# AshLua.EvalActions Resource extension that synthesizes `:eval` and `:docs` generic actions for driving an LLM agent against a scoped Lua surface. ```elixir defmodule MyApp.Agents.MCPActions do use Ash.Resource, extensions: [AshLua.EvalActions] eval_actions do resource MyApp.Posts.Post, actions: [:read, :get_statistics] resource MyApp.Posts.Comment, actions: [:read] end end ``` The synthesized actions inherit the caller's actor / tenant / context — both the script body and the documentation rendering are constrained to the configured `(resource, action)` pairs, and every Ash call inside the Lua script flows through the standard authorization machinery. ## eval_actions Configures the Lua surface exposed to the synthesized `:eval` and `:docs` actions. Each `resource` entry pairs a resource module with the set of action names that the script (and the generated docs) is allowed to see. Use this to apply principle-of-least-privilege per agent surface — only the listed actions become callable from Lua and only those entrypoints appear in `:docs` output. ### Nested DSLs * [resource](#eval_actions-resource) ### Examples ``` eval_actions do resource MyApp.Posts.Post, actions: [:read, :get_statistics] resource MyApp.Posts.Comment, actions: [:read] end ``` ### Options | Name | Type | Default | Docs | |------|------|---------|------| | [`eval_action_name`](#eval_actions-eval_action_name){: #eval_actions-eval_action_name } | `atom` | `:eval` | Name of the synthesized eval action. Defaults to `:eval`. | | [`docs_action_name`](#eval_actions-docs_action_name){: #eval_actions-docs_action_name } | `atom` | `:docs` | Name of the synthesized docs action. Defaults to `:docs`. | | [`otp_app`](#eval_actions-otp_app){: #eval_actions-otp_app } | `atom` | | OTP app to scan when building the manifest. Defaults to the agent resource's domain's `:otp_app`. | | [`forbidden_fields`](#eval_actions-forbidden_fields){: #eval_actions-forbidden_fields } | `:hide \| :display` | `:hide` | How to render fields hidden by authorization in `:eval` results. `:hide` (default) strips them; `:display` renders them as the opaque marker `%{"opaque" => "forbidden"}` so the agent can tell a forbidden field apart from an absent one. | ### eval_actions.resource ```elixir resource resource ``` Exposes a specific set of actions on a resource to the Lua surface. ### Examples ``` resource MyApp.Posts.Post, actions: [:read, :create] ``` ### Arguments | Name | Type | Default | Docs | |------|------|---------|------| | [`resource`](#eval_actions-resource-resource){: #eval_actions-resource-resource .spark-required} | `atom` | | The resource module to expose. | ### Options | Name | Type | Default | Docs | |------|------|---------|------| | [`actions`](#eval_actions-resource-actions){: #eval_actions-resource-actions } | `:all \| list(atom)` | `:all` | Which actions on the resource to expose. `:all` (default) exposes every public action; otherwise pass an atom list. | ### Introspection Target: `AshLua.EvalActions.Expose`