()
-        .describe('Allowed roles. Default: ["operator"].'),
-    cache_ttl: z
-        .number()
-        .int()
-        .min(0)
-        .max(600)
-        .optional()
-        .describe("Role-lookup cache seconds (0-600). Default: 60. 0 = instant revocation (fresh DB read per request)."),
-};
-export function handleScaffoldRoles(args) {
-    const table = args.table ?? "app_roles";
-    const userCol = args.user_col ?? "user_id";
-    const roleCol = args.role_col ?? "role";
-    const allowed = (args.roles && args.roles.length > 0 ? args.roles : ["operator"])
-        .map((r) => r.trim())
-        .filter(Boolean);
-    if (allowed.length === 0) {
-        return { isError: true, content: [{ type: "text", text: "roles must contain at least one non-empty role" }] };
-    }
-    const cacheTtl = args.cache_ttl ?? 60;
-    const firstRole = allowed[0];
-    const migration = `-- Conventional Run402 role table: single role per user, keyed on the tenant user id.
-CREATE TABLE IF NOT EXISTS ${table} (
-  ${userCol} uuid NOT NULL,
-  ${roleCol} text NOT NULL,
-  PRIMARY KEY (${userCol})
-);`;
-    const gate = { table, idColumn: userCol, roleColumn: roleCol, allowed, cacheTtl };
-    const bootstrap = `-- First-operator bootstrap: run ONCE with the SERVICE key (bypasses RLS).
--- Replace <FIRST_OPERATOR_USER_ID> with the tenant user id (internal.users.id /
--- the JWT 'sub') of the first '${firstRole}' — NOT a wallet address.
-INSERT INTO ${table} (${userCol}, ${roleCol})
-VALUES ('<FIRST_OPERATOR_USER_ID>', '${firstRole}')
-ON CONFLICT (${userCol}) DO NOTHING;`;
-    const text = [
-        "## Role-gate scaffold",
-        "",
-        "**1. Migration** (apply once, or via your deploy spec's database migrations):",
-        "```sql",
-        migration,
-        "```",
-        "",
-        "**2. `requireRole` gate** — put this on the function in your deploy spec (`spec.functions[].requireRole`):",
-        "```json",
-        JSON.stringify(gate, null, 2),
-        "```",
-        "",
-        `**3. In the function:** \`await auth.requireRole(${JSON.stringify(firstRole)})\` — or \`await auth.role()\` to branch when \`allowed\` has multiple roles.`,
-        "",
-        "**4. First-operator bootstrap** (the table starts empty — grant the first role once with the service key):",
-        "```sql",
-        bootstrap,
-        "```",
-        "",
-        "Notes:",
-        "- `requireRole(x)` requires `x` to be in `allowed`; for multi-role gates read `auth.role()` and branch instead of re-asserting.",
-        "- `cacheTtl` is the role-lookup cache in seconds; set it to `0` for instant revocation (fresh DB read per request).",
-        "- The gate keys on the tenant **user id** (`internal.users.id` / JWT `sub`), NOT a wallet address.",
-        `- The gate accepts any table/columns — \`${table}(${userCol}, ${roleCol})\` is the blessed default; point \`requireRole\` at your own table if you already have one.`,
-    ].join("\n");
-    return { content: [{ type: "text", text }] };
-}
-//# sourceMappingURL=scaffold-roles.js.map

package/dist/tools/scaffold-roles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scaffold-roles.js","sourceRoot":"","sources":["../../src/tools/scaffold-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,qEAAqE;AACrE,6EAA6E;AAC7E,yEAAyE;AAEzE,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,KAAK,CAAC,KAAK,CAAC;SACZ,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,KAAK,CAAC;SACZ,QAAQ,EAAE;SACV,QAAQ,CAAC,gGAAgG,CAAC;IAC7G,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,KAAK,CAAC;SACZ,QAAQ,EAAE;SACV,QAAQ,CAAC,6BAA6B,CAAC;IAC1C,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CAAC,uCAAuC,CAAC;IACpD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qGAAqG,CAAC;CACnH,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,IAMnC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gDAAgD,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG;6BACS,KAAK;IAC9B,OAAO;IACP,OAAO;iBACM,OAAO;GACrB,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClF,MAAM,SAAS,GAAG;;kCAEc,SAAS;cAC7B,KAAK,KAAK,OAAO,KAAK,OAAO;uCACJ,SAAS;eACjC,OAAO,eAAe,CAAC;IAEpC,MAAM,IAAI,GAAG;QACX,uBAAuB;QACvB,EAAE;QACF,+EAA+E;QAC/E,QAAQ;QACR,SAAS;QACT,KAAK;QACL,EAAE;QACF,4GAA4G;QAC5G,SAAS;QACT,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,KAAK;QACL,EAAE;QACF,oDAAoD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,+EAA+E;QAC5J,EAAE;QACF,4GAA4G;QAC5G,QAAQ;QACR,SAAS;QACT,KAAK;QACL,EAAE;QACF,QAAQ;QACR,iIAAiI;QACjI,qHAAqH;QACrH,oGAAoG;QACpG,4CAA4C,KAAK,IAAI,OAAO,KAAK,OAAO,8FAA8F;KACvK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/C,CAAC"}

package/dist/tools/send-email.d.ts

@@ -1,50 +0,0 @@
-import { z } from "zod";
-export declare const sendEmailSchema: {
-    project_id: z.ZodString;
-    to: z.ZodString;
-    template: z.ZodOptional<z.ZodEnum<["project_invite", "magic_link", "notification"]>>;
-    variables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    subject: z.ZodOptional<z.ZodString>;
-    html: z.ZodOptional<z.ZodString>;
-    text: z.ZodOptional<z.ZodString>;
-    from_name: z.ZodOptional<z.ZodString>;
-    in_reply_to: z.ZodOptional<z.ZodString>;
-    mailbox: z.ZodOptional<z.ZodString>;
-    attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        filename: z.ZodString;
-        content_base64: z.ZodString;
-        content_type: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        content_type: string;
-        filename: string;
-        content_base64: string;
-    }, {
-        content_type: string;
-        filename: string;
-        content_base64: string;
-    }>, "many">>;
-};
-export declare function handleSendEmail(args: {
-    project_id: string;
-    to: string;
-    template?: string;
-    variables?: Record<string, string>;
-    subject?: string;
-    html?: string;
-    text?: string;
-    from_name?: string;
-    in_reply_to?: string;
-    mailbox?: string;
-    attachments?: Array<{
-        filename: string;
-        content_base64: string;
-        content_type: string;
-    }>;
-}): Promise<{
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-    isError?: boolean;
-}>;
-//# sourceMappingURL=send-email.d.ts.map

package/dist/tools/send-email.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"send-email.d.ts","sourceRoot":"","sources":["../../src/tools/send-email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;CAqC3B,CAAC;AAEF,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CA6CjF"}