specguard-mcp 0.1.17 → 0.1.19

package/README.md

@@ -34,8 +34,8 @@ refuses to boot and takes the tools that needed no configuration down with it.
 | --- | --- | --- | --- |
 | `SPECGUARD_ENDPOINT` | `get_repository_overview`, `list_repositories`, `add_repository`, `registrable_repositories` | — | your SpecGuard instance's root URL, **including the scheme** — e.g. `https://specguard.example.com`, or `http://localhost:3000`. A value with no scheme is refused by name (`SPECGUARD_ENDPOINT is not a usable URL: "sg.example.com"`) rather than surfacing later as an opaque failure. `SPECGUARD_URL` is accepted as an alias, and is the name every message uses when it is the one you set. A blank value counts as unset, so leaving `SPECGUARD_ENDPOINT` empty in a templated config falls through to `SPECGUARD_URL` instead of suppressing it |
 | `SPECGUARD_API_KEY` | `get_repository_overview`, `near_duplicate_clusters` (default calls) | — | an agent/CI API key (`sgk_…`) issued by that deployment — a **per-repository** key, which is the single repository those tools answer about by default |
-| `SPECGUARD_USER_API_KEY` | `list_repositories` (fallback), `add_repository`, `registrable_repositories`, `remove_repository` (fallback), `create_repository_api_key`, `revoke_repository_api_key`, `list_repository_agent_keys`, `revoke_repository_agent_key`, `list_repository_agent_keys_presented_revoked`, `list_repository_members`, `add_repository_member`, `update_repository_member_permissions`, `remove_repository_member`, `rename_repository` | — | a **user** API key (`sgu_…`), minted from that deployment's account page. A different credential from the one above, not a second place to put the same value: SpecGuard decides which of them a request may use from the token's prefix, before it reads anything, and answers `401` for the other one. Set whichever your tools need — both, if you use both |
-| `SPECGUARD_AGENT_API_KEY` | `list_repositories` (preferred), `remove_repository` (preferred), `get_repository_overview` / `near_duplicate_clusters` **with** `repository` | — | an **agent** API key (`sga_…`), minted from that deployment's account page (Agent keys panel) with an explicit set of repositories and permissions. It speaks for nobody: its reach is exactly the set granted onto it, fixed at mint time, and every read is bounded by that set server-side. This is the credential to give an automated agent — one key, many repositories, none of a person's rights. When it and `SPECGUARD_USER_API_KEY` are both set, `list_repositories` and `remove_repository` use **this** one, so discovery stays inside the set the other tools can reach |
+| `SPECGUARD_USER_API_KEY` | `list_repositories` (fallback), `add_repository`, `registrable_repositories`, `remove_repository` (fallback), `create_repository_api_key` (fallback), `revoke_repository_api_key` (fallback), `list_repository_agent_keys` (fallback), `revoke_repository_agent_key` (fallback), `list_repository_agent_keys_presented_revoked` (fallback), `list_repository_members` (fallback), `add_repository_member` (fallback), `update_repository_member_permissions` (fallback), `remove_repository_member` (fallback), `get_repository_overview` / `near_duplicate_clusters` **with** `repository` (fallback), `rename_repository` | — | a **user** API key (`sgu_…`), minted from that deployment's account page. A different credential from the one above, not a second place to put the same value: SpecGuard decides which of them a request may use from the token's prefix, before it reads anything, and answers `401` for the other one. Set whichever your tools need — both, if you use both |
+| `SPECGUARD_AGENT_API_KEY` | `list_repositories` (preferred), `remove_repository` (preferred), `create_repository_api_key` (preferred), `revoke_repository_api_key` (preferred), `list_repository_agent_keys` (preferred), `revoke_repository_agent_key` (preferred), `list_repository_agent_keys_presented_revoked` (preferred), `list_repository_members` (preferred), `add_repository_member` (preferred), `update_repository_member_permissions` (preferred), `remove_repository_member` (preferred), `get_repository_overview` / `near_duplicate_clusters` **with** `repository` (preferred) | — | an **agent** API key (`sga_…`), minted from that deployment's account page (Agent keys panel) with an explicit set of repositories and permissions. It speaks for nobody: its reach is exactly the set granted onto it, fixed at mint time, and every read is bounded by that set server-side. This is the credential to give an automated agent — one key, many repositories, none of a person's rights. When it and `SPECGUARD_USER_API_KEY` are both set, every tool that answers either key — `list_repositories`, `remove_repository`, the members tools, the key-lifecycle tools, and `get_repository_overview` / `near_duplicate_clusters` **with** `repository` — uses **this** one, so discovery stays inside the set the other tools can reach |
 | `SPECGUARD_LINT_COMMAND` | `lint_intent_annotations` | `specguard-lint` | the command that runs the linter. Most Ruby projects need `bundle exec specguard-lint` |
 | `SPECGUARD_TIMEOUT_MS` | HTTP tools | `30000` | how long a call to SpecGuard may take |
 
@@ -106,24 +106,29 @@ branch window rather than between the last two runs.
 Everything above is answered about **one repository**, and which one has two spellings. By default
 it is the repository the configured `sgk_…` key resolves to — the key *is* the subject. Pass
 `repository` (the numeric id `list_repositories` reports) and the call goes to the **plural**
-endpoint, `GET /api/v1/repositories/:id`, under the **agent key** (`SPECGUARD_AGENT_API_KEY`,
-`sga_…`): same overview body, same ladder, every parameter below honoured identically — with one
+endpoint, `GET /api/v1/repositories/:id`, which answers **either member credential**, whichever is
+set: `SPECGUARD_AGENT_API_KEY` (`sga_…`) — preferred, and the set of repositories granted onto it
+at mint time is the boundary ids are looked up inside (`list_repositories` under the same key lists
+exactly the set that is reachable) — or, when no agent key is set, `SPECGUARD_USER_API_KEY`
+(`sgu_…`), a **person** key whose accessible set is the boundary instead. With both set the agent
+key wins, so the answer stays inside the set that key can act on. Same overview body, same ladder,
+every parameter below honoured identically — with one
 deliberate omission this path owns: `api_key` is **absent** from the plural body rather than nulled,
-because that block describes the credential that made the request and this request was not made
-with a repository key (an absent key there is the surface's shape, never a dropped block). Other
+because that block describes the credential that made the request and no member credential is a
+repository key (an absent key there is the surface's shape, never a dropped block). Other
 than that, only the subject moves. That is what makes the *other* repositories visible: an `sgk_`
 key is one repository
-by design, so an agent holding only that could never ask about a second one, while the agent key's
-own granted repository set is exactly the boundary the plural endpoint looks ids up inside (a
-repository outside the set answers 404, indistinguishable from one that does not exist —
-`list_repositories` under the same key lists the set that is reachable). SpecGuard refuses each
+by design, so a credential holding only that could never ask about a second one. The server owns
+every refusal on the plural path: a repository outside the presented credential's grant answers
+404, indistinguishable from one that does not exist, person and agent alike. SpecGuard refuses each
 credential kind in the other's place before it reads anything, so the pairing is not mixable: the
-default call wants the `sgk_` key, the `repository` call wants the agent key, and a call made with
-the wrong one is refused *here*, naming the variable to set, before any request is made.
+default call wants the `sgk_` key, the `repository` call wants a member key — and a call made with
+the wrong kind, or with neither member key set, is refused *here*, naming the variable(s) to set,
+before any request is made.
 
 | argument | |
 | --- | --- |
-| `repository` | ask about THIS repository (its numeric id from `list_repositories`) under the **agent key**, instead of the one the `sgk_…` key resolves to — omit it for the default, `sgk_`-keyed call |
+| `repository` | ask about THIS repository (its numeric id from `list_repositories`) under the **agent key** (`SPECGUARD_AGENT_API_KEY`, `sga_…`), or — when no agent key is set — the **user key** (`SPECGUARD_USER_API_KEY`, `sgu_…`), instead of the one the `sgk_…` key resolves to — omit it for the default, `sgk_`-keyed call |
 | `branch` | narrow the run **history** to one branch, for a real growth series — and unlock `unstable_tests` and `directory_growth`, which read the same window |
 | `spec_directory` | open ONE of the heaviest directories and list the spec files inside it |
 | `spec_file` | open ONE of the heaviest spec files and list the individual examples inside it |
@@ -410,7 +415,8 @@ never used.
 Registering a repository is `add_repository`, below — it reads `SPECGUARD_USER_API_KEY` (an
 `sgu_…` key, which this tool also accepts but does not require) and takes the `full_name` this
 tool reports. Removal and the key lifecycle (`remove_repository`,
-`create_repository_api_key`, `revoke_repository_api_key`) are below too, on the same key; a tool
+`create_repository_api_key`, `revoke_repository_api_key`) are below too, on the same
+either-credential rule; a tool
 here is a promise the agent will act on, so each waits for the capability rather than the other way
 round.
 
@@ -514,13 +520,16 @@ every run; one call returns them all. (The server reads only that the `near_dupl
 
 | argument | |
 | --- | --- |
-| `repository` | census THIS repository (its numeric id from `list_repositories`) under the **agent key** (`SPECGUARD_AGENT_API_KEY`, `sga_…`), instead of the one the `sgk_…` key resolves to — omit it for the default, `sgk_`-keyed census |
+| `repository` | census THIS repository (its numeric id from `list_repositories`) under the **agent key** (`SPECGUARD_AGENT_API_KEY`, `sga_…`), or — when no agent key is set — the **user key** (`SPECGUARD_USER_API_KEY`, `sgu_…`), instead of the one the `sgk_…` key resolves to — omit it for the default, `sgk_`-keyed census |
 
 The credential changes with `repository`, exactly as on `get_repository_overview`: the plural
-endpoint answers under the agent key, whose mint-time granted repository set is the boundary the id
-is looked up inside, and the two credential kinds refuse each other's tokens — so a
-`repository` ask without the agent key is refused *here*, naming the variable, before any request
-is made.
+endpoint answers **either member credential**, whichever is set — the agent key preferred (its
+mint-time granted repository set is the boundary the id is looked up inside), the user key when no
+agent key is set (its accessible set is the boundary instead), the agent key winning when both are
+present — and the credential kinds refuse each other's tokens, so a
+`repository` ask with neither member key set is refused *here*, naming both variables, before any
+request is made. A repository outside the presented credential's grant answers 404 at the server,
+person and agent alike.
 
 Read the response with its own rules in mind:
 
@@ -543,9 +552,9 @@ Read the response with its own rules in mind:
 Without `repository`, same credential and endpoint as `get_repository_overview`'s default
 (`sgk_…` repository key on `GET /api/v1/repository`); the response is that body with the
 `near_duplicates` block opened, passed through unmodified. With `repository`, the plural endpoint
-answers under the agent key, exactly as on `get_repository_overview` — and carries that path's
-one deliberate omission: `api_key` is **absent** from the plural body rather than nulled, because
-the block describes the credential that made the request and this request was not made with a
+answers either member credential, exactly as on `get_repository_overview` — and carries that
+path's one deliberate omission: `api_key` is **absent** from the plural body rather than nulled,
+because the block describes the credential that made the request and no member credential is a
 repository key (an absent key there is the surface's shape, never a dropped block).
 
 ### `remove_repository`
@@ -592,9 +601,15 @@ The body comes back as SpecGuard serves it: an `api_key` block (`name`, `token`,
 Authorization is the `keys_manage` capability; a member without it is refused `403` with SpecGuard's
 own sentence, verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`keys.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the mint answers inside the same set
+`list_repositories` reports. Minting under the agent credential attributes the new key to the agent
+key's **owner** (the server's `attributed_user` rule), so minted-key counts keep naming a person
+rather than nobody.
 
 ### `revoke_repository_api_key`
 
@@ -615,9 +630,13 @@ replacement with `create_repository_api_key` and deploy it BEFORE revoking the o
 first and the repository's CI is locked out until a human mints a new key in a browser. A `204`
 means the key is revoked.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`keys.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the revoke answers inside the same set
+`list_repositories` reports.
 
 ### `list_repository_agent_keys`
 
@@ -640,8 +659,14 @@ arriving is `list_repository_agent_keys_presented_revoked`'s question.
 time and nothing persisted it. Authorization is the `keys_manage` capability; a caller without it
 is refused `403` with SpecGuard's own sentence, verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repositories` and
-`add_repository` and a different one from the `sgk_…` key `get_repository_overview` uses.
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`keys.manage` — a repository outside that set is answered `404` in SpecGuard's own words, so an
+agent credential administers the agent keys covering its own set without a person's `sgu_` key.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the answer stays inside the same set
+`list_repositories` reports.
 
 ### `revoke_repository_agent_key`
 
@@ -667,8 +692,14 @@ or one already revoked, is refused `404`, never a cross-repository cut. Authoriz
 `keys_manage` capability; a caller without it is refused `403` with SpecGuard's own sentence,
 verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repositories` and
-`add_repository` and a different one from the `sgk_…` key `get_repository_overview` uses.
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`keys.manage` — a repository outside that set is answered `404` in SpecGuard's own words, so an
+agent credential can cut one of its own kind without a person's `sgu_` key.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the cut answers inside the same set
+`list_repositories` reports.
 
 ### `list_repository_agent_keys_presented_revoked`
 
@@ -691,8 +722,14 @@ it as the offboarding having fully taken.
 time and nothing persisted it. Authorization is the `keys_manage` capability; a caller without it
 is refused `403` with SpecGuard's own sentence, verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`), the same credential as `list_repositories` and
-`add_repository` and a different one from the `sgk_…` key `get_repository_overview` uses.
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`keys.manage` — a repository outside that set is answered `404` in SpecGuard's own words, so an
+agent credential can verify its own offboarding without a person's `sgu_` key.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the triage stays inside the same set
+`list_repositories` reports.
 
 ### `list_repository_members`
 
@@ -714,9 +751,13 @@ Authorization is the `members.manage` capability: a caller who is not a member i
 (the repository's existence stays hidden), and a member without `members.manage` is refused `403`
 with SpecGuard's own sentence, verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`members.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the answer stays inside the same set
+`list_repositories` reports.
 
 ### `add_repository_member`
 
@@ -732,7 +773,8 @@ permissions.
 Each resolution failure — nobody has signed in as that handle yet, the account is archived, the
 handle is ambiguous, the handle is not a login — arrives as a **distinguishable** 400 message
 naming the exact next move. The grantor recorded on the membership is always the person behind
-`SPECGUARD_USER_API_KEY`; no argument can name a different one.
+the credential — the one an `sgu_…` key speaks for, or the **owner** of the `sga_…` agent key.
+The server stamps it; no argument can name a different one.
 
 On success (`201`) the response carries a `member` block whose **`id` is the membership id**
 (alongside `handle`, `permissions`, `granted_by`, `created_at`) — the identifier
@@ -740,9 +782,15 @@ On success (`201`) the response carries a `member` block whose **`id` is the mem
 `members.manage` capability; a member without it is refused `403` with SpecGuard's own sentence,
 verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`members.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the grant answers inside the same set
+`list_repositories` reports. Under the agent credential the grant is bounded twice: the key cannot
+grant a permission it does not itself hold — SpecGuard answers `400` naming the over-reach — and
+the membership is recorded against the key's **owner**.
 
 ### `update_repository_member_permissions`
 
@@ -766,9 +814,15 @@ ids are scoped to the repository (a foreign id is refused `404`). Authorization
 `members.manage` capability; a member without it is refused `403` with SpecGuard's own sentence,
 verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`members.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the edit answers inside the same set
+`list_repositories` reports. Under the agent credential the replacement set is bounded twice: the
+key cannot grant a permission it does not itself hold — SpecGuard answers `400` naming the
+over-reach — and the re-stamped grantor is the key's **owner**.
 
 ### `remove_repository_member`
 
@@ -790,9 +844,13 @@ number on the wire, so pass it as a string, not as a number (see the edit tool a
 Authorization is the `members.manage` capability; a member without it is refused `403` with
 SpecGuard's own sentence, verbatim.
 
-It reads `SPECGUARD_USER_API_KEY` (`sgu_…`) — the same **person** key `add_repository` reads, and
-a different one from the `sgk_…` key `get_repository_overview` uses; `list_repositories` also
-accepts that key but does not require it (its agent key wins when both are set).
+It reads either of two credentials, whichever is set — and a different one from the `sgk_…` key
+`get_repository_overview` uses. `SPECGUARD_AGENT_API_KEY` (`sga_…`) when it is set: the call then
+reaches only the repositories granted onto that key at mint time, and only where the grant carries
+`members.manage` — a repository outside that set is answered `404` in SpecGuard's own words.
+`SPECGUARD_USER_API_KEY` (`sgu_…`) when no agent key is set: the same **person** key `add_repository`
+reads. With both set the **agent** key wins, so the revoke answers inside the same set
+`list_repositories` reports.
 
 ### `rename_repository`
 

package/dist/src/tools/add-repository-member.js

@@ -1,4 +1,4 @@
-import { postJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { postJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { optionalStringArray, requireString } from "./args.js";
 /**
  * `POST /api/v1/repositories/:repository_id/members` as a tool — shipped in the
@@ -38,8 +38,9 @@ const addRepositoryMember = {
         "SpecGuard refuses each of those with its own sentence, and every other resolution failure " +
         "(nobody has signed in as that handle yet, the account is archived, the handle is ambiguous) " +
         "arrives as a distinguishable 400 message naming the exact next move. " +
-        "The grantor recorded on the membership is always the person behind this server's user API " +
-        "key — the server stamps it, and no argument can name a different one. " +
+        "The grantor recorded on the membership is always the person behind the credential — the one " +
+        "an sgu_… key speaks for, or the OWNER of the sga_… agent key. The server stamps it, and no " +
+        "argument can name a different one. " +
         "On success (201) the response carries a `member` block whose `id` is the MEMBERSHIP id " +
         "(`handle`, `permissions`, `granted_by`, `created_at` alongside) — the very identifier " +
         "`update_repository_member_permissions` and `remove_repository_member` name. The id is not " +
@@ -53,8 +54,17 @@ const addRepositoryMember = {
         "SpecGuard's own words. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
         "handle. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential `add_repository` " +
-        "writes with and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two member-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `members.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential " +
+        "`add_repository` writes with). With both set the agent key wins, so the grant answers inside " +
+        "the same set `list_repositories` reports. Under the agent credential the grant is bounded " +
+        "twice: the key cannot grant a permission it does not itself hold (SpecGuard answers 400 " +
+        "naming the over-reach), and the membership is recorded against the key's owner. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses.",
     inputSchema: {
         type: "object",
         properties: {
@@ -88,7 +98,7 @@ const addRepositoryMember = {
         const repositoryId = requireString(args["repository_id"], "repository_id");
         const handle = requireString(args["handle"], "handle");
         const permissions = optionalStringArray(args["permissions"], "permissions");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         // Top-level `{handle, permissions}` — the shape the controller permits,
         // matching `add_repository`'s stated rule: this is JSON an agent writes,
         // not a Rails form. `permissions` omitted when absent so the server's own

package/dist/src/tools/add-repository-member.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-repository-member.js","sourceRoot":"","sources":["../../../src/tools/add-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,mBAAmB,GAAmB;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,4FAA4F;QAC5F,uBAAuB;QACvB,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,4FAA4F;QAC5F,wEAAwE;QACxE,yFAAyF;QACzF,wFAAwF;QACxF,4FAA4F;QAC5F,qFAAqF;QACrF,cAAc;QACd,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,0CAA0C;QAC1C,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,mFAAmF;oBACnF,uCAAuC;aAC1C;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,2EAA2E;oBAC3E,mFAAmF;oBACnF,oFAAoF;oBACpF,mBAAmB;aACtB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,wEAAwE;QACxE,oCAAoC;QACpC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAChE,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"add-repository-member.js","sourceRoot":"","sources":["../../../src/tools/add-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,mBAAmB,GAAmB;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,4FAA4F;QAC5F,uBAAuB;QACvB,0FAA0F;QAC1F,4FAA4F;QAC5F,8FAA8F;QAC9F,uEAAuE;QACvE,8FAA8F;QAC9F,6FAA6F;QAC7F,qCAAqC;QACrC,yFAAyF;QACzF,wFAAwF;QACxF,4FAA4F;QAC5F,qFAAqF;QACrF,cAAc;QACd,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,0CAA0C;QAC1C,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,kFAAkF;QAClF,+FAA+F;QAC/F,4FAA4F;QAC5F,0FAA0F;QAC1F,kFAAkF;QAClF,kGAAkG;QAClG,OAAO;IACT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,mFAAmF;oBACnF,uCAAuC;aAC1C;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,2EAA2E;oBAC3E,mFAAmF;oBACnF,oFAAoF;oBACpF,mBAAmB;aACtB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,wEAAwE;QACxE,oCAAoC;QACpC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAChE,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/dist/src/tools/create-repository-api-key.js

@@ -1,4 +1,4 @@
-import { postJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { postJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { optionalString, requireString } from "./args.js";
 /**
  * `POST /api/v1/repositories/:repository_id/api_keys` as a tool — shipped in
@@ -40,9 +40,17 @@ const createRepositoryApiKey = {
         "`name`, which the server defaults when omitted. " +
         "Authorization is the `keys_manage` capability — a member without it is refused 403 " +
         "in SpecGuard's own words. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential `add_repository` " +
-        "writes with and a DIFFERENT one from the sgk_… repository key " +
-        "`get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two key-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `keys.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential " +
+        "`add_repository` writes with). With both set the agent key wins, so the mint answers inside " +
+        "the same set `list_repositories` reports. Minting under the agent credential attributes the " +
+        "new key to the agent key's OWNER (the server's `attributed_user` rule), so minted-key counts " +
+        "keep naming a person rather than nobody. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key " +
+        "`get_repository_overview` uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -65,7 +73,7 @@ const createRepositoryApiKey = {
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
         const name = optionalString(args["name"], "name");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         // `name` omitted when absent rather than sent as null, so the server's own
         // `ApiKey::DEFAULT_NAME` default applies — this bridge expresses "no
         // preference", it does not choose on the server's behalf.

package/dist/src/tools/create-repository-api-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-repository-api-key.js","sourceRoot":"","sources":["../../../src/tools/create-repository-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,mFAAmF;QACnF,4CAA4C;QAC5C,mFAAmF;QACnF,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,+EAA+E;QAC/E,sEAAsE;QACtE,iFAAiF;QACjF,+BAA+B;QAC/B,qFAAqF;QACrF,kDAAkD;QAClD,qFAAqF;QACrF,4BAA4B;QAC5B,oFAAoF;QACpF,gEAAgE;QAChE,iCAAiC;IACnC,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2EAA2E;oBAC3E,qEAAqE;aACxE;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gFAAgF;oBAChF,6EAA6E;aAChF;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,4EAA4E;QAC5E,+EAA+E;QAC/E,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,2EAA2E;QAC3E,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,WAAW,EACnE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,wEAAwE;QACxE,yEAAyE;QACzE,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"create-repository-api-key.js","sourceRoot":"","sources":["../../../src/tools/create-repository-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,mFAAmF;QACnF,4CAA4C;QAC5C,mFAAmF;QACnF,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,+EAA+E;QAC/E,sEAAsE;QACtE,iFAAiF;QACjF,+BAA+B;QAC/B,qFAAqF;QACrF,kDAAkD;QAClD,qFAAqF;QACrF,4BAA4B;QAC5B,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,6FAA6F;QAC7F,kFAAkF;QAClF,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,2CAA2C;QAC3C,wEAAwE;QACxE,8EAA8E;IAChF,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2EAA2E;oBAC3E,qEAAqE;aACxE;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gFAAgF;oBAChF,6EAA6E;aAChF;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,4EAA4E;QAC5E,+EAA+E;QAC/E,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,2EAA2E;QAC3E,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,WAAW,EACnE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,wEAAwE;QACxE,yEAAyE;QACzE,kCAAkC;QAClC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/tools/list-repository-agent-keys-presented-revoked.js

@@ -1,4 +1,4 @@
-import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { getJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `GET /api/v1/repositories/:repository_id/agent_keys/presented_revoked` as a
@@ -53,8 +53,16 @@ const listRepositoryAgentKeysPresentedRevoked = {
         "Authorization is the `keys_manage` capability — a caller without it is refused 403 in " +
         "SpecGuard's own words. " +
         "Takes `repository_id` (the numeric id `list_repositories` reports, not the `org/repo` handle). " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential the other key-administration " +
-        "tools read and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two key-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `keys.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here — an " +
+        "agent credential verifying its own offboarding needs no person's `sgu_` key to do it) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential the other " +
+        "key-administration tools read). With both set the agent key wins, so the triage stays inside " +
+        "the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -72,7 +80,7 @@ const listRepositoryAgentKeysPresentedRevoked = {
     },
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const body = await getJsonObject(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/agent_keys/presented_revoked`, {}, context.fetch);
         // Passed through unreshaped, the standing rule (`types.ts`: "A thin client
         // that reshapes its upstream is not thin") — and the empty answer passes

package/dist/src/tools/list-repository-agent-keys-presented-revoked.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-repository-agent-keys-presented-revoked.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys-presented-revoked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,uCAAuC,GAAmB;IAC9D,IAAI,EAAE,8CAA8C;IACpD,KAAK,EAAE,yCAAyC;IAChD,WAAW,EACT,8FAA8F;QAC9F,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,iEAAiE;QACjE,+FAA+F;QAC/F,oDAAoD;QACpD,+FAA+F;QAC/F,2DAA2D;QAC3D,8FAA8F;QAC9F,sCAAsC;QACtC,wFAAwF;QACxF,yBAAyB;QACzB,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;IAChG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,yDAAyD;aAC5D;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,+BAA+B,EACvF,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,0CAA0C;QAC1C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uCAAuC,CAAC"}
+{"version":3,"file":"list-repository-agent-keys-presented-revoked.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys-presented-revoked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,uCAAuC,GAAmB;IAC9D,IAAI,EAAE,8CAA8C;IACpD,KAAK,EAAE,yCAAyC;IAChD,WAAW,EACT,8FAA8F;QAC9F,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,iEAAiE;QACjE,+FAA+F;QAC/F,oDAAoD;QACpD,+FAA+F;QAC/F,2DAA2D;QAC3D,8FAA8F;QAC9F,sCAAsC;QACtC,wFAAwF;QACxF,yBAAyB;QACzB,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,4CAA4C;QAC5C,kGAAkG;QAClG,oDAAoD;IACtD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,yDAAyD;aAC5D;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,+BAA+B,EACvF,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,0CAA0C;QAC1C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uCAAuC,CAAC"}

package/dist/src/tools/list-repository-agent-keys.js

@@ -1,4 +1,4 @@
-import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { getJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `GET /api/v1/repositories/:repository_id/agent_keys` as a tool — shipped in
@@ -51,8 +51,16 @@ const listRepositoryAgentKeys = {
         "Authorization is the `keys_manage` capability — a caller without it is refused 403 in " +
         "SpecGuard's own words. " +
         "Takes `repository_id` (the numeric id `list_repositories` reports, not the `org/repo` handle). " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential the other key-administration " +
-        "tools read and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two key-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `keys.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here — an " +
+        "agent credential administering the keys it was granted needs no person's `sgu_` key to do " +
+        "it) and, when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential the " +
+        "other key-administration tools read). With both set the agent key wins, so the answer stays " +
+        "inside the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -70,7 +78,7 @@ const listRepositoryAgentKeys = {
     },
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const body = await getJsonObject(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/agent_keys`, {}, context.fetch);
         // Passed through unreshaped, the standing rule (`types.ts`: "A thin client
         // that reshapes its upstream is not thin") — the rows are the controller's

package/dist/src/tools/list-repository-agent-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-repository-agent-keys.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,uBAAuB,GAAmB;IAC9C,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,4BAA4B;IACnC,WAAW,EACT,4FAA4F;QAC5F,8FAA8F;QAC9F,0EAA0E;QAC1E,+FAA+F;QAC/F,2FAA2F;QAC3F,sBAAsB;QACtB,+FAA+F;QAC/F,wFAAwF;QACxF,8FAA8F;QAC9F,sCAAsC;QACtC,wFAAwF;QACxF,yBAAyB;QACzB,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;IAChG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gFAAgF;oBAChF,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,aAAa,EACrE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"list-repository-agent-keys.js","sourceRoot":"","sources":["../../../src/tools/list-repository-agent-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,uBAAuB,GAAmB;IAC9C,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,4BAA4B;IACnC,WAAW,EACT,4FAA4F;QAC5F,8FAA8F;QAC9F,0EAA0E;QAC1E,+FAA+F;QAC/F,2FAA2F;QAC3F,sBAAsB;QACtB,+FAA+F;QAC/F,wFAAwF;QACxF,8FAA8F;QAC9F,sCAAsC;QACtC,wFAAwF;QACxF,yBAAyB;QACzB,iGAAiG;QACjG,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,8FAA8F;QAC9F,mDAAmD;QACnD,kGAAkG;QAClG,oDAAoD;IACtD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gFAAgF;oBAChF,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,aAAa,EACrE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,mCAAmC;QACnC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/src/tools/list-repository-members.js

@@ -1,4 +1,4 @@
-import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { getJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `GET /api/v1/repositories/:repository_id/members` as a tool — shipped in the
@@ -46,9 +46,15 @@ const listRepositoryMembers = {
         "`members.manage` is refused 403 in SpecGuard's own words. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
         "handle. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key) — a PERSON key, which `list_repositories` " +
-        "also accepts but does not require — and a DIFFERENT one from the sgk_… repository key " +
-        "`get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two member-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `members.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key — a PERSON key, which " +
+        "`list_repositories` also accepts but does not require). With both set the agent key wins, so " +
+        "the answer stays inside the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -66,7 +72,7 @@ const listRepositoryMembers = {
     },
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const members = await getJsonObject(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/members`, {}, context.fetch);
         // Passed through unreshaped, the standing rule (`types.ts`: "A thin client
         // that reshapes its upstream is not thin") — five fields per row, four of

package/dist/src/tools/list-repository-members.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-repository-members.js","sourceRoot":"","sources":["../../../src/tools/list-repository-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,0FAA0F;QAC1F,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,2FAA2F;QAC3F,4DAA4D;QAC5D,wFAAwF;QACxF,4FAA4F;QAC5F,4DAA4D;QAC5D,yFAAyF;QACzF,UAAU;QACV,wFAAwF;QACxF,wFAAwF;QACxF,iCAAiC;IACnC,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,oDAAoD;QACpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"list-repository-members.js","sourceRoot":"","sources":["../../../src/tools/list-repository-members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,yBAAyB;IAChC,WAAW,EACT,0FAA0F;QAC1F,6FAA6F;QAC7F,iGAAiG;QACjG,2FAA2F;QAC3F,2FAA2F;QAC3F,4DAA4D;QAC5D,wFAAwF;QACxF,4FAA4F;QAC5F,4DAA4D;QAC5D,yFAAyF;QACzF,UAAU;QACV,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,mFAAmF;QACnF,+FAA+F;QAC/F,oEAAoE;QACpE,kGAAkG;QAClG,oDAAoD;IACtD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,6EAA6E;oBAC7E,qEAAqE;aACxE;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,qEAAqE;QACrE,6EAA6E;QAC7E,uBAAuB;QACvB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAClE,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,oDAAoD;QACpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/src/tools/near-duplicate-clusters.d.ts

@@ -31,14 +31,18 @@ import type { ToolDefinition } from "./types.js";
  * run, and one call returns them all. What IS choosable, since SPGD-953, is
  * WHICH REPOSITORY is censused: an optional `repository` argument (a numeric id
  * from `list_repositories`) moves the call to the plural endpoint
- * `GET /api/v1/repositories/:id` under the AGENT key, same body (minus the
- * `api_key` block, which is ABSENT on that surface rather than nulled — see
- * `repository-overview.ts` for why the omission is the server's, deliberately),
- * same ask, same cost gate. Without it the request is byte-for-byte the singular,
- * `sgk_`-bound one this tool has always made — and the cost argument above is
- * exactly why the argument is OPTIONAL rather than required: an agent that has
- * only ever had one reachable repository should not be asked to learn a second
- * credential to keep reading it.
+ * `GET /api/v1/repositories/:id` under either member credential, whichever is
+ * set — the AGENT key preferred, and the USER key (a person credential, whose
+ * accessible set is the boundary the id is resolved inside) when no agent key
+ * is set; SPGD-1106 widened the plural arm from agent-only, on the same
+ * agent-wins/user-fallback terms every either-credential tool answers by. Same
+ * body (minus the `api_key` block, which is ABSENT on that surface rather than
+ * nulled — see `repository-overview.ts` for why the omission is the server's,
+ * deliberately), same ask, same cost gate. Without it the request is
+ * byte-for-byte the singular, `sgk_`-bound one this tool has always made — and
+ * the cost argument above is exactly why the argument is OPTIONAL rather than
+ * required: an agent that has only ever had one reachable repository should not
+ * be asked to learn a second credential to keep reading it.
  *
  * `near_duplicates: "true"` is built rather than stringified for the same
  * reason `repository-overview.ts` builds its `unannotated_examples` key:

package/dist/src/tools/near-duplicate-clusters.js

@@ -1,5 +1,5 @@
-import { requireAgentApiConfig, requireApiConfig } from "../config.js";
-import { getJsonObject } from "../support/specguard-api.js";
+import { requireApiConfig } from "../config.js";
+import { getJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { optionalString } from "./args.js";
 /**
  * `GET /api/v1/repository?near_duplicates=` as a tool — shipped in the
@@ -33,14 +33,18 @@ import { optionalString } from "./args.js";
  * run, and one call returns them all. What IS choosable, since SPGD-953, is
  * WHICH REPOSITORY is censused: an optional `repository` argument (a numeric id
  * from `list_repositories`) moves the call to the plural endpoint
- * `GET /api/v1/repositories/:id` under the AGENT key, same body (minus the
- * `api_key` block, which is ABSENT on that surface rather than nulled — see
- * `repository-overview.ts` for why the omission is the server's, deliberately),
- * same ask, same cost gate. Without it the request is byte-for-byte the singular,
- * `sgk_`-bound one this tool has always made — and the cost argument above is
- * exactly why the argument is OPTIONAL rather than required: an agent that has
- * only ever had one reachable repository should not be asked to learn a second
- * credential to keep reading it.
+ * `GET /api/v1/repositories/:id` under either member credential, whichever is
+ * set — the AGENT key preferred, and the USER key (a person credential, whose
+ * accessible set is the boundary the id is resolved inside) when no agent key
+ * is set; SPGD-1106 widened the plural arm from agent-only, on the same
+ * agent-wins/user-fallback terms every either-credential tool answers by. Same
+ * body (minus the `api_key` block, which is ABSENT on that surface rather than
+ * nulled — see `repository-overview.ts` for why the omission is the server's,
+ * deliberately), same ask, same cost gate. Without it the request is
+ * byte-for-byte the singular, `sgk_`-bound one this tool has always made — and
+ * the cost argument above is exactly why the argument is OPTIONAL rather than
+ * required: an agent that has only ever had one reachable repository should not
+ * be asked to learn a second credential to keep reading it.
  *
  * `near_duplicates: "true"` is built rather than stringified for the same
  * reason `repository-overview.ts` builds its `unannotated_examples` key:
@@ -81,9 +85,10 @@ const nearDuplicateClusters = {
         "`near_duplicates: null` on the plain overview. Calling this tool IS the ask; nothing about the " +
         "census is choosable — the clusters are the repository's, computed over every run, and one call " +
         "returns them all. WHICH repository is censused is the one choice there is: pass `repository` " +
-        "(a numeric id from `list_repositories`) to census that named repository under the agent key, " +
-        "or omit it to census the repository the configured sgk_… key resolves to, exactly as before " +
-        "the argument existed. " +
+        "(a numeric id from `list_repositories`) to census that named repository under either member " +
+        "credential — the agent key preferred, the person key when no agent key is set — or omit it to " +
+        "census the repository the configured sgk_… key resolves to, exactly as before the argument " +
+        "existed. " +
         "READ THE DISCLOSURE KEYS BEFORE THE COUNT: `similarity_floor` and `similarity_basis` sit FIRST " +
         "in the block and qualify every cluster below them — a cluster count without what 'similar' " +
         "meant is a figure you cannot act on. `truncated: true` means the cluster list was cut at the " +
@@ -103,16 +108,18 @@ const nearDuplicateClusters = {
         "(`recorded_count: 0`), nothing embedded (`identity_count: 0`), nothing alike — are kept " +
         "distinguishable by those counts rather than collapsed into one empty list. " +
         "Same endpoints and credentials as `get_repository_overview`: without `repository`, an " +
-        "`sgk_` repository key on `GET /api/v1/repository`; with `repository`, an `sga_` agent key " +
-        "(SPECGUARD_AGENT_API_KEY) on `GET /api/v1/repositories/:id`, whose answer the key's own " +
-        "granted repository set bounds. SpecGuard refuses each credential in the other's place, so " +
-        "a `repository` ask without the agent key set is refused HERE, by name, before any request " +
-        "is made. " +
+        "`sgk_` repository key on `GET /api/v1/repository`; with `repository`, EITHER member " +
+        "credential, whichever is set, on `GET /api/v1/repositories/:id` — SPECGUARD_AGENT_API_KEY " +
+        "(an sga_… agent key, whose mint-time granted repository set bounds the answer) preferred, " +
+        "and, when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key — a PERSON key, whose " +
+        "accessible set bounds the answer instead); with both set the agent key wins. The server " +
+        "owns the refusals on that path: a repository outside the presented credential's grant " +
+        "answers 404, person and agent alike. " +
         "The response is the endpoint's full body with the `near_duplicates` block OPENED, passed " +
         "through unmodified — with the one surface difference `get_repository_overview` documents " +
         "for its own `repository` ask: on that plural path the `api_key` block is ABSENT from the " +
-        "body rather than nulled (it describes the credential that made the request, and an agent " +
-        "key is not a repository key), so an absent `api_key` there is the surface's shape, never " +
+        "body rather than nulled (it describes the credential that made the request, and no member " +
+        "credential is a repository key), so an absent `api_key` there is the surface's shape, never " +
         "a dropped block.",
     inputSchema: {
         type: "object",
@@ -122,11 +129,14 @@ const nearDuplicateClusters = {
                 description: "Census THIS repository instead of the one the configured sgk_… key resolves to. The " +
                     "value is the repository's NUMERIC ID, exactly as served in `list_repositories` " +
                     "entries' `id` — not the `org/repo` handle. " +
-                    "The credential changes with it, because SpecGuard refuses each key kind in the " +
-                    "other's place: the call authenticates with SPECGUARD_AGENT_API_KEY (an sga_… agent " +
-                    "key) instead of SPECGUARD_API_KEY, and the key's granted repository set is the " +
-                    "boundary the id is resolved inside — a repository outside the set answers 404, " +
-                    "indistinguishable from one that does not exist. The census itself is identical on " +
+                    "The credential changes with it: the call authenticates with EITHER member credential, " +
+                    "whichever is set — SPECGUARD_AGENT_API_KEY (an sga_… agent key; the set of " +
+                    "repositories granted onto it at mint time is the boundary the id is resolved " +
+                    "inside) and, when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key — a PERSON " +
+                    "key, whose accessible set is the boundary instead); with both set the agent key " +
+                    "wins. The server owns the refusals on that path: a repository outside the " +
+                    "presented credential's grant answers 404, indistinguishable from one that does " +
+                    "not exist — person and agent alike. The census itself is identical on " +
                     "either path: same block, same caps, same disclosure keys. " +
                     "Omit it — or pass a blank — and the call is byte-for-byte the singular one under " +
                     "SPECGUARD_API_KEY, exactly as before this argument existed.",
@@ -140,10 +150,12 @@ const nearDuplicateClusters = {
         // for the reason `repository-overview.ts` states at its own call site: the
         // pair (path, credential) must not be mixable, because either mixed pairing
         // is a 401 at the deployment by design and both are refused here, legibly,
-        // instead.
+        // instead. The plural arm answers either member credential — the agent key
+        // preferred, the user key when no agent key is set (SPGD-1106) — and the
+        // singular arm is unchanged.
         const api = repository === undefined
             ? requireApiConfig(context.config)
-            : requireAgentApiConfig(context.config);
+            : requireUserOrAgentApiConfig(context.config);
         const path = repository === undefined
             ? "/api/v1/repository"
             : `/api/v1/repositories/${encodeURIComponent(repository)}`;

package/dist/src/tools/near-duplicate-clusters.js.map

@@ -1 +1 @@
-{"version":3,"file":"near-duplicate-clusters.js","sourceRoot":"","sources":["../../../src/tools/near-duplicate-clusters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAE/B,KAAK,EAAE,yBAAyB;IAEhC,WAAW,EACT,2FAA2F;QAC3F,gGAAgG;QAChG,gGAAgG;QAChG,gCAAgC;QAChC,kGAAkG;QAClG,iGAAiG;QACjG,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,wBAAwB;QACxB,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,8DAA8D;QAC9D,iGAAiG;QACjG,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,oGAAoG;QACpG,2FAA2F;QAC3F,mGAAmG;QACnG,8FAA8F;QAC9F,2BAA2B;QAC3B,6FAA6F;QAC7F,iFAAiF;QACjF,0FAA0F;QAC1F,6EAA6E;QAC7E,wFAAwF;QACxF,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,4FAA4F;QAC5F,WAAW;QACX,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,kBAAkB;IAEpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,iFAAiF;oBACjF,6CAA6C;oBAC7C,iFAAiF;oBACjF,qFAAqF;oBACrF,iFAAiF;oBACjF,iFAAiF;oBACjF,oFAAoF;oBACpF,4DAA4D;oBAC5D,mFAAmF;oBACnF,6DAA6D;aAChE;SACF;QACD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,WAAW;QACX,MAAM,GAAG,GACP,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,GAAG,EACH,IAAI,EACJ;YACE,uEAAuE;YACvE,mEAAmE;YACnE,kDAAkD;YAClD,eAAe,EAAE,MAAM;SACxB,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"near-duplicate-clusters.js","sourceRoot":"","sources":["../../../src/tools/near-duplicate-clusters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAE/B,KAAK,EAAE,yBAAyB;IAEhC,WAAW,EACT,2FAA2F;QAC3F,gGAAgG;QAChG,gGAAgG;QAChG,gCAAgC;QAChC,kGAAkG;QAClG,iGAAiG;QACjG,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,6FAA6F;QAC7F,WAAW;QACX,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,8DAA8D;QAC9D,iGAAiG;QACjG,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,oGAAoG;QACpG,2FAA2F;QAC3F,mGAAmG;QACnG,8FAA8F;QAC9F,2BAA2B;QAC3B,6FAA6F;QAC7F,iFAAiF;QACjF,0FAA0F;QAC1F,6EAA6E;QAC7E,wFAAwF;QACxF,sFAAsF;QACtF,4FAA4F;QAC5F,4FAA4F;QAC5F,wFAAwF;QACxF,0FAA0F;QAC1F,wFAAwF;QACxF,uCAAuC;QACvC,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,kBAAkB;IAEpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,iFAAiF;oBACjF,6CAA6C;oBAC7C,wFAAwF;oBACxF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,qFAAqF;oBACrF,kFAAkF;oBAClF,4EAA4E;oBAC5E,iFAAiF;oBACjF,wEAAwE;oBACxE,4DAA4D;oBAC5D,mFAAmF;oBACnF,6DAA6D;aAChE;SACF;QACD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,GAAG,GACP,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,GAAG,EACH,IAAI,EACJ;YACE,uEAAuE;YACvE,mEAAmE;YACnE,kDAAkD;YAClD,eAAe,EAAE,MAAM;SACxB,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/src/tools/remove-repository-member.js

@@ -1,4 +1,4 @@
-import { deleteJson, requireUserApiConfig } from "../support/specguard-api.js";
+import { deleteJson, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `DELETE /api/v1/repositories/:repository_id/members/:id` as a tool — shipped
@@ -52,8 +52,15 @@ const removeRepositoryMember = {
         "SpecGuard's own words. A 204 means the membership is revoked. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
         "handle. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential `add_repository` " +
-        "writes with and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two member-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `members.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential " +
+        "`add_repository` writes with). With both set the agent key wins, so the revoke answers inside " +
+        "the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses.",
     inputSchema: {
         type: "object",
         properties: {
@@ -81,7 +88,7 @@ const removeRepositoryMember = {
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
         const memberId = requireString(args["member_id"], "member_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const body = await deleteJson(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/members/${encodeURIComponent(memberId)}`, context.fetch);
         // 204 with no body — the tool's own words, because the deployment's whole
         // answer was "no content". The keys asymmetry is restated here because the

package/dist/src/tools/remove-repository-member.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-repository-member.js","sourceRoot":"","sources":["../../../src/tools/remove-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sFAAsF;QACtF,kFAAkF;QAClF,uFAAuF;QACvF,mCAAmC;QACnC,yFAAyF;QACzF,uFAAuF;QACvF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,4FAA4F;QAC5F,iEAAiE;QACjE,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,YAAY;QACZ,2FAA2F;QAC3F,gEAAgE;QAChE,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,8EAA8E;oBAC9E,kFAAkF;oBAClF,sEAAsE;oBACtE,iFAAiF;oBACjF,8EAA8E;oBAC9E,iBAAiB;aACpB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACxC,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,cAAc,QAAQ,uDAAuD;oBAC7E,gEAAgE;oBAChE,kDAAkD;gBACpD,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;SAChF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"remove-repository-member.js","sourceRoot":"","sources":["../../../src/tools/remove-repository-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,sFAAsF;QACtF,kFAAkF;QAClF,uFAAuF;QACvF,mCAAmC;QACnC,yFAAyF;QACzF,uFAAuF;QACvF,uDAAuD;QACvD,yFAAyF;QACzF,2FAA2F;QAC3F,4FAA4F;QAC5F,iEAAiE;QACjE,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,YAAY;QACZ,2FAA2F;QAC3F,gEAAgE;QAChE,yFAAyF;QACzF,UAAU;QACV,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,kFAAkF;QAClF,gGAAgG;QAChG,4CAA4C;QAC5C,kGAAkG;QAClG,OAAO;IACT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,8EAA8E;oBAC9E,kFAAkF;oBAClF,sEAAsE;oBACtE,iFAAiF;oBACjF,8EAA8E;oBAC9E,iBAAiB;aACpB;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC;QACxC,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,cAAc,QAAQ,uDAAuD;oBAC7E,gEAAgE;oBAChE,kDAAkD;gBACpD,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;SAChF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/tools/repository-overview.d.ts

@@ -44,14 +44,19 @@ import type { ToolDefinition } from "./types.js";
  *
  * THE CREDENTIAL MOVES WITH IT, because the endpoints refuse each other's
  * tokens before any table is read: the singular path still authenticates with
- * `SPECGUARD_API_KEY` (`sgk_`, one repository), the plural path with
- * `SPECGUARD_AGENT_API_KEY` (`sga_`, the agent credential minted for exactly
- * this — one key, many repositories, each read bounded by the key's own
- * granted set server-side). Omitting `repository` is byte-for-byte today's
- * request, and an operator who never sets the agent variable never sees this
- * half of the tool exist — the blank-is-no-ask rule every argument here follows
- * covers `repository` too, so a blank value falls back to the singular path
- * rather than sending a guaranteed-404 id.
+ * `SPECGUARD_API_KEY` (`sgk_`, one repository), while the plural path answers
+ * with EITHER member credential, whichever is set — `SPECGUARD_AGENT_API_KEY`
+ * (`sga_`, the agent credential minted for exactly this: one key, many
+ * repositories, each read bounded by the key's own granted set server-side)
+ * preferred, and `SPECGUARD_USER_API_KEY` (`sgu_`, a person key whose
+ * accessible set is the boundary ids are resolved inside instead) when no
+ * agent key is set. With both set the agent key wins, so the plural answer
+ * stays inside the same set `list_repositories` reports — scope consistency,
+ * not preference. Omitting `repository` is byte-for-byte today's request, and
+ * an operator who sets neither member variable never sees this half of the
+ * tool exist — the blank-is-no-ask rule every argument here follows covers
+ * `repository` too, so a blank value falls back to the singular path rather
+ * than sending a guaranteed-404 id.
  *
  * == The response is passed through, not re-modelled
  *

package/dist/src/tools/repository-overview.js

@@ -1,5 +1,5 @@
-import { requireAgentApiConfig, requireApiConfig } from "../config.js";
-import { getJsonObject } from "../support/specguard-api.js";
+import { requireApiConfig } from "../config.js";
+import { getJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { optionalBoolean, optionalString } from "./args.js";
 /**
  * `GET /api/v1/repository` as a tool — shipped today in the platform
@@ -46,14 +46,19 @@ import { optionalBoolean, optionalString } from "./args.js";
  *
  * THE CREDENTIAL MOVES WITH IT, because the endpoints refuse each other's
  * tokens before any table is read: the singular path still authenticates with
- * `SPECGUARD_API_KEY` (`sgk_`, one repository), the plural path with
- * `SPECGUARD_AGENT_API_KEY` (`sga_`, the agent credential minted for exactly
- * this — one key, many repositories, each read bounded by the key's own
- * granted set server-side). Omitting `repository` is byte-for-byte today's
- * request, and an operator who never sets the agent variable never sees this
- * half of the tool exist — the blank-is-no-ask rule every argument here follows
- * covers `repository` too, so a blank value falls back to the singular path
- * rather than sending a guaranteed-404 id.
+ * `SPECGUARD_API_KEY` (`sgk_`, one repository), while the plural path answers
+ * with EITHER member credential, whichever is set — `SPECGUARD_AGENT_API_KEY`
+ * (`sga_`, the agent credential minted for exactly this: one key, many
+ * repositories, each read bounded by the key's own granted set server-side)
+ * preferred, and `SPECGUARD_USER_API_KEY` (`sgu_`, a person key whose
+ * accessible set is the boundary ids are resolved inside instead) when no
+ * agent key is set. With both set the agent key wins, so the plural answer
+ * stays inside the same set `list_repositories` reports — scope consistency,
+ * not preference. Omitting `repository` is byte-for-byte today's request, and
+ * an operator who sets neither member variable never sees this half of the
+ * tool exist — the blank-is-no-ask rule every argument here follows covers
+ * `repository` too, so a blank value falls back to the singular path rather
+ * than sending a guaranteed-404 id.
  *
  * == The response is passed through, not re-modelled
  *
@@ -563,13 +568,20 @@ const getRepositoryOverview = {
         "with the endpoint: the call goes to GET /api/v1/repositories/:id — the plural surface, " +
         "the same overview body with every parameter above honoured identically, MINUS the " +
         "`api_key` block, which is ABSENT there rather than nulled (it describes the credential " +
-        "that made the request, and this request was not made with a repository key) — under " +
-        "SPECGUARD_AGENT_API_KEY, an sga_… agent key whose granted repository set is the read " +
-        "boundary the id is looked up inside (a repository outside the set answers 404, " +
-        "deliberately indistinguishable from a nonexistent one). SpecGuard refuses each credential " +
-        "in the other's place before it reads anything, so naming `repository` without the agent " +
-        "key — or omitting it with only the agent key set — is refused HERE, by name, before any " +
-        "request is made. " +
+        "that made the request, and no member credential is a repository key) — and it " +
+        "authenticates with EITHER member credential, whichever is set: SPECGUARD_AGENT_API_KEY " +
+        "(an sga_… agent key — the call then reaches only the repositories granted onto that key " +
+        "at mint time; a repository outside that set answers 404, deliberately indistinguishable " +
+        "from a nonexistent one) and, when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key — " +
+        "a PERSON key, whose accessible set is the boundary the id is resolved inside, exactly the " +
+        "set `list_repositories` reports under the same key). With both set the agent key wins, so " +
+        "the answer stays inside the set that key can act on. The server owns every refusal on this " +
+        "path — a repository outside the presented credential's grant answers 404 there, person " +
+        "and agent alike; SpecGuard refuses each credential KIND in the other's place, and the " +
+        "bridge refuses only the credential-less pairing, naming both member variables in one " +
+        "message. Omitting `repository` (or passing a blank) is byte-for-byte today's singular " +
+        "request, so an operator who sets neither member variable never sees this half of the tool " +
+        "exist. " +
         "Figures are null where CI did not report them — a null is 'not measured', never zero. That " +
         "rule is about NULLS and does not run backwards: a non-null figure is not thereby a " +
         "measurement. A run that reported zero tests serves a real `total_specs: 0` beside " +
@@ -586,20 +598,25 @@ const getRepositoryOverview = {
                     "in `list_repositories` entries' `id` — not the `org/repo` handle: the plural endpoint " +
                     "looks the id up inside the calling key's own read boundary, and a handle casts to no " +
                     "id and answers 404. " +
-                    "The credential changes with it, because SpecGuard refuses each key kind in the " +
-                    "other's place: the call authenticates with SPECGUARD_AGENT_API_KEY (an sga_… agent " +
-                    "key) instead of SPECGUARD_API_KEY, and the set of repositories the agent key was " +
-                    "granted at mint time is the boundary the id is resolved inside — a repository " +
-                    "outside the set answers 404, indistinguishable from one that does not exist, and " +
-                    "`list_repositories` under the same key lists exactly the set that is reachable. " +
+                    "The credential changes with it: the call authenticates with EITHER member credential, " +
+                    "whichever is set — SPECGUARD_AGENT_API_KEY (an sga_… agent key; the set of " +
+                    "repositories granted onto it at mint time is the boundary the id is resolved " +
+                    "inside, and `list_repositories` under the same key lists exactly the set that is " +
+                    "reachable) and, when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key — a " +
+                    "PERSON key, whose accessible set is the boundary instead). With both set the " +
+                    "agent key wins, so the answer stays inside the set that key can act on. SpecGuard " +
+                    "refuses each credential KIND in the other's place: a repository outside the " +
+                    "presented credential's grant answers 404, indistinguishable from one that does " +
+                    "not exist — person and agent alike. " +
                     "Every parameter means the same thing on either path: same ladder, same `run_anchor` " +
                     "contract, same overview body with ONE difference this path owns — `api_key` is " +
                     "ABSENT from the plural response, not null (the block describes the credential that " +
-                    "made the request, and an agent-key caller is not a repository key), so its absence " +
+                    "made the request, and a member-key caller — agent or person — is not a repository " +
+                    "key), so its absence " +
                     "is the plural surface's shape, never a dropped key. " +
                     "Omit it — or pass a blank — and the call is byte-for-byte the singular one: " +
                     "SPECGUARD_API_KEY on GET /api/v1/repository, exactly as before this argument " +
-                    "existed, so an operator who never sets the agent key is unaffected.",
+                    "existed, so an operator who sets neither member key is unaffected.",
             },
             branch: {
                 type: "string",
@@ -870,17 +887,19 @@ const getRepositoryOverview = {
         // asked explicitly for it not to be. See this file's header.
         const unannotatedExamples = optionalBoolean(args["unannotated_examples"], "unannotated_examples");
         // WHICH ENDPOINT AND WHICH CREDENTIAL is decided here, once, from the one
-        // ask: `repository` present means the plural surface under the agent key,
+        // ask: `repository` present means the plural surface under either member
+        // credential (the agent key preferred, the user key when no agent key is
+        // set — the SPGD-1106 widening; the route has served both since SPGD-952),
         // absent means the singular surface under the `sgk_` slot — byte-for-byte
         // the request this tool made before the argument existed. The two are kept
         // as one branch point rather than spread across the call below, so the
         // pair (path, credential) cannot be mixed: a plural path under the
-        // repository key, or a singular path under the agent key, is a 401 at the
+        // repository key, or a singular path under a member key, is a 401 at the
         // deployment by design, and both mistakes are refused HERE, legibly,
         // instead.
         const api = repository === undefined
             ? requireApiConfig(context.config)
-            : requireAgentApiConfig(context.config);
+            : requireUserOrAgentApiConfig(context.config);
         const path = repository === undefined
             ? "/api/v1/repository"
             : `/api/v1/repositories/${encodeURIComponent(repository)}`;

package/dist/src/tools/repository-overview.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository-overview.js","sourceRoot":"","sources":["../../../src/tools/repository-overview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4cG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAE/B,KAAK,EAAE,mCAAmC;IAE1C,WAAW,EACT,2FAA2F;QAC3F,6FAA6F;QAC7F,yFAAyF;QACzF,+FAA+F;QAC/F,8FAA8F;QAC9F,gEAAgE;QAChE,gGAAgG;QAChG,wFAAwF;QACxF,6FAA6F;QAC7F,4BAA4B;QAC5B,gFAAgF;QAChF,yFAAyF;QACzF,4FAA4F;QAC5F,qFAAqF;QACrF,yFAAyF;QACzF,yDAAyD;QACzD,4FAA4F;QAC5F,6FAA6F;QAC7F,kCAAkC;QAClC,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,yFAAyF;QACzF,4FAA4F;QAC5F,4DAA4D;QAC5D,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,wEAAwE;QACxE,6FAA6F;QAC7F,gGAAgG;QAChG,4EAA4E;QAC5E,+FAA+F;QAC/F,6FAA6F;QAC7F,0FAA0F;QAC1F,oFAAoF;QACpF,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,qEAAqE;QACrE,2FAA2F;QAC3F,kFAAkF;QAClF,iGAAiG;QACjG,gGAAgG;QAChG,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,+FAA+F;QAC/F,uDAAuD;QACvD,yFAAyF;QACzF,8FAA8F;QAC9F,uFAAuF;QACvF,iEAAiE;QACjE,iGAAiG;QACjG,8FAA8F;QAC9F,eAAe;QACf,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,0FAA0F;QAC1F,yFAAyF;QACzF,yBAAyB;QACzB,wFAAwF;QACxF,6FAA6F;QAC7F,sFAAsF;QACtF,8FAA8F;QAC9F,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,0DAA0D;QAC1D,wFAAwF;QACxF,iFAAiF;QACjF,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,qBAAqB;QACrB,mFAAmF;QACnF,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,yFAAyF;QACzF,+FAA+F;QAC/F,sDAAsD;QACtD,2FAA2F;QAC3F,oFAAoF;QACpF,4FAA4F;QAC5F,sEAAsE;QACtE,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;QACzF,oFAAoF;QACpF,yFAAyF;QACzF,sFAAsF;QACtF,uFAAuF;QACvF,iFAAiF;QACjF,4FAA4F;QAC5F,0FAA0F;QAC1F,0FAA0F;QAC1F,mBAAmB;QACnB,6FAA6F;QAC7F,qFAAqF;QACrF,oFAAoF;QACpF,wFAAwF;QACxF,4FAA4F;IAE9F,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,+EAA+E;oBAC/E,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,sBAAsB;oBACtB,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,gFAAgF;oBAChF,mFAAmF;oBACnF,kFAAkF;oBAClF,sFAAsF;oBACtF,iFAAiF;oBACjF,qFAAqF;oBACrF,qFAAqF;oBACrF,sDAAsD;oBACtD,8EAA8E;oBAC9E,+EAA+E;oBAC/E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,iFAAiF;oBACjF,kFAAkF;oBAClF,oFAAoF;oBACpF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yEAAyE;aAC5E;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,yFAAyF;oBACzF,iEAAiE;oBACjE,sFAAsF;oBACtF,oFAAoF;oBACpF,sFAAsF;oBACtF,yFAAyF;oBACzF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,oBAAoB;oBACpB,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wFAAwF;oBACxF,0FAA0F;oBAC1F,uFAAuF;oBACvF,qDAAqD;oBACrD,uFAAuF;oBACvF,0FAA0F;oBAC1F,sFAAsF;oBACtF,mDAAmD;aACtD;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,oFAAoF;oBACpF,wDAAwD;oBACxD,uFAAuF;oBACvF,4EAA4E;oBAC5E,6EAA6E;oBAC7E,uFAAuF;oBACvF,sEAAsE;oBACtE,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wCAAwC;oBACxC,uFAAuF;oBACvF,kFAAkF;oBAClF,uCAAuC;aAC1C;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,wFAAwF;oBACxF,yDAAyD;oBACzD,mEAAmE;oBACnE,sFAAsF;oBACtF,oFAAoF;oBACpF,qFAAqF;oBACrF,uFAAuF;oBACvF,iFAAiF;oBACjF,oFAAoF;oBACpF,gFAAgF;oBAChF,yCAAyC;oBACzC,sFAAsF;oBACtF,kFAAkF;oBAClF,0CAA0C;aAC7C;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,mFAAmF;oBACnF,sEAAsE;oBACtE,qFAAqF;oBACrF,uFAAuF;oBACvF,oFAAoF;oBACpF,yEAAyE;oBACzE,wFAAwF;oBACxF,iFAAiF;oBACjF,+BAA+B;oBAC/B,qFAAqF;oBACrF,qFAAqF;oBACrF,sFAAsF;oBACtF,mFAAmF;oBACnF,4EAA4E;oBAC5E,sFAAsF;oBACtF,YAAY;oBACZ,wFAAwF;oBACxF,oFAAoF;oBACpF,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,qFAAqF;oBACrF,sFAAsF;oBACtF,2DAA2D;oBAC3D,sFAAsF;oBACtF,oFAAoF;oBACpF,kFAAkF;oBAClF,+BAA+B;oBAC/B,oFAAoF;oBACpF,uFAAuF;oBACvF,oFAAoF;oBACpF,SAAS;aACZ;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,8DAA8D;oBAC9D,qDAAqD;oBACrD,yDAAyD;oBACzD,sFAAsF;oBACtF,0EAA0E;oBAC1E,uFAAuF;oBACvF,0CAA0C;oBAC1C,mEAAmE;oBACnE,qFAAqF;oBACrF,+EAA+E;oBAC/E,mFAAmF;oBACnF,0FAA0F;oBAC1F,wFAAwF;oBACxF,yFAAyF;oBACzF,+BAA+B;oBAC/B,wFAAwF;oBACxF,yFAAyF;oBACzF,0FAA0F;oBAC1F,yFAAyF;oBACzF,yEAAyE;oBACzE,yFAAyF;oBACzF,yFAAyF;oBACzF,uFAAuF;oBACvF,sFAAsF;oBACtF,yFAAyF;oBACzF,wFAAwF;oBACxF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,sFAAsF;oBACtF,sFAAsF;oBACtF,yEAAyE;oBACzE,8EAA8E;oBAC9E,sFAAsF;oBACtF,uFAAuF;oBACvF,uFAAuF;oBACvF,SAAS;aACZ;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,iFAAiF;oBACjF,sFAAsF;oBACtF,0FAA0F;oBAC1F,iFAAiF;oBACjF,yFAAyF;oBACzF,yFAAyF;oBACzF,6FAA6F;oBAC7F,uFAAuF;oBACvF,+EAA+E;oBAC/E,yFAAyF;oBACzF,0FAA0F;oBAC1F,oDAAoD;oBACpD,kFAAkF;oBAClF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,sFAAsF;oBACtF,iCAAiC;oBACjC,0FAA0F;oBAC1F,2FAA2F;oBAC3F,sFAAsF;oBACtF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wFAAwF;oBACxF,wFAAwF;oBACxF,kCAAkC;oBAClC,oFAAoF;oBACpF,uFAAuF;oBACvF,0FAA0F;oBAC1F,yFAAyF;oBACzF,gEAAgE;oBAChE,uFAAuF;oBACvF,2DAA2D;oBAC3D,uFAAuF;oBACvF,uFAAuF;oBACvF,uFAAuF;oBACvF,+EAA+E;oBAC/E,wFAAwF;oBACxF,+DAA+D;oBAC/D,kFAAkF;oBAClF,wFAAwF;oBACxF,qFAAqF;oBACrF,uCAAuC;oBACvC,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,sFAAsF;oBACtF,6CAA6C;oBAC7C,uFAAuF;oBACvF,oFAAoF;oBACpF,2FAA2F;oBAC3F,mGAAmG;oBACnG,wFAAwF;oBACxF,wFAAwF;oBACxF,yFAAyF;oBACzF,qFAAqF;oBACrF,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yGAAyG;oBACzG,qFAAqF;oBACrF,sFAAsF;oBACtF,uFAAuF;oBACvF,wEAAwE;oBACxE,+EAA+E;oBAC/E,cAAc;oBACd,wFAAwF;oBACxF,+DAA+D;oBAC/D,0DAA0D;oBAC1D,uFAAuF;oBACvF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,2DAA2D;oBAC3D,0FAA0F;oBAC1F,0FAA0F;oBAC1F,sFAAsF;oBACtF,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,yBAAyB;oBACzB,qFAAqF;oBACrF,6DAA6D;oBAC7D,wFAAwF;oBACxF,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,0FAA0F;oBAC1F,yFAAyF;oBACzF,mCAAmC;oBACnC,qFAAqF;oBACrF,uFAAuF;oBACvF,gFAAgF;aACnF;SACF;QACD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,4EAA4E;QAC5E,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,mBAAmB,GAAG,cAAc,CACxC,IAAI,CAAC,sBAAsB,CAAC,EAC5B,sBAAsB,CACvB,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,mBAAmB,GAAG,eAAe,CACzC,IAAI,CAAC,sBAAsB,CAAC,EAC5B,sBAAsB,CACvB,CAAC;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,mEAAmE;QACnE,0EAA0E;QAC1E,qEAAqE;QACrE,WAAW;QACX,MAAM,GAAG,GACP,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,GAAG,EACH,IAAI,EACJ;YACE,MAAM;YACN,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,QAAQ;YACnB,oBAAoB,EAAE,mBAAmB;YACzC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SACxE,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CAAC,QAAiC;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"repository-overview.js","sourceRoot":"","sources":["../../../src/tools/repository-overview.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAidG;AACH,MAAM,qBAAqB,GAAmB;IAC5C,IAAI,EAAE,yBAAyB;IAE/B,KAAK,EAAE,mCAAmC;IAE1C,WAAW,EACT,2FAA2F;QAC3F,6FAA6F;QAC7F,yFAAyF;QACzF,+FAA+F;QAC/F,8FAA8F;QAC9F,gEAAgE;QAChE,gGAAgG;QAChG,wFAAwF;QACxF,6FAA6F;QAC7F,4BAA4B;QAC5B,gFAAgF;QAChF,yFAAyF;QACzF,4FAA4F;QAC5F,qFAAqF;QACrF,yFAAyF;QACzF,yDAAyD;QACzD,4FAA4F;QAC5F,6FAA6F;QAC7F,kCAAkC;QAClC,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,yFAAyF;QACzF,4FAA4F;QAC5F,4DAA4D;QAC5D,+FAA+F;QAC/F,2FAA2F;QAC3F,gGAAgG;QAChG,wEAAwE;QACxE,6FAA6F;QAC7F,gGAAgG;QAChG,4EAA4E;QAC5E,+FAA+F;QAC/F,6FAA6F;QAC7F,0FAA0F;QAC1F,oFAAoF;QACpF,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,qEAAqE;QACrE,2FAA2F;QAC3F,kFAAkF;QAClF,iGAAiG;QACjG,gGAAgG;QAChG,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,+FAA+F;QAC/F,uDAAuD;QACvD,yFAAyF;QACzF,8FAA8F;QAC9F,uFAAuF;QACvF,iEAAiE;QACjE,iGAAiG;QACjG,8FAA8F;QAC9F,eAAe;QACf,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,0FAA0F;QAC1F,yFAAyF;QACzF,yBAAyB;QACzB,wFAAwF;QACxF,6FAA6F;QAC7F,sFAAsF;QACtF,8FAA8F;QAC9F,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,0DAA0D;QAC1D,wFAAwF;QACxF,iFAAiF;QACjF,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,qBAAqB;QACrB,mFAAmF;QACnF,+FAA+F;QAC/F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,yFAAyF;QACzF,+FAA+F;QAC/F,sDAAsD;QACtD,2FAA2F;QAC3F,oFAAoF;QACpF,4FAA4F;QAC5F,sEAAsE;QACtE,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;QACzF,oFAAoF;QACpF,yFAAyF;QACzF,gFAAgF;QAChF,yFAAyF;QACzF,0FAA0F;QAC1F,0FAA0F;QAC1F,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,6FAA6F;QAC7F,yFAAyF;QACzF,wFAAwF;QACxF,uFAAuF;QACvF,wFAAwF;QACxF,4FAA4F;QAC5F,SAAS;QACT,6FAA6F;QAC7F,qFAAqF;QACrF,oFAAoF;QACpF,wFAAwF;QACxF,4FAA4F;IAE9F,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,+EAA+E;oBAC/E,qFAAqF;oBACrF,wFAAwF;oBACxF,uFAAuF;oBACvF,sBAAsB;oBACtB,wFAAwF;oBACxF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,mFAAmF;oBACnF,iFAAiF;oBACjF,+EAA+E;oBAC/E,oFAAoF;oBACpF,8EAA8E;oBAC9E,iFAAiF;oBACjF,sCAAsC;oBACtC,sFAAsF;oBACtF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,uBAAuB;oBACvB,sDAAsD;oBACtD,8EAA8E;oBAC9E,+EAA+E;oBAC/E,oEAAoE;aACvE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,uFAAuF;oBACvF,sFAAsF;oBACtF,qFAAqF;oBACrF,iFAAiF;oBACjF,kFAAkF;oBAClF,oFAAoF;oBACpF,yFAAyF;oBACzF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,yEAAyE;aAC5E;YACD,cAAc,EAAE;gBACd,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,yFAAyF;oBACzF,iEAAiE;oBACjE,sFAAsF;oBACtF,oFAAoF;oBACpF,sFAAsF;oBACtF,yFAAyF;oBACzF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,oBAAoB;oBACpB,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wFAAwF;oBACxF,0FAA0F;oBAC1F,uFAAuF;oBACvF,qDAAqD;oBACrD,uFAAuF;oBACvF,0FAA0F;oBAC1F,sFAAsF;oBACtF,mDAAmD;aACtD;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,oFAAoF;oBACpF,wDAAwD;oBACxD,uFAAuF;oBACvF,4EAA4E;oBAC5E,6EAA6E;oBAC7E,uFAAuF;oBACvF,sEAAsE;oBACtE,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wCAAwC;oBACxC,uFAAuF;oBACvF,kFAAkF;oBAClF,uCAAuC;aAC1C;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sFAAsF;oBACtF,wFAAwF;oBACxF,yDAAyD;oBACzD,mEAAmE;oBACnE,sFAAsF;oBACtF,oFAAoF;oBACpF,qFAAqF;oBACrF,uFAAuF;oBACvF,iFAAiF;oBACjF,oFAAoF;oBACpF,gFAAgF;oBAChF,yCAAyC;oBACzC,sFAAsF;oBACtF,kFAAkF;oBAClF,0CAA0C;aAC7C;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,mFAAmF;oBACnF,sEAAsE;oBACtE,qFAAqF;oBACrF,uFAAuF;oBACvF,oFAAoF;oBACpF,yEAAyE;oBACzE,wFAAwF;oBACxF,iFAAiF;oBACjF,+BAA+B;oBAC/B,qFAAqF;oBACrF,qFAAqF;oBACrF,sFAAsF;oBACtF,mFAAmF;oBACnF,4EAA4E;oBAC5E,sFAAsF;oBACtF,YAAY;oBACZ,wFAAwF;oBACxF,oFAAoF;oBACpF,qFAAqF;oBACrF,uFAAuF;oBACvF,qFAAqF;oBACrF,qFAAqF;oBACrF,sFAAsF;oBACtF,2DAA2D;oBAC3D,sFAAsF;oBACtF,oFAAoF;oBACpF,kFAAkF;oBAClF,+BAA+B;oBAC/B,oFAAoF;oBACpF,uFAAuF;oBACvF,oFAAoF;oBACpF,SAAS;aACZ;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,wFAAwF;oBACxF,0FAA0F;oBAC1F,wFAAwF;oBACxF,8DAA8D;oBAC9D,qDAAqD;oBACrD,yDAAyD;oBACzD,sFAAsF;oBACtF,0EAA0E;oBAC1E,uFAAuF;oBACvF,0CAA0C;oBAC1C,mEAAmE;oBACnE,qFAAqF;oBACrF,+EAA+E;oBAC/E,mFAAmF;oBACnF,0FAA0F;oBAC1F,wFAAwF;oBACxF,yFAAyF;oBACzF,+BAA+B;oBAC/B,wFAAwF;oBACxF,yFAAyF;oBACzF,0FAA0F;oBAC1F,yFAAyF;oBACzF,yEAAyE;oBACzE,yFAAyF;oBACzF,yFAAyF;oBACzF,uFAAuF;oBACvF,sFAAsF;oBACtF,yFAAyF;oBACzF,wFAAwF;oBACxF,qFAAqF;oBACrF,uFAAuF;oBACvF,yFAAyF;oBACzF,sFAAsF;oBACtF,sFAAsF;oBACtF,yEAAyE;oBACzE,8EAA8E;oBAC9E,sFAAsF;oBACtF,uFAAuF;oBACvF,uFAAuF;oBACvF,SAAS;aACZ;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,iFAAiF;oBACjF,sFAAsF;oBACtF,0FAA0F;oBAC1F,iFAAiF;oBACjF,yFAAyF;oBACzF,yFAAyF;oBACzF,6FAA6F;oBAC7F,uFAAuF;oBACvF,+EAA+E;oBAC/E,yFAAyF;oBACzF,0FAA0F;oBAC1F,oDAAoD;oBACpD,kFAAkF;oBAClF,2FAA2F;oBAC3F,0FAA0F;oBAC1F,sFAAsF;oBACtF,iCAAiC;oBACjC,0FAA0F;oBAC1F,2FAA2F;oBAC3F,sFAAsF;oBACtF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,wFAAwF;oBACxF,wFAAwF;oBACxF,kCAAkC;oBAClC,oFAAoF;oBACpF,uFAAuF;oBACvF,0FAA0F;oBAC1F,yFAAyF;oBACzF,gEAAgE;oBAChE,uFAAuF;oBACvF,2DAA2D;oBAC3D,uFAAuF;oBACvF,uFAAuF;oBACvF,uFAAuF;oBACvF,+EAA+E;oBAC/E,wFAAwF;oBACxF,+DAA+D;oBAC/D,kFAAkF;oBAClF,wFAAwF;oBACxF,qFAAqF;oBACrF,uCAAuC;oBACvC,yFAAyF;oBACzF,yFAAyF;oBACzF,yFAAyF;oBACzF,sFAAsF;oBACtF,6CAA6C;oBAC7C,uFAAuF;oBACvF,oFAAoF;oBACpF,2FAA2F;oBAC3F,mGAAmG;oBACnG,wFAAwF;oBACxF,wFAAwF;oBACxF,yFAAyF;oBACzF,qFAAqF;oBACrF,2FAA2F;oBAC3F,2FAA2F;oBAC3F,yGAAyG;oBACzG,qFAAqF;oBACrF,sFAAsF;oBACtF,uFAAuF;oBACvF,wEAAwE;oBACxE,+EAA+E;oBAC/E,cAAc;oBACd,wFAAwF;oBACxF,+DAA+D;oBAC/D,0DAA0D;oBAC1D,uFAAuF;oBACvF,qFAAqF;oBACrF,uFAAuF;oBACvF,uFAAuF;oBACvF,2DAA2D;oBAC3D,0FAA0F;oBAC1F,0FAA0F;oBAC1F,sFAAsF;oBACtF,oFAAoF;oBACpF,0FAA0F;oBAC1F,0FAA0F;oBAC1F,yBAAyB;oBACzB,qFAAqF;oBACrF,6DAA6D;oBAC7D,wFAAwF;oBACxF,qFAAqF;oBACrF,uFAAuF;oBACvF,wFAAwF;oBACxF,0FAA0F;oBAC1F,yFAAyF;oBACzF,mCAAmC;oBACnC,qFAAqF;oBACrF,uFAAuF;oBACvF,gFAAgF;aACnF;SACF;QACD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,4EAA4E;QAC5E,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,mBAAmB,GAAG,cAAc,CACxC,IAAI,CAAC,sBAAsB,CAAC,EAC5B,sBAAsB,CACvB,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,mBAAmB,GAAG,eAAe,CACzC,IAAI,CAAC,sBAAsB,CAAC,EAC5B,sBAAsB,CACvB,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,qEAAqE;QACrE,WAAW;QACX,MAAM,GAAG,GACP,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GACR,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,wBAAwB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,GAAG,EACH,IAAI,EACJ;YACE,MAAM;YACN,cAAc,EAAE,aAAa;YAC7B,SAAS,EAAE,QAAQ;YACnB,oBAAoB,EAAE,mBAAmB;YACzC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,oBAAoB,EAAE,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SACxE,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC1B,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,qBAAqB,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CAAC,QAAiC;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/tools/revoke-repository-agent-key.js

@@ -1,4 +1,4 @@
-import { deleteJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { deleteJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `DELETE /api/v1/repositories/:repository_id/agent_keys/:id` as a tool —
@@ -61,8 +61,16 @@ const revokeRepositoryAgentKey = {
         "Authorization is the `keys_manage` capability — a caller without it is refused 403 in " +
         "SpecGuard's own words. " +
         "Takes `repository_id` (the numeric id `list_repositories` reports) and `key_id`. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential the other key-administration " +
-        "tools read and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two key-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `keys.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here — an " +
+        "agent credential revoking one of its own kind needs no person's `sgu_` key to do it) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential the other " +
+        "key-administration tools read). With both set the agent key wins, so the cut answers inside " +
+        "the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -89,7 +97,7 @@ const revokeRepositoryAgentKey = {
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
         const keyId = requireString(args["key_id"], "key_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         // The 200 disclosure body, passed through unreshaped in both halves — the
         // deployment already wrote the confirmation (the stored set, count first),
         // and this is the API's substitute for the web confirm dialog.

package/dist/src/tools/revoke-repository-agent-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke-repository-agent-key.js","sourceRoot":"","sources":["../../../src/tools/revoke-repository-agent-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,wBAAwB,GAAmB;IAC/C,IAAI,EAAE,6BAA6B;IACnC,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,kCAAkC;QAClC,uFAAuF;QACvF,uEAAuE;QACvE,4FAA4F;QAC5F,wFAAwF;QACxF,wFAAwF;QACxF,oFAAoF;QACpF,0FAA0F;QAC1F,wEAAwE;QACxE,wFAAwF;QACxF,yBAAyB;QACzB,mFAAmF;QACnF,gGAAgG;QAChG,8FAA8F;IAChG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,qFAAqF;oBACrF,sFAAsF;oBACtF,8EAA8E;aACjF;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,0BAA0B;aAC7B;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,uEAAuE;QACvE,yDAAyD;QACzD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"revoke-repository-agent-key.js","sourceRoot":"","sources":["../../../src/tools/revoke-repository-agent-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,wBAAwB,GAAmB;IAC/C,IAAI,EAAE,6BAA6B;IACnC,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,kCAAkC;QAClC,uFAAuF;QACvF,uEAAuE;QACvE,4FAA4F;QAC5F,wFAAwF;QACxF,wFAAwF;QACxF,oFAAoF;QACpF,0FAA0F;QAC1F,wEAAwE;QACxE,wFAAwF;QACxF,yBAAyB;QACzB,mFAAmF;QACnF,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,8FAA8F;QAC9F,4CAA4C;QAC5C,kGAAkG;QAClG,oDAAoD;IACtD,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,qFAAqF;oBACrF,sFAAsF;oBACtF,8EAA8E;aACjF;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qFAAqF;oBACrF,mFAAmF;oBACnF,0BAA0B;aAC7B;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,uEAAuE;QACvE,yDAAyD;QACzD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,eAAe,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAClG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,UAAU,EAAE,UAAU;SACvB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/src/tools/revoke-repository-api-key.js

@@ -1,4 +1,4 @@
-import { deleteJson, requireUserApiConfig } from "../support/specguard-api.js";
+import { deleteJson, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString } from "./args.js";
 /**
  * `DELETE /api/v1/repositories/:repository_id/api_keys/:id` as a tool —
@@ -42,9 +42,15 @@ const revokeRepositoryApiKey = {
         "403 in SpecGuard's own words. A 204 means the key is revoked. " +
         "Takes `repository_id` (the numeric id `list_repositories` reports) and `key_id` " +
         "(the id from `add_repository`'s or `create_repository_api_key`'s response). " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential " +
-        "`add_repository` writes with and a DIFFERENT one from the sgk_… repository key " +
-        "`get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two key-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `keys.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential " +
+        "`add_repository` writes with). With both set the agent key wins, so the revoke answers inside " +
+        "the same set `list_repositories` reports. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key " +
+        "`get_repository_overview` uses; SpecGuard refuses each in the other's place.",
     inputSchema: {
         type: "object",
         properties: {
@@ -69,7 +75,7 @@ const revokeRepositoryApiKey = {
     async run(args, context) {
         const repositoryId = requireString(args["repository_id"], "repository_id");
         const keyId = requireString(args["key_id"], "key_id");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const body = await deleteJson(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/api_keys/${encodeURIComponent(keyId)}`, context.fetch);
         // 204 with no body — the tool's own words, because the deployment's whole
         // answer was "no content".

package/dist/src/tools/revoke-repository-api-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke-repository-api-key.js","sourceRoot":"","sources":["../../../src/tools/revoke-repository-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,iFAAiF;QACjF,4EAA4E;QAC5E,yCAAyC;QACzC,+EAA+E;QAC/E,8DAA8D;QAC9D,mFAAmF;QACnF,8EAA8E;QAC9E,kFAAkF;QAClF,wCAAwC;QACxC,iFAAiF;QACjF,gEAAgE;QAChE,kFAAkF;QAClF,8EAA8E;QAC9E,mEAAmE;QACnE,iFAAiF;QACjF,iCAAiC;IACnC,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mEAAmE;oBACnE,uEAAuE;oBACvE,6EAA6E;aAChF;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,uEAAuE;QACvE,yDAAyD;QACzD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAChG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2BAA2B;QAC3B,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,OAAO,KAAK,mEAAmE;gBACjF,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1E,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"revoke-repository-api-key.js","sourceRoot":"","sources":["../../../src/tools/revoke-repository-api-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,sBAAsB,GAAmB;IAC7C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,iFAAiF;QACjF,4EAA4E;QAC5E,yCAAyC;QACzC,+EAA+E;QAC/E,8DAA8D;QAC9D,mFAAmF;QACnF,8EAA8E;QAC9E,kFAAkF;QAClF,wCAAwC;QACxC,iFAAiF;QACjF,gEAAgE;QAChE,kFAAkF;QAClF,8EAA8E;QAC9E,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,6FAA6F;QAC7F,kFAAkF;QAClF,gGAAgG;QAChG,4CAA4C;QAC5C,wEAAwE;QACxE,8EAA8E;IAChF,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,0EAA0E;oBAC1E,qEAAqE;aACxE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mEAAmE;oBACnE,uEAAuE;oBACvE,6EAA6E;aAChF;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,CAAC;QACrC,4EAA4E;QAC5E,uEAAuE;QACvE,yDAAyD;QACzD,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,aAAa,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAChG,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,0EAA0E;QAC1E,2BAA2B;QAC3B,OAAO;YACL,IAAI,EACF,IAAI,KAAK,EAAE;gBACT,CAAC,CAAC,OAAO,KAAK,mEAAmE;gBACjF,CAAC,CAAC,IAAI;YACV,UAAU,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1E,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/src/tools/update-repository-member-permissions.js

@@ -1,4 +1,4 @@
-import { patchJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { patchJsonObject, requireUserOrAgentApiConfig } from "../support/specguard-api.js";
 import { requireString, requireStringArray } from "./args.js";
 /**
  * `PATCH /api/v1/repositories/:repository_id/members/:id` as a tool — shipped
@@ -49,8 +49,17 @@ const updateRepositoryMemberPermissions = {
         "SpecGuard's own words. " +
         "Takes `repository_id` — the numeric id `list_repositories` reports, not the `org/repo` " +
         "handle. " +
-        "Needs SPECGUARD_USER_API_KEY (an sgu_… key), the same credential `add_repository` " +
-        "writes with and a DIFFERENT one from the sgk_… repository key `get_repository_overview` uses.",
+        "It authenticates with EITHER of this server's two member-administration credentials, whichever " +
+        "is set: SPECGUARD_AGENT_API_KEY (an sga_… key — the call then reaches only the repositories " +
+        "granted onto that key at mint time, and only where the grant carries `members.manage`; a " +
+        "repository outside that set answers 404 in SpecGuard's own words, never a probe here) and, " +
+        "when that is not set, SPECGUARD_USER_API_KEY (an sgu_… key, the same credential " +
+        "`add_repository` writes with). With both set the agent key wins, so the edit answers inside " +
+        "the same set `list_repositories` reports. Under the agent credential the replacement set is " +
+        "bounded twice: the key cannot grant a permission it does not itself hold (SpecGuard answers " +
+        "400 naming the over-reach), and the re-stamped grantor is the key's owner. " +
+        "Either way it is a DIFFERENT credential from the sgk_… repository key `get_repository_overview` " +
+        "uses.",
     inputSchema: {
         type: "object",
         properties: {
@@ -90,7 +99,7 @@ const updateRepositoryMemberPermissions = {
         // caught here — before a write — rather than persisted as a member holding
         // nothing.
         const permissions = requireStringArray(args["permissions"], "permissions");
-        const api = requireUserApiConfig(context.config);
+        const api = requireUserOrAgentApiConfig(context.config);
         const updated = await patchJsonObject(api, `/api/v1/repositories/${encodeURIComponent(repositoryId)}/members/${encodeURIComponent(memberId)}`, { permissions }, context.fetch);
         // Unreshaped, the standing rule — the 200 body is this verb's whole answer.
         return {

package/dist/src/tools/update-repository-member-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-repository-member-permissions.js","sourceRoot":"","sources":["../../../src/tools/update-repository-member-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,iCAAiC,GAAmB;IACxD,IAAI,EAAE,sCAAsC;IAC5C,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,yFAAyF;QACzF,0FAA0F;QAC1F,8EAA8E;QAC9E,0BAA0B;QAC1B,wFAAwF;QACxF,sFAAsF;QACtF,2FAA2F;QAC3F,6CAA6C;QAC7C,2FAA2F;QAC3F,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,yEAAyE;QACzE,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,oFAAoF;QACpF,+FAA+F;IACjG,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,oFAAoF;oBACpF,qFAAqF;oBACrF,oFAAoF;oBACpF,oDAAoD;aACvD;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,kFAAkF;oBAClF,mFAAmF;oBACnF,0CAA0C;aAC7C;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,CAAC;QACvD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,WAAW;QACX,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,EAAE,WAAW,EAAE,EACf,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,4EAA4E;QAC5E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,iCAAiC,CAAC"}
+{"version":3,"file":"update-repository-member-permissions.js","sourceRoot":"","sources":["../../../src/tools/update-repository-member-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,iCAAiC,GAAmB;IACxD,IAAI,EAAE,sCAAsC;IAC5C,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,yFAAyF;QACzF,0FAA0F;QAC1F,8EAA8E;QAC9E,0BAA0B;QAC1B,wFAAwF;QACxF,sFAAsF;QACtF,2FAA2F;QAC3F,6CAA6C;QAC7C,2FAA2F;QAC3F,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,4FAA4F;QAC5F,yEAAyE;QACzE,2FAA2F;QAC3F,yBAAyB;QACzB,yFAAyF;QACzF,UAAU;QACV,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,kFAAkF;QAClF,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,6EAA6E;QAC7E,kGAAkG;QAClG,OAAO;IACT,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,aAAa,EAAE;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,qEAAqE;aACxE;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,mFAAmF;oBACnF,oFAAoF;oBACpF,qFAAqF;oBACrF,oFAAoF;oBACpF,oDAAoD;aACvD;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,WAAW,EACT,kFAAkF;oBAClF,mFAAmF;oBACnF,0CAA0C;aAC7C;SACF;QACD,QAAQ,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,CAAC;QACvD,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,sBAAsB;QACtB,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,WAAW;QACX,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAE3E,MAAM,GAAG,GAAG,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,GAAG,EACH,wBAAwB,kBAAkB,CAAC,YAAY,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAClG,EAAE,WAAW,EAAE,EACf,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,4EAA4E;QAC5E,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,iCAAiC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specguard-mcp",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "MCP server exposing SpecGuard suite intelligence to AI coding agents",
   "license": "ISC",
   "type": "module",