> ## Documentation Index > Fetch the complete documentation index at: https://docs.firedrill.run/llms.txt > Use this file to discover all available pages before exploring further. # Read verified Tool behavior source > Requires build.read in this project. Returns the exact immutable bundled JavaScript for one locked package, not original repository source. The archive and selected bytes are verified without importing or executing customer code. Source is limited to 1 MiB UTF-8 and is never truncated. Optional UI metadata describes only this package's verified static assets, without their payloads. Responses are private and not cached; current access is rechecked before returning source. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/projects/{projectId}/builds/{buildHash}/tools/source openapi: 3.1.0 info: title: Firedrill Control API version: 1.0.0 description: >- The control plane for drills, drill runs, and the worlds they run in. Errors always carry the canonical envelope; unsafe operations require an Idempotency-Key; long work returns an operation resource. servers: - url: https://api.firedrill.run security: - controlCredential: [] tags: - name: authentication description: Sessions, CLI exchange, credentials, and verification keys. x-group: Authentication - name: organizations description: Organization members, billing, usage, retention, audit, and exports. x-group: Organizations - name: projects description: Project lifecycle, access, grants, and repository bindings. x-group: Projects - name: builds description: Immutable builds, uploads, source drafts, and world definitions. x-group: Builds and source - name: tools description: Project Tool discovery, approval, source, and revocation. x-group: Tool library - name: worlds description: >- Managed environments, world sessions, state, time, reset, faults, forks, and snapshots. x-group: Environments and sessions - name: runs description: >- Hosted runs, comparisons, attachments, reports, evidence bundles, sharing, and exports. x-group: Runs and evidence - name: browser description: Managed browser tests, runs, messages, streams, frames, and artifacts. x-group: Browser testing - name: callbacks description: Callback receiver approval, revocation, and signing material. x-group: Callbacks - name: github-ci description: >- GitHub installations, repository automation, CI suites, cases, evidence, and checks. x-group: GitHub and CI - name: authoring description: Authoring sessions, proposals, turns, and scenario proposals. x-group: Cloud authoring paths: /v1/projects/{projectId}/builds/{buildHash}/tools/source: get: tags: - builds summary: Read verified Tool behavior source description: >- Requires build.read in this project. Returns the exact immutable bundled JavaScript for one locked package, not original repository source. The archive and selected bytes are verified without importing or executing customer code. Source is limited to 1 MiB UTF-8 and is never truncated. Optional UI metadata describes only this package's verified static assets, without their payloads. Responses are private and not cached; current access is rechecked before returning source. operationId: builds.getToolSource parameters: - name: projectId in: path required: true schema: type: string pattern: ^prj_[0-9a-z]{12,32}$ - name: buildHash in: path required: true schema: type: string pattern: ^sha256:[0-9a-f]{64}$ - name: packageId in: query required: true schema: type: string minLength: 1 maxLength: 96 pattern: ^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$ description: >- Exact locked Tool package ID; encode it as a query value, not an archive path. responses: '200': description: Verified immutable Tool source and optional UI descriptors content: application/json: schema: $ref: '#/components/schemas/HostedToolSource' '400': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '401': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '403': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '404': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '422': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '503': description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' default: description: Canonical error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' components: schemas: HostedToolSource: type: object properties: schemaVersion: type: number enum: - 1 organizationId: type: string pattern: ^org_[0-9a-z]{12,32}$ projectId: type: string pattern: ^prj_[0-9a-z]{12,32}$ buildHash: type: string pattern: ^sha256:[0-9a-f]{64}$ packageId: type: string minLength: 1 maxLength: 96 pattern: ^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$ version: type: string pattern: >- ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$ manifestHash: type: string pattern: ^sha256:[0-9a-f]{64}$ artifactHash: type: string pattern: ^sha256:[0-9a-f]{64}$ implementation: type: object properties: kind: type: string enum: - javascript source: type: string minLength: 1 maxLength: 1048576 bytes: type: integer minimum: 0 exclusiveMinimum: true maximum: 1048576 required: - kind - source - bytes additionalProperties: false ui: type: object properties: entry: type: string minLength: 1 maxLength: 512 pattern: >- ^[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[A-Za-z0-9_-][A-Za-z0-9._-]*)*$ assets: maxItems: 256 type: array items: type: object properties: path: type: string minLength: 1 maxLength: 512 pattern: >- ^[A-Za-z0-9_-][A-Za-z0-9._-]*(?:\/[A-Za-z0-9_-][A-Za-z0-9._-]*)*$ mediaType: type: string enum: - text/html; charset=utf-8 - text/css; charset=utf-8 - text/javascript; charset=utf-8 - application/json; charset=utf-8 - image/svg+xml - image/png - image/jpeg - image/gif - image/webp - image/avif - image/x-icon - font/woff - font/woff2 - font/ttf - font/otf artifactHash: type: string pattern: ^sha256:[0-9a-f]{64}$ bytes: type: integer minimum: 0 maximum: 4194304 required: - path - mediaType - artifactHash - bytes additionalProperties: false required: - entry - assets additionalProperties: false required: - schemaVersion - organizationId - projectId - buildHash - packageId - version - manifestHash - artifactHash - implementation additionalProperties: false ErrorEnvelope: type: object properties: code: type: string pattern: ^(control|world)\.[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$ message: type: string minLength: 1 correlationId: type: string minLength: 1 retryable: type: boolean retryAfterMs: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 operationId: type: string source: type: string enum: - platform - simulated_provider issues: type: array items: type: object properties: path: type: string code: type: string message: type: string required: - path - code - message additionalProperties: false details: type: object propertyNames: type: string additionalProperties: {} evidence: type: object properties: sessionId: type: string runId: type: string journalSeq: type: integer minimum: 0 maximum: 9007199254740991 buildHash: type: string additionalProperties: false required: - code - message - correlationId - retryable - source additionalProperties: true securitySchemes: controlCredential: type: http scheme: bearer description: Opaque control credential ````