Jarroba Tools

Evaluate "can this principal do this action on this scope, and WHY?" against a vendor-neutral identity/RBAC model that mirrors Azure RBAC, AWS IAM/Organizations, GCP Resource Manager or Kubernetes RBAC — each rule verified against the official docs (access.md). Returns a three-valued verdict — allowed / denied / indeterminate (an unmodelled condition would decide it) — with a step-by-step trace of which rule decided and why. Nothing is looked up online: you must pass the scenario data yourself in "world".

"What if" access diff: compares two versions of the same scenario (e.g. before/after removing a role assignment, or offboarding a principal) against a list of (principal, action, scope) checks, and reports who gains access and who loses it. A check that flips to/from "indeterminate" counts as neither a gain nor a loss — only a genuine allowed<->denied flip does.

The dual of access_check: given a list of candidate principals, returns which of them can do this action on this scope — each with its own verdict and trace, same shape as access_check.

Compare two OpenAPI specifications and say which changes BREAK a client that already exists - which is the question you actually ask before deploying, and the one a colour diff does not answer. Tells apart pairs that look identical in a diff: adding an OPTIONAL parameter breaks nothing, adding a REQUIRED one does; ADDING an enum value is safe, REMOVING one is not; dropping a query parameter is ignored, dropping a path one changes the URL. Every finding says why.

Turn a request into pasteable code in one of eleven targets: curl, fetch, axios, Python requests, HTTPie, Go, Java, C#, PHP, PowerShell or Rust. Emits the import lines and escapes per language, and gets right the things that are habitually wrong (in C# the Content-Type belongs to the content, not the headers; in Go an unused import does not compile).

Convert an API collection between formats, entirely offline. Reads Postman v2.1, Insomnia, Bruno .bru, OpenAPI 3.x / Swagger 2.0 (JSON or YAML), a browser HAR, or curl commands - the format is detected. Writes Postman, Bruno (as a file tree) or curl. Reports what cannot be translated (Postman/Bruno scripts, file fields, Insomnia templates) instead of dropping it silently.

List the credentials hidden inside an API collection before you share it: tokens, cookies, API keys and passwords, with their location and a MASKED sample. An exported collection carries its secrets with it, and this is the file people attach to tickets. Heuristic by name: it masks what it recognises, it never claims a file is clean.

Will the browser send an OPTIONS preflight before this request, and WHY? Answers without touching the network. Half of "it works in curl but not in my page" is a preflight the server does not answer, and knowing which of the three things triggers it (the method, the Content-Type or a custom header) changes where to look. Also lists the headers the browser refuses to let a page set.

A tight-binding chain of N atoms: the N levels it produces, the bandwidth, and the spacing between levels. Shows where a band COMES FROM — with 2 atoms the level splits in two (alpha +/- beta), and with many the spacing falls as 1/N until it drops below k_B*T, which is when talking about individual levels stops making sense.

Programmer's calculator on exact integers (BigInt): arithmetic (add/sub/mul/div/mod/pow) and bitwise (and/or/xor/nand/nor/xnor/shl/shr/sar/rol/ror). Returns the result in every base.

Energy curve between the two atoms of a measured diatomic molecule: bond length, well depth (De), REAL dissociation energy (D0) and zero-point energy. D0 is NOT De — the molecule is never at rest at the bottom of the well, not even at 0 K, and in H2 the difference is 0.27 eV. Covalent bonds use Morse, noble gases use Lennard-Jones.

Differentiate an expression symbolically, exactly: "x^3 + 2x", "sin(x)*cos(x)", "x^x". Keeps units, so d/dx (3 m * x) is "3 m" and not 3. Can take higher-order derivatives and evaluate the result at a point. Says which name it read as a unit, and refuses to answer "0" when the variable is not in the expression.

Evaluate a mathematical expression WITH UNITS and dimensional checking: "100 km/h to m/s", "5 km + 300 m", "70 kg to lbs", "det([[1,2],[3,4]])". Adding incompatible units is an error, not a silent number. Also flags results that are not finite (NaN, infinity).

Evaluate a multi-line calculation sheet and return the result of EVERY line. Variables carry downwards, units travel with the value, "#" starts a comment, "ans" is the previous result, and an error stays on its own line instead of killing the sheet. Declare currencies with "# @moneda USD = 1.08 EUR". Good for checking a quote or a budget line by line.

Solve an equation in one unknown ("x^2 - 5x + 6 = 0", "sin(x) = 0.5") or a linear system (one equation per line). Says whether the answer is EXACT or an approximation, and over which interval it searched. Never invents a root it did not find.

Show the WORKED STEPS of a calculation, verified step by step: a linear or quadratic equation, a derivative (naming which rule applies), or Gaussian elimination on a linear system row by row. Each step comes with the name of the rule used. When it cannot explain a case it says so (covered: false) instead of inventing a plausible-looking derivation — useful when you have to show your work to a person.

Read Unix permissions: takes octal ("755") or symbolic ("rwxr-xr-x") and returns both forms plus the breakdown (user/group/other, setuid/setgid/sticky).

Is this IP inside that CIDR network? Returns true/false.

Analyze an IPv4 network from CIDR or IP+mask: network and broadcast addresses, first/last host, mask and wildcard, host count, class, private/special ranges, binary form and reverse PTR name.

Split a base network into variable-length subnets (VLSM) sized to the host counts you ask for.

Split a text into claims and say, for each, whether it comes with a source and of what kind: peer-reviewed, preprint (arXiv and friends), registry/link, or self-published. Flags the ABSOLUTE claims with NO source at all, which is the expensive failure mode because they sound exactly as confident as the backed ones. It does NOT say whether something is true — it cannot — it says whether it is supported, which is a different thing. An arXiv DOI is still a preprint: registration is not review. Worth running on your own answer before you send it.

Convert a color between HEX, RGB and HSL. Accepts "#3498db", "rgb(52,152,219)", "hsl(...)" or CSS names.

Single-electron transistor: charging energy E_C, whether Coulomb blockade occurs, and why it does not when it fails. Checks BOTH conditions — E_C >> k_B*T and tunnel barriers above the resistance quantum R_K = h/e^2 ~ 25.8 kOhm. The second is almost never mentioned, and without it a design with perfect energy still does not blockade.

Count tokens EXACTLY with the model's real BPE (o200k_base=GPT-4o, cl100k_base=GPT-4/3.5, p50k_base=Codex, r50k_base=GPT-3/2). Returns tokens, words, characters and % of the context window.

Next run times of a 5-field cron expression, as ISO dates. "When does this actually fire?" is a calculation LLMs routinely get wrong.

Turn a DDL into Markdown documentation, DBML (dbdiagram.io) or a Mermaid erDiagram, with relations and their 1:1 / 1:N cardinality derived from the keys.

Turn a DDL into classes in your language: Java/JPA, TypeScript, Python (SQLAlchemy 2.0), C#/EF Core or Go. Types are respected — `numeric` becomes BigDecimal/decimal, never a double — and so is which fields are optional.

Propose the missing foreign keys: find by name and type the columns that look like they point at another table, then CHECK each one against the rows, counting how many of its values actually exist on the other side. The percentage is counted rows, not a hunch. At 100% the relation holds and the returned ALTER TABLE cannot fail; with orphan rows PostgreSQL would reject it, so how many and which ones are reported.

Find the foreign-key paths between two tables and return the SELECT with the JOINs already written. If the script carries data, every path is EXECUTED and they are ranked by the rows they actually return — a short path that yields zero rows joins nothing. Hub tables (related to almost everything) can be set aside, since they connect any pair without explaining anything.

Run the script in an ephemeral PostgreSQL and review row-level security, warning about the SILENT failures: RLS on with no policies, policies with RLS off, the owner bypassing them because FORCE is missing, a superuser role, or the missing GRANT/USAGE that makes "zero rows" not the policy's fault at all. Given a role and a table it also SIMULATES: it looks at the table through that role's eyes, inside a transaction that is rolled back, and reports how many rows it can see, update and delete.

Run a DDL in an ephemeral PostgreSQL and return the REAL schema (tables, columns, keys, indexes, constraints) plus the design problems found: tables with no primary key, foreign keys with no index, money in floating point, timestamps without a time zone, types that do not match on the two sides of a relation, and redundant indexes. The schema is executed, not guessed with regular expressions.

Detect whether a SQL script comes from MySQL/MariaDB, SQLite, SQL Server or Oracle and translate it to PostgreSQL, explaining every change with its line number. Changes that are NOT exact equivalents are flagged as such.

Append the "nodes"/"edges"/"charts" of a JTD FRAGMENT (same format) to the diagram held in memory, on top of whatever is already there. Returns the new counts plus the warnings and errors of validating the result.

Return the COMPLETE JTD document built so far in memory, ready to save or paste into the web tool.

Start an EMPTY JTD diagram in memory, discarding any previous one. Lets you build it piece by piece with diagram_add and look at it with diagram_preview, instead of writing the whole JSON in one shot.

Validate and DRAW (SVG) the diagram held in memory, so you can look at it and keep adding or fixing in a loop. This is the generate → look → correct cycle; a model cannot judge a diagram by reading its JSON.

Render a JTD to PNG with the app's REAL engine (full fidelity; only needed to check skins and effects). Requires a checkout of the repo AND a running dev server. For everything else use diagram_svg, which needs neither.

Render a JTD to SVG with no browser and no dev server, so you get the actual drawing back and can check it. Validates first. This is the one to use to SEE what you built.

Validate a JTD (Jarroba Tools Diagram) document: structure, allowed shapes and chart types, and edge references. Returns {ok, errors, warnings, summary}. Spec: public/jtd.md. Use it to check your JSON before handing it to anyone.

Say which LAYERS of a Dockerfile would be rebuilt when given files change, and which come from cache. Dockerfile linters spot suspicious ordering patterns; this SIMULATES invalidation, which is a different thing: it needs to know which files exist and which changed. In Docker, when one layer is invalidated so is EVERY layer after it, so a `COPY . .` before the `RUN` that installs dependencies condemns you to reinstalling all of them every time you touch a line of code — and that shows up here as numbers. Respects the `.dockerignore`: what stays out of the context cannot invalidate anything.

Electron configuration of a neutral element, full and noble-gas abbreviated, with its shells and valence. Flags whether the element is one of the 20 real ANOMALIES (Cr, Cu, Nb, Ru, Pd...) — exactly where the Madelung rule fails and a language model tends to get the rule right and the element wrong.

Data sheet for an element by atomic number or symbol: name, mass, category, group/period/block, electronegativity, radius, ionization energy and electron affinity. Data that does NOT exist comes back as null, never as 0 — a noble gas has no electron affinity, and that is not "zero".

Electron configuration of an ION. Electrons leave from the HIGHEST n shell, not from the last orbital that was filled: Fe2+ is [Ar]3d6, not [Ar]3d4 4s2. This is the classic mistake and the one seen most often in generated answers.

Review an eval suite and run it against the outputs you provide. The review catches what silently ruins a suite: assertions that CANNOT FAIL (an empty `contains`, a regex like `.*`, a case with no assertions) and ones that can never pass (requiring and forbidding the same thing, an inverted range). A suite with those scores 100% on day one and has measured nothing. Assertion types: contains, not-contains, regex, json, range, max-chars and supported (no absolute claim without a source). Calls no model: you pass the outputs in already produced.

Convert data between formats: json, yaml, properties, env, csv, markdown.

Why the transistor changed shape: natural length lambda and minimum gate length (5*lambda) for each architecture — planar, FD-SOI, FinFET, GAA nanosheet, nanowire, forksheet and CFET — at the SAME dimensions, which is what isolates the effect of geometry alone. It does not tabulate real process-node dimensions, because those are not public.

Detect and correct a single-bit error in a received Hamming word: whether there is an error, which bit, and the corrected data.

Encode bits with a Hamming (SEC) code: inserts the parity bits. Input is a string of 0s and 1s.

SHA-256, SHA-384 and SHA-512 (hex) of a UTF-8 string.

Hydrogen spectral lines for a series (nLow=1 Lyman, 2 Balmer, 3 Paschen...). Gives the wavelength IN VACUUM and IN AIR, which are different numbers: H-alpha is 656.47 nm in vacuum and 656.28 in air, and confusing them is common. Uses the reduced-mass Rydberg constant (R_H), not R-infinity.