voroa-cli 0.0.0-stage → 0.2.0

package/src/mcp/tools/writes.js

@@ -0,0 +1,632 @@
+// Phase C write tools - configuration a customer can change from an AI client.
+//
+// The tier rule, and it is not "reversible": these DESTROY NO RESOURCE. That wording is forced by golden
+// rule 4 - no read path decrypts, so replacing an environment variable or a secret file puts the old value
+// beyond everyone's reach, the customer's included. Those two therefore take `overwrite: true` and are
+// REFUSED without it when the key already exists. The refusal is enforced in the backend
+// (lib/customerMcpOverwrite), not here: this package runs on the customer's laptop, so a guard that lived
+// only in this file would be absent the moment somebody used curl with the same token. The argument exists
+// here so the model can supply it and read back a clear reason when it does not.
+//
+// Every schema is CLOSED (`additionalProperties: false`) and names exactly the fields its route reads. A
+// tool that forwarded a model-authored object wholesale would be a tool whose surface is whatever the model
+// imagined this week.
+//
+// Nothing here creates a billable resource, deletes anything, or opens a network boundary. Those are
+// proposed, and a human confirms them in the dashboard.
+
+import { jsonResponse, badInput } from '../lib/response.js';
+import { serviceId } from './_ids.js';
+// Projected through _shape.js like every other tool - tests/staticScan refuses a tool module that shapes
+// its output inline, because an inline projection is invisible to the value-level scan.
+import { pick } from './_shape.js';
+
+// writeTool builds one tool from a declaration. `params` become validated path ids; `body` names the
+// arguments that travel in the request body, with their JSON-schema types.
+function writeTool({ name, description, method = 'POST', params = [], body = {}, required = [], path, project }) {
+  const properties = {};
+  for (const p of params) properties[p.name] = { type: 'string', description: p.description };
+  for (const [k, v] of Object.entries(body)) properties[k] = v;
+  return {
+    name,
+    kind: 'action',
+    scope: 'services:write',
+    description,
+    inputSchema: {
+      type: 'object',
+      properties,
+      required: [...params.filter((p) => !p.optional).map((p) => p.name), ...required],
+      additionalProperties: false,
+    },
+    async handler(args, ctx) {
+      const ids = {};
+      for (const p of params) {
+        const raw = args[p.name];
+        if (raw == null || raw === '') {
+          if (!p.optional) throw badInput(`${p.name} is required.`);
+          continue;
+        }
+        const ok = serviceId(raw);
+        if (!ok) throw badInput(`${p.name} is not a valid id.`);
+        ids[p.name] = ok;
+      }
+      const payload = {};
+      for (const k of Object.keys(body)) if (args[k] !== undefined) payload[k] = args[k];
+      const data = await ctx.http[method === 'PUT' ? 'put' : method === 'PATCH' ? 'patch' : 'post'](path(ids), payload);
+      // A write's response is projected too. Most routes answer { ok: true }; the ones that echo a row
+      // must not echo it whole - the same rule the read tools follow.
+      if (project) return jsonResponse(project(data));
+      return jsonResponse(pick(data || {}, ['ok', 'id', 'name', 'filename', 'saved', 'previewsRebuilding']));
+    },
+  };
+}
+
+const SERVICE_ARG = { name: 'serviceId', description: 'The service id, from list_services.' };
+const DB_ARG = { name: 'databaseId', description: 'The database id, from list_databases.' };
+const PROJECT_ARG = { name: 'projectId', description: 'The project id, from list_projects.' };
+const GROUP_ARG = { name: 'groupId', description: 'The environment group id, from list_env_groups.' };
+const svc = (v) => encodeURIComponent(v.serviceId);
+const db = (v) => encodeURIComponent(v.databaseId);
+const prj = (v) => encodeURIComponent(v.projectId);
+const grp = (v) => encodeURIComponent(v.groupId);
+
+const OVERWRITE = {
+  type: 'boolean',
+  description:
+    'Set true to REPLACE something that already has a value. Without it the request is refused when the '
+    + 'name already exists, because the current value cannot be read back by anyone and replacing it '
+    + 'discards it for good. Use list_env_vars or list_secret_files first to see which names exist.',
+};
+
+export const updateServiceSettings = writeTool({
+  name: 'update_service_settings',
+  description:
+    'Rename a service, or change the directory inside the repository that it builds from. Takes effect on '
+    + 'the next deploy.',
+  method: 'PATCH',
+  params: [SERVICE_ARG],
+  body: {
+    name: { type: 'string', description: 'A new name for the service.' },
+    rootDirectory: { type: 'string', description: 'The directory in the repository to build from, e.g. "apps/api".' },
+  },
+  path: (v) => `/apps/${svc(v)}/settings`,
+});
+
+export const setAutoDeploy = writeTool({
+  name: 'set_auto_deploy',
+  description:
+    'Turn automatic deploys on or off for a service. When on, a push to the configured branch deploys it.',
+  method: 'PATCH',
+  params: [SERVICE_ARG],
+  body: { autoDeploy: { type: 'boolean', description: 'true to deploy on every push to the branch.' } },
+  required: ['autoDeploy'],
+  path: (v) => `/apps/${svc(v)}/auto-deploy`,
+});
+
+export const setEnvVars = writeTool({
+  name: 'set_env_vars',
+  description:
+    'Add or replace environment variables on a service. Values are stored encrypted and can never be read '
+    + 'back - not by you, not by the customer, not by Voroa. Replacing one therefore discards the old value '
+    + 'permanently, so a name that already exists is refused unless overwrite is true. Applies from the '
+    + 'next deploy.',
+  method: 'PUT',
+  params: [SERVICE_ARG],
+  body: {
+    envVars: {
+      type: 'array',
+      description: 'The variables to set.',
+      items: {
+        type: 'object',
+        properties: {
+          key: { type: 'string' },
+          value: { type: 'string' },
+          isBuildTime: { type: 'boolean' },
+        },
+        required: ['key', 'value'],
+        additionalProperties: false,
+      },
+    },
+    overwrite: OVERWRITE,
+  },
+  required: ['envVars'],
+  path: (v) => `/apps/${svc(v)}/env`,
+});
+
+export const putSecretFile = writeTool({
+  name: 'put_secret_file',
+  description:
+    'Add or replace a secret file on a service. Contents are stored encrypted and can never be read back, '
+    + 'so replacing a file discards what was there - a filename that already exists is refused unless '
+    + 'overwrite is true. The file appears to the service at /etc/secrets/<filename> from the next deploy.',
+  method: 'PUT',
+  params: [SERVICE_ARG],
+  body: {
+    filename: { type: 'string', description: 'The file path, e.g. ".env" or "certs/key.pem".' },
+    content: { type: 'string', description: 'The file contents.' },
+    overwrite: OVERWRITE,
+  },
+  required: ['filename', 'content'],
+  path: (v) => `/apps/${svc(v)}/secret-files`,
+});
+
+export const setPreviewVariables = writeTool({
+  name: 'set_preview_variables',
+  description:
+    'Set the environment variables applied to a service\'s preview environments. Values are never readable '
+    + 'afterwards, exactly like a service\'s own environment variables.',
+  method: 'PUT',
+  params: [SERVICE_ARG],
+  body: {
+    variables: {
+      type: 'array',
+      description: 'The preview variables to set.',
+      items: {
+        type: 'object',
+        properties: {
+          key: { type: 'string' },
+          value: { type: 'string' },
+          isBuildTime: { type: 'boolean' },
+        },
+        required: ['key', 'value'],
+        additionalProperties: false,
+      },
+    },
+  },
+  required: ['variables'],
+  path: (v) => `/apps/${svc(v)}/preview-variables`,
+});
+
+export const setPreviewsEnabled = writeTool({
+  name: 'set_previews_enabled',
+  description:
+    'Turn preview environments on or off for a service. When on, an open pull request gets its own '
+    + 'temporary copy of the service.',
+  method: 'PATCH',
+  params: [SERVICE_ARG],
+  body: { enabled: { type: 'boolean', description: 'true to build a preview for each open pull request.' } },
+  required: ['enabled'],
+  path: (v) => `/apps/${svc(v)}/previews/enabled`,
+});
+
+export const addDomain = writeTool({
+  name: 'add_domain',
+  description:
+    'Add a custom domain to a service. Voroa then requests a certificate for it; the domain only starts '
+    + 'serving once its DNS points at Voroa, which the customer sets up at their registrar. Removing a '
+    + 'domain is not available from here.',
+  params: [SERVICE_ARG],
+  body: { domain: { type: 'string', description: 'The domain, e.g. "app.example.com".' } },
+  required: ['domain'],
+  path: (v) => `/apps/${svc(v)}/domains`,
+});
+
+export const reprovisionDomain = writeTool({
+  name: 'reprovision_domain',
+  description:
+    'Ask Voroa to try again on a custom domain whose certificate or routing did not come up. Safe to '
+    + 'repeat; it changes nothing about the domain itself.',
+  params: [SERVICE_ARG, { name: 'domainId', description: 'The domain id, from list_domains.' }],
+  path: (v) => `/apps/${svc(v)}/domains/${encodeURIComponent(v.domainId)}/reprovision`,
+});
+
+export const createScheduledTask = writeTool({
+  name: 'create_scheduled_task',
+  description:
+    'Add a scheduled task (a cron job) to a service. It runs inside the service\'s own running container, '
+    + 'so the service must be running for it to fire.',
+  params: [SERVICE_ARG],
+  body: {
+    name: { type: 'string', description: 'A name for the task.' },
+    command: { type: 'string', description: 'The command to run inside the container.' },
+    frequency: { type: 'string', description: 'A five-field cron expression, or a preset such as "daily".' },
+    enabled: { type: 'boolean', description: 'Whether it should start enabled. Defaults to true.' },
+  },
+  required: ['name', 'command', 'frequency'],
+  path: (v) => `/apps/${svc(v)}/scheduled-tasks`,
+});
+
+export const updateScheduledTask = writeTool({
+  name: 'update_scheduled_task',
+  description: 'Change a scheduled task\'s name, command, frequency, or whether it is enabled.',
+  method: 'PATCH',
+  params: [SERVICE_ARG, { name: 'taskId', description: 'The task id, from list_scheduled_tasks.' }],
+  body: {
+    name: { type: 'string' },
+    command: { type: 'string' },
+    frequency: { type: 'string', description: 'A five-field cron expression, or a preset such as "daily".' },
+    enabled: { type: 'boolean' },
+  },
+  path: (v) => `/apps/${svc(v)}/scheduled-tasks/${encodeURIComponent(v.taskId)}`,
+});
+
+export const reorderServiceEnvGroups = writeTool({
+  name: 'reorder_service_env_groups',
+  description:
+    'Set the order in which a service\'s environment groups are applied. A later group\'s value wins where '
+    + 'two groups define the same name.',
+  method: 'PATCH',
+  params: [SERVICE_ARG],
+  body: {
+    groupIds: {
+      type: 'array',
+      description: 'Every linked group id, in the order they should apply.',
+      items: { type: 'string' },
+    },
+  },
+  required: ['groupIds'],
+  path: (v) => `/apps/${svc(v)}/env-groups/order`,
+});
+
+export const createProject = writeTool({
+  name: 'create_project',
+  description:
+    'Create a project. A project groups services and their environments; it costs nothing on its own.',
+  body: {
+    name: { type: 'string', description: 'A name for the project.' },
+    environmentName: { type: 'string', description: 'Optional name for its first environment.' },
+  },
+  required: ['name'],
+  path: () => '/projects',
+});
+
+export const renameProject = writeTool({
+  name: 'rename_project',
+  description:
+    'Rename a project. The services and environments inside it are untouched - only the label the customer '
+    + 'sees changes.',
+  method: 'PATCH',
+  params: [PROJECT_ARG],
+  body: { name: { type: 'string', description: 'The new name.' } },
+  required: ['name'],
+  path: (v) => `/projects/${prj(v)}`,
+});
+
+export const createEnvironment = writeTool({
+  name: 'create_environment',
+  description:
+    'Add an environment to a project, such as "staging". An environment groups the services deployed for '
+    + 'one stage of the work.',
+  params: [PROJECT_ARG],
+  body: { name: { type: 'string', description: 'A name for the environment.' } },
+  required: ['name'],
+  path: (v) => `/projects/${prj(v)}/environments`,
+});
+
+export const renameEnvironment = writeTool({
+  name: 'rename_environment',
+  description:
+    'Rename an environment inside a project. The services deployed in it are untouched; only the label '
+    + 'changes.',
+  method: 'PATCH',
+  params: [PROJECT_ARG, { name: 'environmentId', description: 'The environment id, from list_environments.' }],
+  body: { name: { type: 'string', description: 'The new name.' } },
+  required: ['name'],
+  path: (v) => `/projects/${prj(v)}/environments/${encodeURIComponent(v.environmentId)}`,
+});
+
+export const createEnvGroup = writeTool({
+  name: 'create_env_group',
+  description:
+    'Create an environment group - a set of environment variables that several services can share.',
+  body: { name: { type: 'string', description: 'A name for the group.' } },
+  required: ['name'],
+  path: () => '/env-groups',
+});
+
+export const renameEnvGroup = writeTool({
+  name: 'rename_env_group',
+  description:
+    'Rename an environment group. The variables in it and the services linked to it are untouched - only '
+    + 'the label changes.',
+  method: 'PATCH',
+  params: [GROUP_ARG],
+  body: { name: { type: 'string', description: 'The new name.' } },
+  required: ['name'],
+  path: (v) => `/env-groups/${grp(v)}`,
+});
+
+export const setEnvGroupVariables = writeTool({
+  name: 'set_env_group_variables',
+  description:
+    'Set the variables in an environment group. Every service linked to the group picks them up on its '
+    + 'next deploy. Values can never be read back afterwards.',
+  method: 'PUT',
+  params: [GROUP_ARG],
+  body: {
+    variables: {
+      type: 'array',
+      description: 'The variables for this group.',
+      items: {
+        type: 'object',
+        // `key`, not `name` - the route reads v.key (routes/envGroups.js). A tool that sent `name` would
+        // be accepted by the schema and dropped by the handler, which is the worst kind of wrong.
+        properties: {
+          key: { type: 'string' },
+          value: { type: 'string' },
+          isBuildTime: { type: 'boolean' },
+        },
+        required: ['key', 'value'],
+        additionalProperties: false,
+      },
+    },
+  },
+  required: ['variables'],
+  path: (v) => `/env-groups/${grp(v)}/env-vars`,
+});
+
+export const linkEnvGroupToService = writeTool({
+  name: 'link_env_group_to_service',
+  description:
+    'Apply an environment group to a service. The service picks up the group\'s variables on its next '
+    + 'deploy. Unlinking is not available from here.',
+  params: [GROUP_ARG, SERVICE_ARG],
+  path: (v) => `/env-groups/${grp(v)}/services/${svc(v)}`,
+});
+
+export const updateDatabaseSettings = writeTool({
+  name: 'update_database_settings',
+  description:
+    'Change how much memory a database may use. It applies without deleting anything, and a value below '
+    + 'what the plan allows is refused.',
+  method: 'PATCH',
+  params: [DB_ARG],
+  body: { ramMb: { type: 'number', description: 'Memory limit in megabytes.' } },
+  required: ['ramMb'],
+  path: (v) => `/databases/${db(v)}`,
+});
+
+export const restartDatabase = writeTool({
+  name: 'restart_database',
+  description:
+    'Restart a database. It is briefly unavailable while it comes back; no data is changed and nothing is '
+    + 'lost.',
+  params: [DB_ARG],
+  path: (v) => `/databases/${db(v)}/restart`,
+});
+
+export const stopDatabase = writeTool({
+  name: 'stop_database',
+  description:
+    'Stop a database. Anything connected to it will fail until it is started again. Nothing is deleted, '
+    + 'and start_database brings it back.',
+  params: [DB_ARG],
+  path: (v) => `/databases/${db(v)}/stop`,
+});
+
+export const startDatabase = writeTool({
+  name: 'start_database',
+  description:
+    'Start a database that was stopped. It becomes reachable again once it has finished coming up; nothing '
+    + 'about its data changes.',
+  params: [DB_ARG],
+  path: (v) => `/databases/${db(v)}/start`,
+});
+
+export const createDatabaseUser = writeTool({
+  name: 'create_database_user',
+  description:
+    'Create a database user. Its password is generated by Voroa and shown in the dashboard, never returned '
+    + 'here.',
+  params: [DB_ARG],
+  body: { name: { type: 'string', description: 'The user name.' } },
+  required: ['name'],
+  path: (v) => `/databases/${db(v)}/users`,
+});
+
+export const setDefaultDatabaseUser = writeTool({
+  name: 'set_default_database_user',
+  description:
+    'Choose which database user the connection details in the dashboard are issued for. The other users '
+    + 'keep working; only which one is offered by default changes.',
+  params: [DB_ARG, { name: 'userName', description: 'The user name, from list_database_users.' }],
+  path: (v) => `/databases/${db(v)}/users/${encodeURIComponent(v.userName)}/default`,
+});
+
+export const preflightImport = writeTool({
+  name: 'preflight_import',
+  description:
+    'Check whether a dump could be imported into a database - its size, format and whether the database '
+    + 'has room. This is a DRY RUN: it reads the source and changes nothing. The import itself replaces the '
+    + 'database\'s current data, so it is not available from here; propose it and confirm it in the '
+    + 'dashboard.',
+  params: [DB_ARG],
+  body: { sourceUrl: { type: 'string', description: 'Where the dump can be read from.' } },
+  required: ['sourceUrl'],
+  path: (v) => `/databases/${db(v)}/import/preflight`,
+  project: (d) => d || null,
+});
+
+// Reversible, and it belongs beside `stop` rather than in the write tier: the service stops answering the
+// internet until someone turns it back on. Declared here because it is a write in shape, but it carries
+// services:act and a reversibility row.
+export const setMaintenanceMode = {
+  name: 'set_maintenance_mode',
+  kind: 'action',
+  scope: 'services:act',
+  description:
+    'Put a service into maintenance mode, or take it out. While it is on, visitors see a maintenance page '
+    + 'instead of the service - it is DOWN for them - but nothing is destroyed and turning it off restores '
+    + 'service immediately.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      serviceId: { type: 'string', description: 'The service id, from list_services.' },
+      on: { type: 'boolean', description: 'true to show the maintenance page, false to serve normally.' },
+      pageUrl: { type: 'string', description: 'Optional address of a page to show instead of the default.' },
+    },
+    required: ['serviceId', 'on'],
+    additionalProperties: false,
+  },
+  async handler(args, ctx) {
+    const id = serviceId(args.serviceId);
+    if (!id) throw badInput('serviceId is required and must be a valid service id from list_services.');
+    if (typeof args.on !== 'boolean') throw badInput('on must be true or false.');
+    const body = { on: args.on };
+    if (args.pageUrl !== undefined) body.pageUrl = args.pageUrl;
+    return jsonResponse(await ctx.http.put(`/apps/${encodeURIComponent(id)}/maintenance`, body));
+  },
+};
+
+// ADR-0263. Reversible in the same sense maintenance is: the service keeps running and nothing is
+// destroyed; turning it back restores the previous path within a few minutes.
+export const setEdgeProtection = {
+  name: 'set_edge_protection',
+  kind: 'action',
+  scope: 'services:act',
+  description:
+    'Turn edge protection on or off for a service. On: its address is served through an edge network '
+    + 'that absorbs floods, uploads over 100 MB are refused, a request that takes over 100 seconds to start '
+    + 'answering times out, and X-Real-Ip is not provided (the visitor is the second-to-last X-Forwarded-For entry; the last is the edge address). Off: '
+    + 'visitors reach the service directly. The change is applied within a few minutes.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      serviceId: { type: 'string', description: 'The service id, from list_services.' },
+      enabled: { type: 'boolean', description: 'true to serve through the edge network, false to serve directly.' },
+    },
+    required: ['serviceId', 'enabled'],
+    additionalProperties: false,
+  },
+  async handler(args, ctx) {
+    const id = serviceId(args.serviceId);
+    if (!id) throw badInput('serviceId is required and must be a valid service id from list_services.');
+    if (typeof args.enabled !== 'boolean') throw badInput('enabled must be true or false.');
+    return jsonResponse(await ctx.http.patch(`/apps/${encodeURIComponent(id)}/edge-protection`, { enabled: args.enabled }));
+  },
+};
+
+// Object Storage: write a bucket's endpoint, name and key into a service's environment variables (the
+// dashboard's Connect tab). The secret travels server-side only - this tool never sees or returns it. The
+// service picks the variables up on its next deploy.
+export const connectBucketToService = writeTool({
+  name: 'connect_bucket_to_service',
+  description:
+    'Give a service access to a bucket: writes <prefix>ENDPOINT, BUCKET, REGION, ACCESS_KEY_ID and '
+    + 'SECRET_ACCESS_KEY into the service\'s environment variables (prefix defaults to S3_). Refused if any of '
+    + 'those names already exists on the service. Redeploy the service afterwards so it reads them.',
+  params: [{ name: 'bucketId', description: 'The bucket id, from list_buckets.' }],
+  body: {
+    appUuid: { type: 'string', description: 'The service id, from list_services.' },
+    prefix: { type: 'string', description: 'Optional. Uppercase variable prefix, for example S3_ or MEDIA_.' },
+  },
+  required: ['appUuid'],
+  path: (v) => `/buckets/${encodeURIComponent(v.bucketId)}/connect`,
+  project: (d) => pick(d || {}, ['keys']),
+});
+
+// ---- Wave 2 writes (plan 2026-10-27) ----------------------------------------------------------------------
+export const verifyDomainClaim = writeTool({
+  name: 'verify_domain_claim',
+  description:
+    'Check the DNS of a domain the customer claimed on a service and, if the records are right, attach it. '
+    + 'Nothing changes when the records are not in place yet - the answer says what is missing.',
+  params: [SERVICE_ARG, { name: 'claimId', description: 'The claim id, from list_domains (pending claims).' }],
+  path: (v) => `/apps/${svc(v)}/domains/claims/${encodeURIComponent(v.claimId)}/verify`,
+  project: (d) => pick(d || {}, ['id', 'domain', 'ownership', 'status', 'verifiedStatus']),
+});
+
+export const importPreviewVariables = writeTool({
+  name: 'import_preview_variables',
+  description:
+    'Copy the service\'s production environment variable NAMES and values into its preview variables, so '
+    + 'preview deploys start with the same configuration. Refused unless overwrite:true when preview variables '
+    + 'already exist (values cannot be read back, so replacing them is final). includeManagedDatabases:true '
+    + 'also copies the connection variables of linked databases - previews would then share production data.',
+  params: [SERVICE_ARG],
+  body: {
+    overwrite: { type: 'boolean', description: 'Required true to replace preview variables that already exist.' },
+    includeManagedDatabases: { type: 'boolean', description: 'Also copy linked database connection variables (previews then use production data).' },
+  },
+  path: (v) => `/apps/${svc(v)}/preview-variables/import`,
+  project: (d) => pick(d || {}, ['ok', 'imported', 'skippedExisting', 'skippedDatabases', 'skippedInvalid', 'skippedOverCap', 'previewsRebuilding']),
+});
+
+export const createDatabaseBackup = writeTool({
+  name: 'create_database_backup',
+  description:
+    'Take a backup of a paid database now. Free of charge; one pending backup per database at a time; kept '
+    + 'for the retention period shown by list_database_backups. Refused on free databases.',
+  params: [DB_ARG],
+  path: (v) => `/databases/${db(v)}/backups`,
+  project: (d) => pick(d || {}, ['backupId', 'status', 'message']),
+});
+
+export const enableDatabaseBackups = writeTool({
+  name: 'enable_database_backups',
+  description:
+    'Turn nightly backups ON for a paid database. Turning them OFF is not possible here - it is proposed '
+    + 'with propose(disable_database_backups) and approved by a person, because it is a quiet way to lose data.',
+  method: 'PUT',
+  params: [DB_ARG],
+  body: { enabled: { type: 'boolean', enum: [true], description: 'Must be true.' } },
+  required: ['enabled'],
+  path: (v) => `/databases/${db(v)}/backups/settings`,
+  project: (d) => pick(d || {}, ['backupsEnabled']),
+});
+
+export const setNotificationSettings = writeTool({
+  name: 'set_notification_settings',
+  description:
+    'Turn the workspace email alerts on or off: deploy (a failed deploy) and usage (approaching a limit). '
+    + 'Send only the ones to change. Reversible.',
+  method: 'PUT',
+  body: {
+    deploy: { type: 'boolean', description: 'Email on a failed deploy.' },
+    usage: { type: 'boolean', description: 'Email when usage approaches a limit.' },
+  },
+  path: () => '/workspace/notifications',
+  project: (d) => pick(d || {}, ['deploy', 'usage']),
+});
+
+// Support tickets (CTO decision 2026-10-27). Capped per token per day on the server (3 new, 20 replies),
+// and the support desk sees every one marked as sent by an AI client.
+const TICKET_ARG = { name: 'ticketId', description: 'The ticket id, from list_tickets.' };
+
+export const openTicket = writeTool({
+  name: 'open_ticket',
+  description:
+    'Open a support ticket with Voroa. Use it for a real problem the customer cannot fix themselves, after '
+    + 'checking status, logs and deploy history. Limited to a few per day per token, and marked as sent by '
+    + 'an AI client. Tell the customer you opened it.',
+  body: {
+    subject: { type: 'string', description: 'One line: what is wrong.' },
+    body: { type: 'string', description: 'What happened, what was tried, and any error text.' },
+    priority: { type: 'string', enum: ['low', 'normal', 'high'], description: 'Optional. Defaults to normal.' },
+    category: { type: 'string', enum: ['billing', 'deployments', 'domains', 'databases', 'account', 'other'], description: 'Optional. Defaults to other.' },
+    appUuid: { type: 'string', description: 'Optional. The service id the ticket is about.' },
+  },
+  required: ['subject', 'body'],
+  path: () => '/support/tickets',
+  project: (d) => ({ ticket: pick((d && d.ticket) || {}, ['id', 'subject', 'status', 'priority', 'createdAt']) }),
+});
+
+export const replyTicket = writeTool({
+  name: 'reply_ticket',
+  description: 'Add a reply to one of the workspace\'s support tickets. Reopens a solved ticket. Limited per day.',
+  params: [TICKET_ARG],
+  body: { body: { type: 'string', description: 'The reply text.' } },
+  required: ['body'],
+  path: (v) => `/support/tickets/${encodeURIComponent(v.ticketId)}/reply`,
+  project: (d) => ({ ticket: pick((d && d.ticket) || {}, ['id', 'status', 'updatedAt']) }),
+});
+
+export const solveTicket = writeTool({
+  name: 'solve_ticket',
+  description: 'Mark a support ticket solved because the problem is fixed. A later reply reopens it.',
+  params: [TICKET_ARG],
+  path: (v) => `/support/tickets/${encodeURIComponent(v.ticketId)}/solve`,
+  project: (d) => ({ ticket: pick((d && d.ticket) || {}, ['id', 'status', 'updatedAt']) }),
+});
+
+export const WRITE_TOOLS = [
+  openTicket, replyTicket, solveTicket,
+  verifyDomainClaim, importPreviewVariables, createDatabaseBackup, enableDatabaseBackups, setNotificationSettings,
+  updateServiceSettings, setAutoDeploy, setEnvVars, putSecretFile, setPreviewVariables, setPreviewsEnabled,
+  addDomain, reprovisionDomain, createScheduledTask, updateScheduledTask, reorderServiceEnvGroups,
+  createProject, renameProject, createEnvironment, renameEnvironment, createEnvGroup, renameEnvGroup,
+  setEnvGroupVariables, linkEnvGroupToService, updateDatabaseSettings, restartDatabase, stopDatabase,
+  startDatabase, createDatabaseUser, setDefaultDatabaseUser, preflightImport, setMaintenanceMode,
+  setEdgeProtection,
+  connectBucketToService,
+];