5.10 Catalog completeness

[andypalmi]

5.10 Catalog completeness

Parent: Story 5 (#7232)
Tool file: forge/ee/lib/mcp/tools/platform.js (extend)

Summary

Add the get-by-id read tools for the platform catalogs (templates, blueprints), plus the team-type catalog reads. The list variants already ship; agents need single-item detail (e.g. to inspect a template or blueprint before use). Team types are a global platform catalog with no team in the path, mirroring project-types, so they are filed with the platform catalog tools. This scope is read-only for non-admins: all catalog create/edit/delete are platform-admin and are tracked (not implemented) in 5.10-d.

Read tools (phase 1)

readOnlyHint: true.

Tool	Endpoint	Scope	Annotation
platform_get_template	GET /templates/:templateId	template:read	read
platform_get_blueprint	GET /flow-blueprints/:flowBlueprintId	flow-blueprint:read	read
platform_list_team_types	GET /team-types	team-type:list	read
platform_get_team_type	GET /team-types/:teamTypeId	team-type:read	read

Design notes:

• No stack or instance-type get-by-id tools. The existing platform_list_hosted_instance_types already returns every project-type nested with its full stacks and a defaultStack, decorated with team creatability flags, and it accepts a projectType argument to return one type and its stacks. The single-item routes GET /project-types/:id and GET /stacks/:id use the same views.ProjectType.projectType and views.ProjectStack.stack views that tool already returns, so dedicated platform_get_hosted_instance_type / platform_get_stack / platform_list_stacks tools would be redundant and were dropped.
• list/read on templates/blueprints are any-authenticated (role undefined); the User.admin flag only changes response detail. These are safe reads.
• GET /flow-blueprints/:id and the list route allow project/device token bypass; for user PATs they require flow-blueprint:read/:list.
• templates get blanks hidden env values in the response.
• platform_list_team_types and platform_get_team_type read the global team-type catalog (no team in the path), so they are filed with the platform catalog tools rather than the team tools. list_team_types supports pagination.
• Excluded here: GET /flow-blueprints/export-public (anonymous, config-gated read; not registered as a tool). The admin /export route is tracked in 5.10-d.

Scopes to allow-list + access-tag (#7445): template:read (read), flow-blueprint:read (read), team-type:list (read), team-type:read (read).

Tests:

• All tools allowed for read-only PAT.
• Get-by-id returns the same view the UI uses.
• Team-type list and get return the platform team-type catalog.