whale-code 6.5.6 → 6.5.8

package/dist/server/tool-router-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-router-types.js","names":["handleInventory","handleInventoryQuery","handleInventoryAudit","handlePurchaseOrders","handleTransfers","handleProducts","handleCollections","handleCustomers","handleOrders","handleAnalytics","handleLocations","handleSuppliers","handleAlerts","handleAuditTrail","handleStore","handleEmail","handleDocuments","handleWebSearch","handleTelemetry","handleBrowser","handleDiscovery","handleVoice","handleWorkflows","handleEmbeddings","handleLLM","handleImageGen","handleRemoveBg","handleMedia","handleVideoGen","handleAPIKeys","handleCreations","handleMetaAds","handleKali","handleLocalAgent","handleEnrichment","handleStorefront","handleApiDocs","handleClickHouse","toolMetrics","Map","getToolMetrics","result","name","m","invocations","errors","avgMs","Math","round","totalMs","lastMs","recordToolMetric","toolName","durationMs","success","get","set","DEFAULT_TIMEOUT","buildToolHandlers","handleDiscoverTools","handlers","inventory","handler","sb","args","sid","a","action","startsWith","slice","includes","timeout","requiresStore","purchase_orders","transfers","products","collections","customers","orders","analytics","locations","suppliers","store","storefront","email","documents","alerts","audit_trail","workflows","voice","image_gen","remove_bg","media","video_gen","llm","embeddings","creations","web_search","telemetry","browser","discovery","api_keys","api_docs","meta_ads","kali","supportsProgress","local_agent","enrichment","clickhouse","discover_tools","Object","freeze","TOOL_CATEGORIES"],"sources":["../../src/server/tool-router-types.ts"],"sourcesContent":["/**\n * Tool Router — types, metrics, and tool handler registry.\n */\n\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\n\nimport { handleInventory, handleInventoryQuery, handleInventoryAudit } from \"./handlers/inventory.js\";\nimport { handlePurchaseOrders, handleTransfers } from \"./handlers/supply-chain.js\";\nimport { handleProducts, handleCollections } from \"./handlers/catalog.js\";\nimport { handleCustomers, handleOrders } from \"./handlers/crm.js\";\nimport { handleAnalytics } from \"./handlers/analytics.js\";\nimport { handleLocations, handleSuppliers, handleAlerts, handleAuditTrail, handleStore } from \"./handlers/operations.js\";\nimport { handleEmail, handleDocuments } from \"./handlers/comms.js\";\nimport { handleWebSearch, handleTelemetry } from \"./handlers/platform.js\";\nimport { handleBrowser } from \"./handlers/browser.js\";\nimport { handleDiscovery } from \"./handlers/discovery.js\";\nimport { handleVoice } from \"./handlers/voice.js\";\nimport { handleWorkflows } from \"./handlers/workflows.js\";\nimport { handleEmbeddings } from \"./handlers/embeddings.js\";\nimport { handleLLM } from \"./handlers/llm-providers.js\";\nimport { handleImageGen } from \"./handlers/image-gen.js\";\nimport { handleRemoveBg } from \"./handlers/remove-bg.js\";\nimport { handleMedia } from \"./handlers/media.js\";\nimport { handleVideoGen } from \"./handlers/video-gen.js\";\nimport { handleAPIKeys } from \"./handlers/api-keys.js\";\nimport { handleCreations } from \"./handlers/creations.js\";\nimport { handleMetaAds } from \"./handlers/meta-ads.js\";\nimport { handleKali } from \"./handlers/kali.js\";\nimport { handleLocalAgent } from \"./handlers/local-agent.js\";\nimport { handleEnrichment } from \"./handlers/enrichment.js\";\nimport { handleStorefront } from \"./handlers/storefront.js\";\nimport { handleApiDocs } from \"./handlers/api-docs.js\";\nimport { handleClickHouse } from \"./handlers/clickhouse.js\";\n\n// ============================================================================\n// TYPES\n// ============================================================================\n\nexport interface ToolDef {\n  name: string;\n  description: string;\n  input_schema: Record<string, unknown>;\n}\n\nexport interface UserToolRow {\n  id: string;\n  name: string;\n  display_name: string;\n  description: string;\n  input_schema: Record<string, unknown>;\n  execution_type: \"rpc\" | \"http\" | \"sql\";\n  is_read_only: boolean;\n  requires_approval: boolean;\n  http_config: Record<string, unknown> | null;\n  rpc_function: string | null;\n  sql_template: string | null;\n  allowed_tables: string[] | null;\n  max_execution_time_ms: number;\n}\n\nexport interface AgentConfig {\n  id: string;\n  name: string;\n  description: string;\n  system_prompt: string;\n  model: string;\n  max_tokens: number;\n  max_tool_calls: number;\n  temperature: number;\n  enabled_tools: string[];\n  can_query: boolean;\n  can_send: boolean;\n  can_modify: boolean;\n  tone: string;\n  verbosity: string;\n  api_key: string | null;\n  store_id: string | null;\n  context_config: {\n    includeLocations?: boolean;\n    locationIds?: string[];\n    includeCustomers?: boolean;\n    customerSegments?: string[];\n    max_history_chars?: number;\n    max_tool_result_chars?: number;\n    max_message_chars?: number;\n    compaction_trigger_tokens?: number;\n    compaction_total_budget?: number;\n    clear_thinking_keep?: number;\n    clear_tool_uses_trigger?: number;\n    clear_tool_uses_keep?: number;\n    session_cost_budget_usd?: number;\n    max_concurrent_tools?: number;\n    enable_delegation?: boolean;\n    max_duration_ms?: number;\n    enable_model_routing?: boolean;\n    subagent_max_tokens?: number;\n    subagent_max_turns?: number;\n    subagent_temperature?: number;\n  } | null;\n}\n\nexport interface ToolLoadResult {\n  core: ToolDef[];\n  extended: ToolDef[];\n  all: ToolDef[];\n}\n\nexport type ToolProgressCallback = (toolName: string, progress: unknown) => void;\n\nexport type ToolHandler = (\n  sb: SupabaseClient,\n  args: Record<string, unknown>,\n  storeId?: string,\n  onToolProgress?: (progress: unknown) => void,\n) => Promise<{ success: boolean; data?: unknown; error?: string }>;\n\nexport interface ToolHandlerEntry {\n  handler: ToolHandler;\n  timeout: number;\n  requiresStore: boolean;\n  supportsProgress?: boolean;\n}\n\n// ============================================================================\n// IN-MEMORY EXECUTION METRICS\n// ============================================================================\n\nconst toolMetrics = new Map<string, { invocations: number; errors: number; totalMs: number; lastMs: number }>();\n\nexport function getToolMetrics(): Record<string, { invocations: number; errors: number; avgMs: number; lastMs: number }> {\n  const result: Record<string, { invocations: number; errors: number; avgMs: number; lastMs: number }> = {};\n  for (const [name, m] of toolMetrics) {\n    result[name] = { invocations: m.invocations, errors: m.errors, avgMs: m.invocations > 0 ? Math.round(m.totalMs / m.invocations) : 0, lastMs: m.lastMs };\n  }\n  return result;\n}\n\nexport function recordToolMetric(toolName: string, durationMs: number, success: boolean): void {\n  let m = toolMetrics.get(toolName);\n  if (!m) { m = { invocations: 0, errors: 0, totalMs: 0, lastMs: 0 }; toolMetrics.set(toolName, m); }\n  m.invocations++;\n  m.totalMs += durationMs;\n  m.lastMs = durationMs;\n  if (!success) m.errors++;\n}\n\n// ============================================================================\n// CONSTANTS\n// ============================================================================\n\nexport const DEFAULT_TIMEOUT = 30_000;\n\n// ============================================================================\n// UNIFIED HANDLER REGISTRY — forward declaration for discover_tools handler\n// ============================================================================\n\n// This is populated by tool-router.ts after handleDiscoverTools is defined there\n// We declare the type and a factory function here\n\nexport function buildToolHandlers(handleDiscoverTools: ToolHandler): Record<string, ToolHandlerEntry> {\n  const handlers: Record<string, ToolHandlerEntry> = {\n    // --- Business Data ---\n    inventory: { handler: (sb, args, sid) => {\n      const a = args.action as string || \"\";\n      if (a.startsWith(\"audit_\")) return handleInventoryAudit(sb, { ...args, action: a.slice(6) }, sid);\n      if ([\"summary\",\"velocity\",\"by_location\",\"in_stock\",\"out_of_stock\",\"by_category\"].includes(a)) return handleInventoryQuery(sb, args, sid);\n      return handleInventory(sb, args, sid);\n    }, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    purchase_orders: { handler: handlePurchaseOrders, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    transfers: { handler: handleTransfers, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    products: { handler: handleProducts, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    collections: { handler: handleCollections, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    customers: { handler: handleCustomers, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    orders: { handler: handleOrders, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    analytics: { handler: handleAnalytics, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    locations: { handler: handleLocations, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    suppliers: { handler: handleSuppliers, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    store: { handler: handleStore, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    storefront: { handler: handleStorefront, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n\n    // --- Communication ---\n    email: { handler: handleEmail, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    documents: { handler: handleDocuments, timeout: 120_000, requiresStore: true },\n\n    // --- Operations ---\n    alerts: { handler: handleAlerts, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    audit_trail: { handler: handleAuditTrail, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    workflows: { handler: handleWorkflows, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n\n    // --- AI & Generation ---\n    voice: { handler: handleVoice, timeout: 120_000, requiresStore: true },\n    image_gen: { handler: handleImageGen, timeout: 60_000, requiresStore: true },\n    remove_bg: { handler: handleRemoveBg, timeout: 60_000, requiresStore: true },\n    media: { handler: handleMedia, timeout: 60_000, requiresStore: true },\n    video_gen: { handler: handleVideoGen, timeout: 600_000, requiresStore: true },\n    llm: { handler: handleLLM, timeout: 120_000, requiresStore: true },\n    embeddings: { handler: handleEmbeddings, timeout: 60_000, requiresStore: true },\n    creations: { handler: handleCreations, timeout: 60_000, requiresStore: true },\n\n    // --- Platform & Infrastructure ---\n    web_search: { handler: handleWebSearch, timeout: DEFAULT_TIMEOUT, requiresStore: false },\n    telemetry: { handler: handleTelemetry, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    browser: { handler: handleBrowser, timeout: 120_000, requiresStore: true },\n    discovery: { handler: handleDiscovery, timeout: DEFAULT_TIMEOUT, requiresStore: false },\n    api_keys: { handler: handleAPIKeys, timeout: DEFAULT_TIMEOUT, requiresStore: true },\n    api_docs: { handler: handleApiDocs, timeout: 5000, requiresStore: false },\n\n    // --- Advertising ---\n    meta_ads: { handler: handleMetaAds, timeout: 300_000, requiresStore: true },\n\n    // --- Security & Local ---\n    kali: { handler: handleKali as ToolHandler, timeout: 600_000, requiresStore: true, supportsProgress: true },\n    local_agent: { handler: handleLocalAgent, timeout: 600_000, requiresStore: false },\n\n    // --- Customer Data ---\n    enrichment: { handler: handleEnrichment, timeout: 60_000, requiresStore: true },\n\n    // --- Observability ---\n    clickhouse: { handler: handleClickHouse, timeout: 60_000, requiresStore: false },\n\n    // --- Meta: Tool Discovery ---\n    discover_tools: { handler: handleDiscoverTools, timeout: 5000, requiresStore: false },\n  };\n  Object.freeze(handlers);\n  return handlers;\n}\n\n// ============================================================================\n// TOOL CATEGORY HEURISTICS\n// ============================================================================\n\nexport const TOOL_CATEGORIES: Record<string, string> = {\n  inventory: \"business\", purchase_orders: \"business\", transfers: \"business\",\n  products: \"business\", collections: \"business\", customers: \"business\",\n  orders: \"business\", analytics: \"business\", locations: \"business\",\n  suppliers: \"business\", store: \"business\", storefront: \"business\",\n  email: \"communication\", documents: \"communication\",\n  alerts: \"operations\", audit_trail: \"operations\", workflows: \"operations\",\n  telemetry: \"operations\",\n  voice: \"media\", image_gen: \"media\", video_gen: \"media\", remove_bg: \"media\", media: \"media\",\n  llm: \"ai\", embeddings: \"ai\", creations: \"media\",\n  web_search: \"platform\", browser: \"platform\", discovery: \"platform\",\n  api_keys: \"platform\", api_docs: \"platform\",\n  kali: \"security\", local_agent: \"platform\",\n  meta_ads: \"advertising\",\n  enrichment: \"data\",\n};\n"],"mappings":"AAAA;AACA;AACA;;AAIA,SAASA,eAAe,EAAEC,oBAAoB,EAAEC,oBAAoB,QAAQ,yBAAyB;AACrG,SAASC,oBAAoB,EAAEC,eAAe,QAAQ,4BAA4B;AAClF,SAASC,cAAc,EAAEC,iBAAiB,QAAQ,uBAAuB;AACzE,SAASC,eAAe,EAAEC,YAAY,QAAQ,mBAAmB;AACjE,SAASC,eAAe,QAAQ,yBAAyB;AACzD,SAASC,eAAe,EAAEC,eAAe,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,WAAW,QAAQ,0BAA0B;AACxH,SAASC,WAAW,EAAEC,eAAe,QAAQ,qBAAqB;AAClE,SAASC,eAAe,EAAEC,eAAe,QAAQ,wBAAwB;AACzE,SAASC,aAAa,QAAQ,uBAAuB;AACrD,SAASC,eAAe,QAAQ,yBAAyB;AACzD,SAASC,WAAW,QAAQ,qBAAqB;AACjD,SAASC,eAAe,QAAQ,yBAAyB;AACzD,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,SAAS,QAAQ,6BAA6B;AACvD,SAASC,cAAc,QAAQ,yBAAyB;AACxD,SAASC,cAAc,QAAQ,yBAAyB;AACxD,SAASC,WAAW,QAAQ,qBAAqB;AACjD,SAASC,cAAc,QAAQ,yBAAyB;AACxD,SAASC,aAAa,QAAQ,wBAAwB;AACtD,SAASC,eAAe,QAAQ,yBAAyB;AACzD,SAASC,aAAa,QAAQ,wBAAwB;AACtD,SAASC,UAAU,QAAQ,oBAAoB;AAC/C,SAASC,gBAAgB,QAAQ,2BAA2B;AAC5D,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,aAAa,QAAQ,wBAAwB;AACtD,SAASC,gBAAgB,QAAQ,0BAA0B;;AAE3D;AACA;AACA;;AAuFA;AACA;AACA;;AAEA,MAAMC,WAAW,GAAG,IAAIC,GAAG,CAAmF,CAAC;AAE/G,OAAO,SAASC,cAAcA,CAAA,EAA2F;EACvH,MAAMC,MAA8F,GAAG,CAAC,CAAC;EACzG,KAAK,MAAM,CAACC,IAAI,EAAEC,CAAC,CAAC,IAAIL,WAAW,EAAE;IACnCG,MAAM,CAACC,IAAI,CAAC,GAAG;MAAEE,WAAW,EAAED,CAAC,CAACC,WAAW;MAAEC,MAAM,EAAEF,CAAC,CAACE,MAAM;MAAEC,KAAK,EAAEH,CAAC,CAACC,WAAW,GAAG,CAAC,GAAGG,IAAI,CAACC,KAAK,CAACL,CAAC,CAACM,OAAO,GAAGN,CAAC,CAACC,WAAW,CAAC,GAAG,CAAC;MAAEM,MAAM,EAAEP,CAAC,CAACO;IAAO,CAAC;EACzJ;EACA,OAAOT,MAAM;AACf;AAEA,OAAO,SAASU,gBAAgBA,CAACC,QAAgB,EAAEC,UAAkB,EAAEC,OAAgB,EAAQ;EAC7F,IAAIX,CAAC,GAAGL,WAAW,CAACiB,GAAG,CAACH,QAAQ,CAAC;EACjC,IAAI,CAACT,CAAC,EAAE;IAAEA,CAAC,GAAG;MAAEC,WAAW,EAAE,CAAC;MAAEC,MAAM,EAAE,CAAC;MAAEI,OAAO,EAAE,CAAC;MAAEC,MAAM,EAAE;IAAE,CAAC;IAAEZ,WAAW,CAACkB,GAAG,CAACJ,QAAQ,EAAET,CAAC,CAAC;EAAE;EAClGA,CAAC,CAACC,WAAW,EAAE;EACfD,CAAC,CAACM,OAAO,IAAII,UAAU;EACvBV,CAAC,CAACO,MAAM,GAAGG,UAAU;EACrB,IAAI,CAACC,OAAO,EAAEX,CAAC,CAACE,MAAM,EAAE;AAC1B;;AAEA;AACA;AACA;;AAEA,OAAO,MAAMY,eAAe,GAAG,MAAM;;AAErC;AACA;AACA;;AAEA;AACA;;AAEA,OAAO,SAASC,iBAAiBA,CAACC,mBAAgC,EAAoC;EACpG,MAAMC,QAA0C,GAAG;IACjD;IACAC,SAAS,EAAE;MAAEC,OAAO,EAAEA,CAACC,EAAE,EAAEC,IAAI,EAAEC,GAAG,KAAK;QACvC,MAAMC,CAAC,GAAGF,IAAI,CAACG,MAAM,IAAc,EAAE;QACrC,IAAID,CAAC,CAACE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAOlE,oBAAoB,CAAC6D,EAAE,EAAE;UAAE,GAAGC,IAAI;UAAEG,MAAM,EAAED,CAAC,CAACG,KAAK,CAAC,CAAC;QAAE,CAAC,EAAEJ,GAAG,CAAC;QACjG,IAAI,CAAC,SAAS,EAAC,UAAU,EAAC,aAAa,EAAC,UAAU,EAAC,cAAc,EAAC,aAAa,CAAC,CAACK,QAAQ,CAACJ,CAAC,CAAC,EAAE,OAAOjE,oBAAoB,CAAC8D,EAAE,EAAEC,IAAI,EAAEC,GAAG,CAAC;QACxI,OAAOjE,eAAe,CAAC+D,EAAE,EAAEC,IAAI,EAAEC,GAAG,CAAC;MACvC,CAAC;MAAEM,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAClDC,eAAe,EAAE;MAAEX,OAAO,EAAE3D,oBAAoB;MAAEoE,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACjGE,SAAS,EAAE;MAAEZ,OAAO,EAAE1D,eAAe;MAAEmE,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtFG,QAAQ,EAAE;MAAEb,OAAO,EAAEzD,cAAc;MAAEkE,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACpFI,WAAW,EAAE;MAAEd,OAAO,EAAExD,iBAAiB;MAAEiE,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAC1FK,SAAS,EAAE;MAAEf,OAAO,EAAEvD,eAAe;MAAEgE,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtFM,MAAM,EAAE;MAAEhB,OAAO,EAAEtD,YAAY;MAAE+D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAChFO,SAAS,EAAE;MAAEjB,OAAO,EAAErD,eAAe;MAAE8D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtFQ,SAAS,EAAE;MAAElB,OAAO,EAAEpD,eAAe;MAAE6D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtFS,SAAS,EAAE;MAAEnB,OAAO,EAAEnD,eAAe;MAAE4D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtFU,KAAK,EAAE;MAAEpB,OAAO,EAAEhD,WAAW;MAAEyD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAC9EW,UAAU,EAAE;MAAErB,OAAO,EAAE3B,gBAAgB;MAAEoC,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAExF;IACAY,KAAK,EAAE;MAAEtB,OAAO,EAAE/C,WAAW;MAAEwD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAC9Ea,SAAS,EAAE;MAAEvB,OAAO,EAAE9C,eAAe;MAAEuD,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IAE9E;IACAc,MAAM,EAAE;MAAExB,OAAO,EAAElD,YAAY;MAAE2D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAChFe,WAAW,EAAE;MAAEzB,OAAO,EAAEjD,gBAAgB;MAAE0D,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACzFgB,SAAS,EAAE;MAAE1B,OAAO,EAAExC,eAAe;MAAEiD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IAEtF;IACAiB,KAAK,EAAE;MAAE3B,OAAO,EAAEzC,WAAW;MAAEkD,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IACtEkB,SAAS,EAAE;MAAE5B,OAAO,EAAErC,cAAc;MAAE8C,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IAC5EmB,SAAS,EAAE;MAAE7B,OAAO,EAAEpC,cAAc;MAAE6C,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IAC5EoB,KAAK,EAAE;MAAE9B,OAAO,EAAEnC,WAAW;MAAE4C,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IACrEqB,SAAS,EAAE;MAAE/B,OAAO,EAAElC,cAAc;MAAE2C,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IAC7EsB,GAAG,EAAE;MAAEhC,OAAO,EAAEtC,SAAS;MAAE+C,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IAClEuB,UAAU,EAAE;MAAEjC,OAAO,EAAEvC,gBAAgB;MAAEgD,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IAC/EwB,SAAS,EAAE;MAAElC,OAAO,EAAEhC,eAAe;MAAEyC,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IAE7E;IACAyB,UAAU,EAAE;MAAEnC,OAAO,EAAE7C,eAAe;MAAEsD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAM,CAAC;IACxF0B,SAAS,EAAE;MAAEpC,OAAO,EAAE5C,eAAe;MAAEqD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACtF2B,OAAO,EAAE;MAAErC,OAAO,EAAE3C,aAAa;MAAEoD,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IAC1E4B,SAAS,EAAE;MAAEtC,OAAO,EAAE1C,eAAe;MAAEmD,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAM,CAAC;IACvF6B,QAAQ,EAAE;MAAEvC,OAAO,EAAEjC,aAAa;MAAE0C,OAAO,EAAEd,eAAe;MAAEe,aAAa,EAAE;IAAK,CAAC;IACnF8B,QAAQ,EAAE;MAAExC,OAAO,EAAE1B,aAAa;MAAEmC,OAAO,EAAE,IAAI;MAAEC,aAAa,EAAE;IAAM,CAAC;IAEzE;IACA+B,QAAQ,EAAE;MAAEzC,OAAO,EAAE/B,aAAa;MAAEwC,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAK,CAAC;IAE3E;IACAgC,IAAI,EAAE;MAAE1C,OAAO,EAAE9B,UAAyB;MAAEuC,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE,IAAI;MAAEiC,gBAAgB,EAAE;IAAK,CAAC;IAC3GC,WAAW,EAAE;MAAE5C,OAAO,EAAE7B,gBAAgB;MAAEsC,OAAO,EAAE,OAAO;MAAEC,aAAa,EAAE;IAAM,CAAC;IAElF;IACAmC,UAAU,EAAE;MAAE7C,OAAO,EAAE5B,gBAAgB;MAAEqC,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAK,CAAC;IAE/E;IACAoC,UAAU,EAAE;MAAE9C,OAAO,EAAEzB,gBAAgB;MAAEkC,OAAO,EAAE,MAAM;MAAEC,aAAa,EAAE;IAAM,CAAC;IAEhF;IACAqC,cAAc,EAAE;MAAE/C,OAAO,EAAEH,mBAAmB;MAAEY,OAAO,EAAE,IAAI;MAAEC,aAAa,EAAE;IAAM;EACtF,CAAC;EACDsC,MAAM,CAACC,MAAM,CAACnD,QAAQ,CAAC;EACvB,OAAOA,QAAQ;AACjB;;AAEA;AACA;AACA;;AAEA,OAAO,MAAMoD,eAAuC,GAAG;EACrDnD,SAAS,EAAE,UAAU;EAAEY,eAAe,EAAE,UAAU;EAAEC,SAAS,EAAE,UAAU;EACzEC,QAAQ,EAAE,UAAU;EAAEC,WAAW,EAAE,UAAU;EAAEC,SAAS,EAAE,UAAU;EACpEC,MAAM,EAAE,UAAU;EAAEC,SAAS,EAAE,UAAU;EAAEC,SAAS,EAAE,UAAU;EAChEC,SAAS,EAAE,UAAU;EAAEC,KAAK,EAAE,UAAU;EAAEC,UAAU,EAAE,UAAU;EAChEC,KAAK,EAAE,eAAe;EAAEC,SAAS,EAAE,eAAe;EAClDC,MAAM,EAAE,YAAY;EAAEC,WAAW,EAAE,YAAY;EAAEC,SAAS,EAAE,YAAY;EACxEU,SAAS,EAAE,YAAY;EACvBT,KAAK,EAAE,OAAO;EAAEC,SAAS,EAAE,OAAO;EAAEG,SAAS,EAAE,OAAO;EAAEF,SAAS,EAAE,OAAO;EAAEC,KAAK,EAAE,OAAO;EAC1FE,GAAG,EAAE,IAAI;EAAEC,UAAU,EAAE,IAAI;EAAEC,SAAS,EAAE,OAAO;EAC/CC,UAAU,EAAE,UAAU;EAAEE,OAAO,EAAE,UAAU;EAAEC,SAAS,EAAE,UAAU;EAClEC,QAAQ,EAAE,UAAU;EAAEC,QAAQ,EAAE,UAAU;EAC1CE,IAAI,EAAE,UAAU;EAAEE,WAAW,EAAE,UAAU;EACzCH,QAAQ,EAAE,aAAa;EACvBI,UAAU,EAAE;AACd,CAAC","ignoreList":[]}

package/dist/server/tool-router-user-tools.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Tool Router — user tool loading, caching, and execution (RPC, HTTP, SQL).
+ */
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type ToolDef, type UserToolRow, type AgentConfig } from "./tool-router-types.js";
+export declare function loadUserTools(supabase: SupabaseClient, storeId: string): Promise<{
+    rows: UserToolRow[];
+    defs: ToolDef[];
+}>;
+export declare function getUserToolByPrefixedName(rows: UserToolRow[], prefixedName: string): UserToolRow | undefined;
+export declare function getToolsForAgent(agent: AgentConfig, coreTools: ToolDef[], userToolDefs?: ToolDef[]): ToolDef[];
+export declare function executeUserTool(supabase: SupabaseClient, userTool: UserToolRow, args: Record<string, unknown>, storeId: string, agentId?: string, conversationId?: string): Promise<{
+    success: boolean;
+    data?: unknown;
+    error?: string;
+}>;

package/dist/server/tool-router-user-tools.js

@@ -0,0 +1,269 @@
+/**
+ * Tool Router — user tool loading, caching, and execution (RPC, HTTP, SQL).
+ */
+
+import { sanitizeError } from "../shared/agent-core.js";
+import { sanitizeToolDescription } from "./lib/prompt-sanitizer.js";
+import { validateUrl } from "./lib/ssrf-guard.js";
+import { buildTraceparent, generateTraceId, generateSpanId } from "./server-trace.js";
+
+// ============================================================================
+// USER TOOL CACHE
+// ============================================================================
+
+const userToolCache = new Map();
+const USER_TOOL_CACHE_MAX = 100;
+function evictUserToolCache() {
+  if (userToolCache.size <= USER_TOOL_CACHE_MAX) return;
+  const entries = [...userToolCache.entries()].sort((a, b) => a[1].lastAccessed - b[1].lastAccessed);
+  const excess = userToolCache.size - USER_TOOL_CACHE_MAX;
+  for (let i = 0; i < excess; i++) {
+    userToolCache.delete(entries[i][0]);
+  }
+}
+export async function loadUserTools(supabase, storeId) {
+  const cached = userToolCache.get(storeId);
+  if (cached && Date.now() - cached.time < 60_000) {
+    cached.lastAccessed = Date.now();
+    return {
+      rows: cached.tools,
+      defs: cached.defs
+    };
+  }
+  const {
+    data,
+    error
+  } = await supabase.from("user_tools").select("id, name, display_name, description, input_schema, execution_type, is_read_only, requires_approval, http_config, rpc_function, sql_template, allowed_tables, max_execution_time_ms").eq("store_id", storeId).eq("is_active", true);
+  if (error || !data?.length) return {
+    rows: [],
+    defs: []
+  };
+  const rows = data;
+  const defs = rows.map(t => ({
+    name: `user_tool__${t.name}`,
+    description: sanitizeToolDescription(`[Custom Tool] ${t.display_name}: ${t.description}${t.requires_approval ? " (requires approval)" : ""}`),
+    input_schema: t.input_schema || {
+      type: "object",
+      properties: {}
+    }
+  }));
+  userToolCache.set(storeId, {
+    tools: rows,
+    defs,
+    time: Date.now(),
+    lastAccessed: Date.now()
+  });
+  evictUserToolCache();
+  return {
+    rows,
+    defs
+  };
+}
+export function getUserToolByPrefixedName(rows, prefixedName) {
+  const toolName = prefixedName.replace(/^user_tool__/, "");
+  return rows.find(t => t.name === toolName);
+}
+export function getToolsForAgent(agent, coreTools, userToolDefs = []) {
+  if (agent.enabled_tools?.length > 0) {
+    const filteredUserTools = userToolDefs.filter(t => agent.enabled_tools.includes(t.name));
+    return [...coreTools, ...filteredUserTools];
+  }
+  return [...coreTools, ...userToolDefs];
+}
+
+// ============================================================================
+// USER TOOL EXECUTORS
+// ============================================================================
+
+export async function executeUserTool(supabase, userTool, args, storeId, agentId, conversationId) {
+  const timeout = userTool.max_execution_time_ms || 5000;
+  if (userTool.execution_type === "http") {
+    return executeHTTPUserTool(supabase, userTool, args, storeId, timeout, conversationId);
+  }
+  try {
+    const {
+      data,
+      error
+    } = await supabase.rpc("execute_user_tool", {
+      p_tool_id: userTool.id,
+      p_store_id: storeId,
+      p_args: args,
+      p_agent_id: agentId || null,
+      p_conversation_id: conversationId || null
+    });
+    if (error) return {
+      success: false,
+      error: error.message
+    };
+    const result = data;
+    if (result.pending_approval) {
+      return {
+        success: false,
+        error: `Tool requires approval. Execution ID: ${result.execution_id}. ${result.message}`
+      };
+    }
+    if (result.success && result.data && result.data.execute_sql) {
+      return executeSQLUserTool(supabase, result.data, args, storeId);
+    }
+    return result.success ? {
+      success: true,
+      data: result.data
+    } : {
+      success: false,
+      error: result.error || "Unknown error"
+    };
+  } catch (err) {
+    return {
+      success: false,
+      error: sanitizeError(err)
+    };
+  }
+}
+async function executeHTTPUserTool(supabase, userTool, args, storeId, timeout, _conversationId) {
+  const config = userTool.http_config;
+  if (!config || !config.url) {
+    return {
+      success: false,
+      error: "HTTP tool has no URL configured"
+    };
+  }
+  const httpCfg = config;
+  let url = httpCfg.url;
+  let headers = {
+    ...(httpCfg.headers || {})
+  };
+
+  // Resolve secrets
+  const configStr = JSON.stringify({
+    url: httpCfg.url,
+    headers: httpCfg.headers,
+    body: httpCfg.body_template
+  });
+  const secretRefs = [...configStr.matchAll(/\{\{secret:(\w+)\}\}/g)].map(m => m[1]);
+  const secretMap = new Map();
+  await Promise.all([...new Set(secretRefs)].map(async name => {
+    try {
+      const {
+        data
+      } = await supabase.rpc("decrypt_secret", {
+        p_name: name,
+        p_store_id: storeId
+      });
+      if (data) secretMap.set(name, data);
+    } catch {/* secret not found */}
+  }));
+  const resolveSecrets = text => text.replace(/\{\{secret:(\w+)\}\}/g, (_, name) => secretMap.get(name) || `{{secret:${name}}}`);
+  const resolveArgs = text => text.replace(/\{\{(\w+)\}\}/g, (_, name) => {
+    if (name === "secret") return `{{${name}}}`;
+    const val = args[name];
+    return val !== undefined ? String(val) : `{{${name}}}`;
+  });
+  const resolve = text => resolveSecrets(resolveArgs(text));
+  url = resolve(url);
+  for (const [key, val] of Object.entries(headers)) {
+    headers[key] = resolve(val);
+  }
+  let body;
+  const method = (httpCfg.method || "GET").toUpperCase();
+  if (method !== "GET" && method !== "HEAD") {
+    if (httpCfg.body_template) {
+      const resolvedBody = {};
+      for (const [key, val] of Object.entries(httpCfg.body_template)) {
+        resolvedBody[key] = typeof val === "string" ? resolve(val) : val;
+      }
+      for (const [key, val] of Object.entries(args)) {
+        if (!(key in resolvedBody)) resolvedBody[key] = val;
+      }
+      body = JSON.stringify(resolvedBody);
+    } else {
+      body = JSON.stringify(args);
+    }
+    if (!headers["Content-Type"] && !headers["content-type"]) headers["Content-Type"] = "application/json";
+  }
+  const ssrfError = await validateUrl(url);
+  if (ssrfError) return {
+    success: false,
+    error: `Blocked: ${ssrfError}`
+  };
+
+  // Inject W3C traceparent for distributed tracing through user tool HTTP calls
+  if (!headers["traceparent"]) {
+    const traceId = generateTraceId();
+    const spanId = generateSpanId();
+    headers["traceparent"] = buildTraceparent(traceId, spanId);
+  }
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    const resp = await fetch(url, {
+      method,
+      headers,
+      body,
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    secretMap.clear();
+    const contentType = resp.headers.get("content-type") || "";
+    let data;
+    if (contentType.includes("json")) data = await resp.json();else data = await resp.text();
+    if (!resp.ok) {
+      return {
+        success: false,
+        error: `HTTP ${resp.status}: ${typeof data === "string" ? data.substring(0, 500) : JSON.stringify(data).substring(0, 500)}`
+      };
+    }
+    return {
+      success: true,
+      data
+    };
+  } catch (err) {
+    secretMap.clear();
+    if (err.name === "AbortError") return {
+      success: false,
+      error: `HTTP request timed out after ${timeout}ms`
+    };
+    return {
+      success: false,
+      error: sanitizeError(err)
+    };
+  }
+}
+async function executeSQLUserTool(supabase, sqlConfig, args, storeId) {
+  if (!sqlConfig.is_read_only) return {
+    success: false,
+    error: "Write SQL tools are not supported in server execution"
+  };
+  if (!sqlConfig.template) return {
+    success: false,
+    error: "No SQL template configured"
+  };
+  try {
+    const {
+      data,
+      error
+    } = await supabase.rpc("execute_safe_sql", {
+      p_sql: sqlConfig.template,
+      p_params: args,
+      p_store_id: storeId,
+      p_allowed_tables: sqlConfig.allowed_tables || []
+    });
+    if (error) return {
+      success: false,
+      error: error.message
+    };
+    if (data?.success) return {
+      success: true,
+      data: data.data
+    };
+    return {
+      success: false,
+      error: data?.error || "SQL execution failed"
+    };
+  } catch (err) {
+    return {
+      success: false,
+      error: sanitizeError(err)
+    };
+  }
+}
+//# sourceMappingURL=tool-router-user-tools.js.map

package/dist/server/tool-router-user-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-router-user-tools.js","names":["sanitizeError","sanitizeToolDescription","validateUrl","buildTraceparent","generateTraceId","generateSpanId","userToolCache","Map","USER_TOOL_CACHE_MAX","evictUserToolCache","size","entries","sort","a","b","lastAccessed","excess","i","delete","loadUserTools","supabase","storeId","cached","get","Date","now","time","rows","tools","defs","data","error","from","select","eq","length","map","t","name","description","display_name","requires_approval","input_schema","type","properties","set","getUserToolByPrefixedName","prefixedName","toolName","replace","find","getToolsForAgent","agent","coreTools","userToolDefs","enabled_tools","filteredUserTools","filter","includes","executeUserTool","userTool","args","agentId","conversationId","timeout","max_execution_time_ms","execution_type","executeHTTPUserTool","rpc","p_tool_id","id","p_store_id","p_args","p_agent_id","p_conversation_id","success","message","result","pending_approval","execution_id","execute_sql","executeSQLUserTool","err","_conversationId","config","http_config","url","httpCfg","headers","configStr","JSON","stringify","body","body_template","secretRefs","matchAll","m","secretMap","Promise","all","Set","p_name","resolveSecrets","text","_","resolveArgs","val","undefined","String","resolve","key","Object","method","toUpperCase","resolvedBody","ssrfError","traceId","spanId","controller","AbortController","timer","setTimeout","abort","resp","fetch","signal","clearTimeout","clear","contentType","json","ok","status","substring","sqlConfig","is_read_only","template","p_sql","p_params","p_allowed_tables","allowed_tables"],"sources":["../../src/server/tool-router-user-tools.ts"],"sourcesContent":["/**\n * Tool Router — user tool loading, caching, and execution (RPC, HTTP, SQL).\n */\n\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport { sanitizeError } from \"../shared/agent-core.js\";\nimport { sanitizeToolDescription } from \"./lib/prompt-sanitizer.js\";\nimport { validateUrl } from \"./lib/ssrf-guard.js\";\nimport { type ToolDef, type UserToolRow, type AgentConfig } from \"./tool-router-types.js\";\nimport { buildTraceparent, generateTraceId, generateSpanId } from \"./server-trace.js\";\n\n// ============================================================================\n// USER TOOL CACHE\n// ============================================================================\n\nconst userToolCache = new Map<string, { tools: UserToolRow[]; defs: ToolDef[]; time: number; lastAccessed: number }>();\nconst USER_TOOL_CACHE_MAX = 100;\n\nfunction evictUserToolCache(): void {\n  if (userToolCache.size <= USER_TOOL_CACHE_MAX) return;\n  const entries = [...userToolCache.entries()].sort((a, b) => a[1].lastAccessed - b[1].lastAccessed);\n  const excess = userToolCache.size - USER_TOOL_CACHE_MAX;\n  for (let i = 0; i < excess; i++) {\n    userToolCache.delete(entries[i][0]);\n  }\n}\n\nexport async function loadUserTools(supabase: SupabaseClient, storeId: string): Promise<{ rows: UserToolRow[]; defs: ToolDef[] }> {\n  const cached = userToolCache.get(storeId);\n  if (cached && Date.now() - cached.time < 60_000) {\n    cached.lastAccessed = Date.now();\n    return { rows: cached.tools, defs: cached.defs };\n  }\n\n  const { data, error } = await supabase\n    .from(\"user_tools\")\n    .select(\"id, name, display_name, description, input_schema, execution_type, is_read_only, requires_approval, http_config, rpc_function, sql_template, allowed_tables, max_execution_time_ms\")\n    .eq(\"store_id\", storeId)\n    .eq(\"is_active\", true);\n\n  if (error || !data?.length) return { rows: [], defs: [] };\n\n  const rows: UserToolRow[] = data as UserToolRow[];\n  const defs: ToolDef[] = rows.map((t) => ({\n    name: `user_tool__${t.name}`,\n    description: sanitizeToolDescription(\n      `[Custom Tool] ${t.display_name}: ${t.description}${t.requires_approval ? \" (requires approval)\" : \"\"}`,\n    ),\n    input_schema: t.input_schema || { type: \"object\", properties: {} },\n  }));\n\n  userToolCache.set(storeId, { tools: rows, defs, time: Date.now(), lastAccessed: Date.now() });\n  evictUserToolCache();\n  return { rows, defs };\n}\n\nexport function getUserToolByPrefixedName(rows: UserToolRow[], prefixedName: string): UserToolRow | undefined {\n  const toolName = prefixedName.replace(/^user_tool__/, \"\");\n  return rows.find((t) => t.name === toolName);\n}\n\nexport function getToolsForAgent(agent: AgentConfig, coreTools: ToolDef[], userToolDefs: ToolDef[] = []): ToolDef[] {\n  if (agent.enabled_tools?.length > 0) {\n    const filteredUserTools = userToolDefs.filter((t) => agent.enabled_tools.includes(t.name));\n    return [...coreTools, ...filteredUserTools];\n  }\n  return [...coreTools, ...userToolDefs];\n}\n\n// ============================================================================\n// USER TOOL EXECUTORS\n// ============================================================================\n\nexport async function executeUserTool(\n  supabase: SupabaseClient,\n  userTool: UserToolRow,\n  args: Record<string, unknown>,\n  storeId: string,\n  agentId?: string,\n  conversationId?: string,\n): Promise<{ success: boolean; data?: unknown; error?: string }> {\n  const timeout = userTool.max_execution_time_ms || 5000;\n\n  if (userTool.execution_type === \"http\") {\n    return executeHTTPUserTool(supabase, userTool, args, storeId, timeout, conversationId);\n  }\n\n  try {\n    const { data, error } = await supabase.rpc(\"execute_user_tool\", {\n      p_tool_id: userTool.id, p_store_id: storeId, p_args: args,\n      p_agent_id: agentId || null, p_conversation_id: conversationId || null,\n    });\n\n    if (error) return { success: false, error: error.message };\n\n    const result = data as { success: boolean; data?: unknown; error?: string; pending_approval?: boolean; execution_id?: string; message?: string };\n\n    if (result.pending_approval) {\n      return { success: false, error: `Tool requires approval. Execution ID: ${result.execution_id}. ${result.message}` };\n    }\n\n    if (result.success && result.data && (result.data as any).execute_sql) {\n      return executeSQLUserTool(supabase, result.data as any, args, storeId);\n    }\n\n    return result.success ? { success: true, data: result.data } : { success: false, error: result.error || \"Unknown error\" };\n  } catch (err) {\n    return { success: false, error: sanitizeError(err) };\n  }\n}\n\nasync function executeHTTPUserTool(\n  supabase: SupabaseClient,\n  userTool: UserToolRow,\n  args: Record<string, unknown>,\n  storeId: string,\n  timeout: number,\n  _conversationId?: string,\n): Promise<{ success: boolean; data?: unknown; error?: string }> {\n  const config = userTool.http_config;\n  if (!config || !(config as any).url) {\n    return { success: false, error: \"HTTP tool has no URL configured\" };\n  }\n\n  const httpCfg = config as { url: string; method?: string; headers?: Record<string, string>; body_template?: Record<string, unknown> };\n\n  let url = httpCfg.url;\n  let headers: Record<string, string> = { ...(httpCfg.headers || {}) };\n\n  // Resolve secrets\n  const configStr = JSON.stringify({ url: httpCfg.url, headers: httpCfg.headers, body: httpCfg.body_template });\n  const secretRefs = [...configStr.matchAll(/\\{\\{secret:(\\w+)\\}\\}/g)].map(m => m[1]);\n\n  const secretMap = new Map<string, string>();\n  await Promise.all(\n    [...new Set(secretRefs)].map(async (name) => {\n      try {\n        const { data } = await supabase.rpc(\"decrypt_secret\", { p_name: name, p_store_id: storeId });\n        if (data) secretMap.set(name, data as string);\n      } catch { /* secret not found */ }\n    }),\n  );\n\n  const resolveSecrets = (text: string): string => text.replace(/\\{\\{secret:(\\w+)\\}\\}/g, (_, name) => secretMap.get(name) || `{{secret:${name}}}`);\n  const resolveArgs = (text: string): string => text.replace(/\\{\\{(\\w+)\\}\\}/g, (_, name) => { if (name === \"secret\") return `{{${name}}}`; const val = args[name]; return val !== undefined ? String(val) : `{{${name}}}`; });\n  const resolve = (text: string): string => resolveSecrets(resolveArgs(text));\n\n  url = resolve(url);\n  for (const [key, val] of Object.entries(headers)) { headers[key] = resolve(val); }\n\n  let body: string | undefined;\n  const method = (httpCfg.method || \"GET\").toUpperCase();\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    if (httpCfg.body_template) {\n      const resolvedBody: Record<string, unknown> = {};\n      for (const [key, val] of Object.entries(httpCfg.body_template)) {\n        resolvedBody[key] = typeof val === \"string\" ? resolve(val) : val;\n      }\n      for (const [key, val] of Object.entries(args)) { if (!(key in resolvedBody)) resolvedBody[key] = val; }\n      body = JSON.stringify(resolvedBody);\n    } else {\n      body = JSON.stringify(args);\n    }\n    if (!headers[\"Content-Type\"] && !headers[\"content-type\"]) headers[\"Content-Type\"] = \"application/json\";\n  }\n\n  const ssrfError = await validateUrl(url);\n  if (ssrfError) return { success: false, error: `Blocked: ${ssrfError}` };\n\n  // Inject W3C traceparent for distributed tracing through user tool HTTP calls\n  if (!headers[\"traceparent\"]) {\n    const traceId = generateTraceId();\n    const spanId = generateSpanId();\n    headers[\"traceparent\"] = buildTraceparent(traceId, spanId);\n  }\n\n  try {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n    const resp = await fetch(url, { method, headers, body, signal: controller.signal });\n    clearTimeout(timer);\n    secretMap.clear();\n\n    const contentType = resp.headers.get(\"content-type\") || \"\";\n    let data: unknown;\n    if (contentType.includes(\"json\")) data = await resp.json(); else data = await resp.text();\n\n    if (!resp.ok) {\n      return { success: false, error: `HTTP ${resp.status}: ${typeof data === \"string\" ? data.substring(0, 500) : JSON.stringify(data).substring(0, 500)}` };\n    }\n    return { success: true, data };\n  } catch (err: any) {\n    secretMap.clear();\n    if (err.name === \"AbortError\") return { success: false, error: `HTTP request timed out after ${timeout}ms` };\n    return { success: false, error: sanitizeError(err) };\n  }\n}\n\nasync function executeSQLUserTool(\n  supabase: SupabaseClient,\n  sqlConfig: { template: string; allowed_tables: string[]; is_read_only: boolean },\n  args: Record<string, unknown>,\n  storeId: string,\n): Promise<{ success: boolean; data?: unknown; error?: string }> {\n  if (!sqlConfig.is_read_only) return { success: false, error: \"Write SQL tools are not supported in server execution\" };\n  if (!sqlConfig.template) return { success: false, error: \"No SQL template configured\" };\n\n  try {\n    const { data, error } = await supabase.rpc(\"execute_safe_sql\", {\n      p_sql: sqlConfig.template, p_params: args, p_store_id: storeId, p_allowed_tables: sqlConfig.allowed_tables || [],\n    });\n    if (error) return { success: false, error: error.message };\n    if (data?.success) return { success: true, data: data.data };\n    return { success: false, error: data?.error || \"SQL execution failed\" };\n  } catch (err) {\n    return { success: false, error: sanitizeError(err) };\n  }\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,aAAa,QAAQ,yBAAyB;AACvD,SAASC,uBAAuB,QAAQ,2BAA2B;AACnE,SAASC,WAAW,QAAQ,qBAAqB;AAEjD,SAASC,gBAAgB,EAAEC,eAAe,EAAEC,cAAc,QAAQ,mBAAmB;;AAErF;AACA;AACA;;AAEA,MAAMC,aAAa,GAAG,IAAIC,GAAG,CAAwF,CAAC;AACtH,MAAMC,mBAAmB,GAAG,GAAG;AAE/B,SAASC,kBAAkBA,CAAA,EAAS;EAClC,IAAIH,aAAa,CAACI,IAAI,IAAIF,mBAAmB,EAAE;EAC/C,MAAMG,OAAO,GAAG,CAAC,GAAGL,aAAa,CAACK,OAAO,CAAC,CAAC,CAAC,CAACC,IAAI,CAAC,CAACC,CAAC,EAAEC,CAAC,KAAKD,CAAC,CAAC,CAAC,CAAC,CAACE,YAAY,GAAGD,CAAC,CAAC,CAAC,CAAC,CAACC,YAAY,CAAC;EAClG,MAAMC,MAAM,GAAGV,aAAa,CAACI,IAAI,GAAGF,mBAAmB;EACvD,KAAK,IAAIS,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGD,MAAM,EAAEC,CAAC,EAAE,EAAE;IAC/BX,aAAa,CAACY,MAAM,CAACP,OAAO,CAACM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;EACrC;AACF;AAEA,OAAO,eAAeE,aAAaA,CAACC,QAAwB,EAAEC,OAAe,EAAqD;EAChI,MAAMC,MAAM,GAAGhB,aAAa,CAACiB,GAAG,CAACF,OAAO,CAAC;EACzC,IAAIC,MAAM,IAAIE,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGH,MAAM,CAACI,IAAI,GAAG,MAAM,EAAE;IAC/CJ,MAAM,CAACP,YAAY,GAAGS,IAAI,CAACC,GAAG,CAAC,CAAC;IAChC,OAAO;MAAEE,IAAI,EAAEL,MAAM,CAACM,KAAK;MAAEC,IAAI,EAAEP,MAAM,CAACO;IAAK,CAAC;EAClD;EAEA,MAAM;IAAEC,IAAI;IAAEC;EAAM,CAAC,GAAG,MAAMX,QAAQ,CACnCY,IAAI,CAAC,YAAY,CAAC,CAClBC,MAAM,CAAC,oLAAoL,CAAC,CAC5LC,EAAE,CAAC,UAAU,EAAEb,OAAO,CAAC,CACvBa,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;EAExB,IAAIH,KAAK,IAAI,CAACD,IAAI,EAAEK,MAAM,EAAE,OAAO;IAAER,IAAI,EAAE,EAAE;IAAEE,IAAI,EAAE;EAAG,CAAC;EAEzD,MAAMF,IAAmB,GAAGG,IAAqB;EACjD,MAAMD,IAAe,GAAGF,IAAI,CAACS,GAAG,CAAEC,CAAC,KAAM;IACvCC,IAAI,EAAE,cAAcD,CAAC,CAACC,IAAI,EAAE;IAC5BC,WAAW,EAAEtC,uBAAuB,CAClC,iBAAiBoC,CAAC,CAACG,YAAY,KAAKH,CAAC,CAACE,WAAW,GAAGF,CAAC,CAACI,iBAAiB,GAAG,sBAAsB,GAAG,EAAE,EACvG,CAAC;IACDC,YAAY,EAAEL,CAAC,CAACK,YAAY,IAAI;MAAEC,IAAI,EAAE,QAAQ;MAAEC,UAAU,EAAE,CAAC;IAAE;EACnE,CAAC,CAAC,CAAC;EAEHtC,aAAa,CAACuC,GAAG,CAACxB,OAAO,EAAE;IAAEO,KAAK,EAAED,IAAI;IAAEE,IAAI;IAAEH,IAAI,EAAEF,IAAI,CAACC,GAAG,CAAC,CAAC;IAAEV,YAAY,EAAES,IAAI,CAACC,GAAG,CAAC;EAAE,CAAC,CAAC;EAC7FhB,kBAAkB,CAAC,CAAC;EACpB,OAAO;IAAEkB,IAAI;IAAEE;EAAK,CAAC;AACvB;AAEA,OAAO,SAASiB,yBAAyBA,CAACnB,IAAmB,EAAEoB,YAAoB,EAA2B;EAC5G,MAAMC,QAAQ,GAAGD,YAAY,CAACE,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;EACzD,OAAOtB,IAAI,CAACuB,IAAI,CAAEb,CAAC,IAAKA,CAAC,CAACC,IAAI,KAAKU,QAAQ,CAAC;AAC9C;AAEA,OAAO,SAASG,gBAAgBA,CAACC,KAAkB,EAAEC,SAAoB,EAAEC,YAAuB,GAAG,EAAE,EAAa;EAClH,IAAIF,KAAK,CAACG,aAAa,EAAEpB,MAAM,GAAG,CAAC,EAAE;IACnC,MAAMqB,iBAAiB,GAAGF,YAAY,CAACG,MAAM,CAAEpB,CAAC,IAAKe,KAAK,CAACG,aAAa,CAACG,QAAQ,CAACrB,CAAC,CAACC,IAAI,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAGe,SAAS,EAAE,GAAGG,iBAAiB,CAAC;EAC7C;EACA,OAAO,CAAC,GAAGH,SAAS,EAAE,GAAGC,YAAY,CAAC;AACxC;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeK,eAAeA,CACnCvC,QAAwB,EACxBwC,QAAqB,EACrBC,IAA6B,EAC7BxC,OAAe,EACfyC,OAAgB,EAChBC,cAAuB,EACwC;EAC/D,MAAMC,OAAO,GAAGJ,QAAQ,CAACK,qBAAqB,IAAI,IAAI;EAEtD,IAAIL,QAAQ,CAACM,cAAc,KAAK,MAAM,EAAE;IACtC,OAAOC,mBAAmB,CAAC/C,QAAQ,EAAEwC,QAAQ,EAAEC,IAAI,EAAExC,OAAO,EAAE2C,OAAO,EAAED,cAAc,CAAC;EACxF;EAEA,IAAI;IACF,MAAM;MAAEjC,IAAI;MAAEC;IAAM,CAAC,GAAG,MAAMX,QAAQ,CAACgD,GAAG,CAAC,mBAAmB,EAAE;MAC9DC,SAAS,EAAET,QAAQ,CAACU,EAAE;MAAEC,UAAU,EAAElD,OAAO;MAAEmD,MAAM,EAAEX,IAAI;MACzDY,UAAU,EAAEX,OAAO,IAAI,IAAI;MAAEY,iBAAiB,EAAEX,cAAc,IAAI;IACpE,CAAC,CAAC;IAEF,IAAIhC,KAAK,EAAE,OAAO;MAAE4C,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAEA,KAAK,CAAC6C;IAAQ,CAAC;IAE1D,MAAMC,MAAM,GAAG/C,IAAiI;IAEhJ,IAAI+C,MAAM,CAACC,gBAAgB,EAAE;MAC3B,OAAO;QAAEH,OAAO,EAAE,KAAK;QAAE5C,KAAK,EAAE,yCAAyC8C,MAAM,CAACE,YAAY,KAAKF,MAAM,CAACD,OAAO;MAAG,CAAC;IACrH;IAEA,IAAIC,MAAM,CAACF,OAAO,IAAIE,MAAM,CAAC/C,IAAI,IAAK+C,MAAM,CAAC/C,IAAI,CAASkD,WAAW,EAAE;MACrE,OAAOC,kBAAkB,CAAC7D,QAAQ,EAAEyD,MAAM,CAAC/C,IAAI,EAAS+B,IAAI,EAAExC,OAAO,CAAC;IACxE;IAEA,OAAOwD,MAAM,CAACF,OAAO,GAAG;MAAEA,OAAO,EAAE,IAAI;MAAE7C,IAAI,EAAE+C,MAAM,CAAC/C;IAAK,CAAC,GAAG;MAAE6C,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE8C,MAAM,CAAC9C,KAAK,IAAI;IAAgB,CAAC;EAC3H,CAAC,CAAC,OAAOmD,GAAG,EAAE;IACZ,OAAO;MAAEP,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE/B,aAAa,CAACkF,GAAG;IAAE,CAAC;EACtD;AACF;AAEA,eAAef,mBAAmBA,CAChC/C,QAAwB,EACxBwC,QAAqB,EACrBC,IAA6B,EAC7BxC,OAAe,EACf2C,OAAe,EACfmB,eAAwB,EACuC;EAC/D,MAAMC,MAAM,GAAGxB,QAAQ,CAACyB,WAAW;EACnC,IAAI,CAACD,MAAM,IAAI,CAAEA,MAAM,CAASE,GAAG,EAAE;IACnC,OAAO;MAAEX,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE;IAAkC,CAAC;EACrE;EAEA,MAAMwD,OAAO,GAAGH,MAAqH;EAErI,IAAIE,GAAG,GAAGC,OAAO,CAACD,GAAG;EACrB,IAAIE,OAA+B,GAAG;IAAE,IAAID,OAAO,CAACC,OAAO,IAAI,CAAC,CAAC;EAAE,CAAC;;EAEpE;EACA,MAAMC,SAAS,GAAGC,IAAI,CAACC,SAAS,CAAC;IAAEL,GAAG,EAAEC,OAAO,CAACD,GAAG;IAAEE,OAAO,EAAED,OAAO,CAACC,OAAO;IAAEI,IAAI,EAAEL,OAAO,CAACM;EAAc,CAAC,CAAC;EAC7G,MAAMC,UAAU,GAAG,CAAC,GAAGL,SAAS,CAACM,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC3D,GAAG,CAAC4D,CAAC,IAAIA,CAAC,CAAC,CAAC,CAAC,CAAC;EAElF,MAAMC,SAAS,GAAG,IAAI1F,GAAG,CAAiB,CAAC;EAC3C,MAAM2F,OAAO,CAACC,GAAG,CACf,CAAC,GAAG,IAAIC,GAAG,CAACN,UAAU,CAAC,CAAC,CAAC1D,GAAG,CAAC,MAAOE,IAAI,IAAK;IAC3C,IAAI;MACF,MAAM;QAAER;MAAK,CAAC,GAAG,MAAMV,QAAQ,CAACgD,GAAG,CAAC,gBAAgB,EAAE;QAAEiC,MAAM,EAAE/D,IAAI;QAAEiC,UAAU,EAAElD;MAAQ,CAAC,CAAC;MAC5F,IAAIS,IAAI,EAAEmE,SAAS,CAACpD,GAAG,CAACP,IAAI,EAAER,IAAc,CAAC;IAC/C,CAAC,CAAC,MAAM,CAAE;EACZ,CAAC,CACH,CAAC;EAED,MAAMwE,cAAc,GAAIC,IAAY,IAAaA,IAAI,CAACtD,OAAO,CAAC,uBAAuB,EAAE,CAACuD,CAAC,EAAElE,IAAI,KAAK2D,SAAS,CAAC1E,GAAG,CAACe,IAAI,CAAC,IAAI,YAAYA,IAAI,IAAI,CAAC;EAChJ,MAAMmE,WAAW,GAAIF,IAAY,IAAaA,IAAI,CAACtD,OAAO,CAAC,gBAAgB,EAAE,CAACuD,CAAC,EAAElE,IAAI,KAAK;IAAE,IAAIA,IAAI,KAAK,QAAQ,EAAE,OAAO,KAAKA,IAAI,IAAI;IAAE,MAAMoE,GAAG,GAAG7C,IAAI,CAACvB,IAAI,CAAC;IAAE,OAAOoE,GAAG,KAAKC,SAAS,GAAGC,MAAM,CAACF,GAAG,CAAC,GAAG,KAAKpE,IAAI,IAAI;EAAE,CAAC,CAAC;EAC3N,MAAMuE,OAAO,GAAIN,IAAY,IAAaD,cAAc,CAACG,WAAW,CAACF,IAAI,CAAC,CAAC;EAE3EjB,GAAG,GAAGuB,OAAO,CAACvB,GAAG,CAAC;EAClB,KAAK,MAAM,CAACwB,GAAG,EAAEJ,GAAG,CAAC,IAAIK,MAAM,CAACpG,OAAO,CAAC6E,OAAO,CAAC,EAAE;IAAEA,OAAO,CAACsB,GAAG,CAAC,GAAGD,OAAO,CAACH,GAAG,CAAC;EAAE;EAEjF,IAAId,IAAwB;EAC5B,MAAMoB,MAAM,GAAG,CAACzB,OAAO,CAACyB,MAAM,IAAI,KAAK,EAAEC,WAAW,CAAC,CAAC;EACtD,IAAID,MAAM,KAAK,KAAK,IAAIA,MAAM,KAAK,MAAM,EAAE;IACzC,IAAIzB,OAAO,CAACM,aAAa,EAAE;MACzB,MAAMqB,YAAqC,GAAG,CAAC,CAAC;MAChD,KAAK,MAAM,CAACJ,GAAG,EAAEJ,GAAG,CAAC,IAAIK,MAAM,CAACpG,OAAO,CAAC4E,OAAO,CAACM,aAAa,CAAC,EAAE;QAC9DqB,YAAY,CAACJ,GAAG,CAAC,GAAG,OAAOJ,GAAG,KAAK,QAAQ,GAAGG,OAAO,CAACH,GAAG,CAAC,GAAGA,GAAG;MAClE;MACA,KAAK,MAAM,CAACI,GAAG,EAAEJ,GAAG,CAAC,IAAIK,MAAM,CAACpG,OAAO,CAACkD,IAAI,CAAC,EAAE;QAAE,IAAI,EAAEiD,GAAG,IAAII,YAAY,CAAC,EAAEA,YAAY,CAACJ,GAAG,CAAC,GAAGJ,GAAG;MAAE;MACtGd,IAAI,GAAGF,IAAI,CAACC,SAAS,CAACuB,YAAY,CAAC;IACrC,CAAC,MAAM;MACLtB,IAAI,GAAGF,IAAI,CAACC,SAAS,CAAC9B,IAAI,CAAC;IAC7B;IACA,IAAI,CAAC2B,OAAO,CAAC,cAAc,CAAC,IAAI,CAACA,OAAO,CAAC,cAAc,CAAC,EAAEA,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB;EACxG;EAEA,MAAM2B,SAAS,GAAG,MAAMjH,WAAW,CAACoF,GAAG,CAAC;EACxC,IAAI6B,SAAS,EAAE,OAAO;IAAExC,OAAO,EAAE,KAAK;IAAE5C,KAAK,EAAE,YAAYoF,SAAS;EAAG,CAAC;;EAExE;EACA,IAAI,CAAC3B,OAAO,CAAC,aAAa,CAAC,EAAE;IAC3B,MAAM4B,OAAO,GAAGhH,eAAe,CAAC,CAAC;IACjC,MAAMiH,MAAM,GAAGhH,cAAc,CAAC,CAAC;IAC/BmF,OAAO,CAAC,aAAa,CAAC,GAAGrF,gBAAgB,CAACiH,OAAO,EAAEC,MAAM,CAAC;EAC5D;EAEA,IAAI;IACF,MAAMC,UAAU,GAAG,IAAIC,eAAe,CAAC,CAAC;IACxC,MAAMC,KAAK,GAAGC,UAAU,CAAC,MAAMH,UAAU,CAACI,KAAK,CAAC,CAAC,EAAE1D,OAAO,CAAC;IAC3D,MAAM2D,IAAI,GAAG,MAAMC,KAAK,CAACtC,GAAG,EAAE;MAAE0B,MAAM;MAAExB,OAAO;MAAEI,IAAI;MAAEiC,MAAM,EAAEP,UAAU,CAACO;IAAO,CAAC,CAAC;IACnFC,YAAY,CAACN,KAAK,CAAC;IACnBvB,SAAS,CAAC8B,KAAK,CAAC,CAAC;IAEjB,MAAMC,WAAW,GAAGL,IAAI,CAACnC,OAAO,CAACjE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;IAC1D,IAAIO,IAAa;IACjB,IAAIkG,WAAW,CAACtE,QAAQ,CAAC,MAAM,CAAC,EAAE5B,IAAI,GAAG,MAAM6F,IAAI,CAACM,IAAI,CAAC,CAAC,CAAC,KAAMnG,IAAI,GAAG,MAAM6F,IAAI,CAACpB,IAAI,CAAC,CAAC;IAEzF,IAAI,CAACoB,IAAI,CAACO,EAAE,EAAE;MACZ,OAAO;QAAEvD,OAAO,EAAE,KAAK;QAAE5C,KAAK,EAAE,QAAQ4F,IAAI,CAACQ,MAAM,KAAK,OAAOrG,IAAI,KAAK,QAAQ,GAAGA,IAAI,CAACsG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG1C,IAAI,CAACC,SAAS,CAAC7D,IAAI,CAAC,CAACsG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;MAAG,CAAC;IACxJ;IACA,OAAO;MAAEzD,OAAO,EAAE,IAAI;MAAE7C;IAAK,CAAC;EAChC,CAAC,CAAC,OAAOoD,GAAQ,EAAE;IACjBe,SAAS,CAAC8B,KAAK,CAAC,CAAC;IACjB,IAAI7C,GAAG,CAAC5C,IAAI,KAAK,YAAY,EAAE,OAAO;MAAEqC,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE,gCAAgCiC,OAAO;IAAK,CAAC;IAC5G,OAAO;MAAEW,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE/B,aAAa,CAACkF,GAAG;IAAE,CAAC;EACtD;AACF;AAEA,eAAeD,kBAAkBA,CAC/B7D,QAAwB,EACxBiH,SAAgF,EAChFxE,IAA6B,EAC7BxC,OAAe,EACgD;EAC/D,IAAI,CAACgH,SAAS,CAACC,YAAY,EAAE,OAAO;IAAE3D,OAAO,EAAE,KAAK;IAAE5C,KAAK,EAAE;EAAwD,CAAC;EACtH,IAAI,CAACsG,SAAS,CAACE,QAAQ,EAAE,OAAO;IAAE5D,OAAO,EAAE,KAAK;IAAE5C,KAAK,EAAE;EAA6B,CAAC;EAEvF,IAAI;IACF,MAAM;MAAED,IAAI;MAAEC;IAAM,CAAC,GAAG,MAAMX,QAAQ,CAACgD,GAAG,CAAC,kBAAkB,EAAE;MAC7DoE,KAAK,EAAEH,SAAS,CAACE,QAAQ;MAAEE,QAAQ,EAAE5E,IAAI;MAAEU,UAAU,EAAElD,OAAO;MAAEqH,gBAAgB,EAAEL,SAAS,CAACM,cAAc,IAAI;IAChH,CAAC,CAAC;IACF,IAAI5G,KAAK,EAAE,OAAO;MAAE4C,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAEA,KAAK,CAAC6C;IAAQ,CAAC;IAC1D,IAAI9C,IAAI,EAAE6C,OAAO,EAAE,OAAO;MAAEA,OAAO,EAAE,IAAI;MAAE7C,IAAI,EAAEA,IAAI,CAACA;IAAK,CAAC;IAC5D,OAAO;MAAE6C,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAED,IAAI,EAAEC,KAAK,IAAI;IAAuB,CAAC;EACzE,CAAC,CAAC,OAAOmD,GAAG,EAAE;IACZ,OAAO;MAAEP,OAAO,EAAE,KAAK;MAAE5C,KAAK,EAAE/B,aAAa,CAACkF,GAAG;IAAE,CAAC;EACtD;AACF","ignoreList":[]}

package/dist/server/validation-schemas.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Zod schema definitions for tool input validation.
+ * Split from validation.ts for maintainability.
+ */
+import { z } from "zod";
+export type SchemaMap = Record<string, z.ZodTypeAny>;
+/**
+ * Top-level registry keyed by tool name.
+ * Only tools with mutation actions are listed.
+ * Read-only tools (analytics, orders.find, etc.) are intentionally absent -- passthrough.
+ */
+export declare const toolSchemaRegistry: Record<string, SchemaMap>;

package/dist/server/validation-schemas.js

@@ -0,0 +1,251 @@
+/**
+ * Zod schema definitions for tool input validation.
+ * Split from validation.ts for maintainability.
+ */
+
+import { z } from "zod";
+
+// ============================================================================
+// SHARED PRIMITIVES
+// ============================================================================
+
+const uuid = z.string().uuid();
+const positiveNumber = z.number().positive();
+const nonNegativeNumber = z.number().min(0);
+
+// ============================================================================
+// INVENTORY MUTATIONS
+// ============================================================================
+
+const inventoryAdjustSchema = z.object({
+  action: z.literal("adjust"),
+  product_id: uuid,
+  location_id: uuid,
+  adjustment: z.number(),
+  reason: z.string().optional()
+});
+const inventorySetSchema = z.object({
+  action: z.literal("set"),
+  product_id: uuid,
+  location_id: uuid,
+  quantity: nonNegativeNumber
+});
+const inventoryTransferSchema = z.object({
+  action: z.literal("transfer"),
+  product_id: uuid,
+  from_location_id: uuid,
+  to_location_id: uuid,
+  quantity: positiveNumber
+});
+const inventoryBulkSetSchema = z.object({
+  action: z.literal("bulk_set"),
+  items: z.array(z.object({
+    product_id: uuid,
+    location_id: uuid,
+    quantity: nonNegativeNumber
+  })).min(1)
+});
+const inventoryBulkAdjustSchema = z.object({
+  action: z.literal("bulk_adjust"),
+  items: z.array(z.object({
+    product_id: uuid,
+    location_id: uuid,
+    adjustment: z.number()
+  })).min(1)
+});
+const inventoryBulkClearSchema = z.object({
+  action: z.literal("bulk_clear"),
+  location_id: uuid
+});
+
+// ============================================================================
+// SUPPLY CHAIN -- PURCHASE ORDERS
+// ============================================================================
+
+const poCreateSchema = z.object({
+  action: z.literal("create"),
+  supplier_id: uuid,
+  location_id: uuid,
+  items: z.array(z.object({
+    product_id: uuid,
+    quantity: positiveNumber,
+    unit_price: nonNegativeNumber.optional(),
+    unit_cost: nonNegativeNumber.optional()
+  })).min(1).optional(),
+  notes: z.string().optional(),
+  expected_delivery_date: z.string().optional(),
+  po_type: z.string().optional()
+});
+const poAddItemsSchema = z.object({
+  action: z.literal("add_items"),
+  purchase_order_id: uuid,
+  items: z.array(z.object({
+    product_id: uuid,
+    quantity: positiveNumber,
+    unit_price: nonNegativeNumber.optional(),
+    unit_cost: nonNegativeNumber.optional()
+  })).min(1)
+});
+const poApproveSchema = z.object({
+  action: z.literal("approve"),
+  purchase_order_id: uuid
+});
+const poReceiveSchema = z.object({
+  action: z.literal("receive"),
+  purchase_order_id: uuid
+});
+const poCancelSchema = z.object({
+  action: z.literal("cancel"),
+  purchase_order_id: uuid
+});
+
+// ============================================================================
+// SUPPLY CHAIN -- TRANSFERS
+// ============================================================================
+
+const transferCreateSchema = z.object({
+  action: z.literal("create"),
+  from_location_id: uuid.optional(),
+  source_location_id: uuid.optional(),
+  to_location_id: uuid.optional(),
+  destination_location_id: uuid.optional(),
+  items: z.array(z.object({
+    product_id: uuid,
+    quantity: positiveNumber
+  })).min(1).optional(),
+  notes: z.string().optional()
+}).refine(d => d.from_location_id || d.source_location_id, {
+  message: "from_location_id or source_location_id is required",
+  path: ["from_location_id"]
+}).refine(d => d.to_location_id || d.destination_location_id, {
+  message: "to_location_id or destination_location_id is required",
+  path: ["to_location_id"]
+});
+const transferApproveSchema = z.object({
+  action: z.literal("approve"),
+  transfer_id: uuid
+});
+const transferShipSchema = z.object({
+  action: z.union([z.literal("ship"), z.literal("mark_in_transit")]),
+  transfer_id: uuid
+});
+const transferReceiveSchema = z.object({
+  action: z.union([z.literal("receive"), z.literal("complete")]),
+  transfer_id: uuid
+});
+const transferCancelSchema = z.object({
+  action: z.literal("cancel"),
+  transfer_id: uuid
+});
+
+// ============================================================================
+// CUSTOMERS
+// ============================================================================
+
+const customerCreateSchema = z.object({
+  action: z.literal("create"),
+  first_name: z.string().min(1),
+  last_name: z.string().min(1),
+  email: z.string().email().optional(),
+  phone: z.string().optional(),
+  date_of_birth: z.string().optional(),
+  email_consent: z.boolean().optional(),
+  sms_consent: z.boolean().optional(),
+  street_address: z.string().optional(),
+  city: z.string().optional(),
+  state: z.string().optional(),
+  postal_code: z.string().optional(),
+  drivers_license_number: z.string().optional(),
+  medical_card_number: z.string().optional(),
+  medical_card_expiry: z.string().optional()
+});
+const customerUpdateSchema = z.object({
+  action: z.literal("update"),
+  customer_id: uuid,
+  first_name: z.string().min(1).optional(),
+  last_name: z.string().min(1).optional(),
+  email: z.string().email().optional(),
+  phone: z.string().optional(),
+  date_of_birth: z.string().optional(),
+  status: z.string().optional(),
+  email_consent: z.boolean().optional(),
+  sms_consent: z.boolean().optional(),
+  push_consent: z.boolean().optional(),
+  loyalty_points: z.number().optional(),
+  loyalty_tier: z.string().optional(),
+  street_address: z.string().optional(),
+  city: z.string().optional(),
+  state: z.string().optional(),
+  postal_code: z.string().optional(),
+  drivers_license_number: z.string().optional(),
+  id_verified: z.boolean().optional(),
+  medical_card_number: z.string().optional(),
+  medical_card_expiry: z.string().optional(),
+  is_wholesale_approved: z.boolean().optional(),
+  wholesale_tier: z.string().optional(),
+  wholesale_business_name: z.string().optional(),
+  wholesale_license_number: z.string().optional(),
+  wholesale_tax_id: z.string().optional()
+});
+const customerMergeSchema = z.object({
+  action: z.literal("merge"),
+  primary_customer_id: uuid,
+  secondary_customer_id: uuid
+});
+const productMergeSchema = z.object({
+  action: z.literal("merge"),
+  primary_product_id: uuid,
+  secondary_product_id: uuid
+});
+
+// ============================================================================
+// SCHEMA REGISTRY -- maps (toolName, action) -> Zod schema
+// ============================================================================
+
+const productSchemas = {
+  merge: productMergeSchema
+};
+const inventorySchemas = {
+  adjust: inventoryAdjustSchema,
+  set: inventorySetSchema,
+  transfer: inventoryTransferSchema,
+  bulk_set: inventoryBulkSetSchema,
+  bulk_adjust: inventoryBulkAdjustSchema,
+  bulk_clear: inventoryBulkClearSchema
+};
+const purchaseOrderSchemas = {
+  create: poCreateSchema,
+  add_items: poAddItemsSchema,
+  approve: poApproveSchema,
+  mark_ordered: poApproveSchema,
+  receive: poReceiveSchema,
+  cancel: poCancelSchema
+};
+const transferSchemas = {
+  create: transferCreateSchema,
+  approve: transferApproveSchema,
+  ship: transferShipSchema,
+  mark_in_transit: transferShipSchema,
+  receive: transferReceiveSchema,
+  complete: transferReceiveSchema,
+  cancel: transferCancelSchema
+};
+const customerSchemas = {
+  create: customerCreateSchema,
+  update: customerUpdateSchema,
+  merge: customerMergeSchema
+};
+
+/**
+ * Top-level registry keyed by tool name.
+ * Only tools with mutation actions are listed.
+ * Read-only tools (analytics, orders.find, etc.) are intentionally absent -- passthrough.
+ */
+export const toolSchemaRegistry = {
+  products: productSchemas,
+  inventory: inventorySchemas,
+  purchase_orders: purchaseOrderSchemas,
+  transfers: transferSchemas,
+  customers: customerSchemas
+};
+//# sourceMappingURL=validation-schemas.js.map