@dforge-core/dforge-mcp 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/server.js

@@ -2981,7 +2981,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve4.call(this, root, ref);
+      let _sch = resolve5.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -3008,7 +3008,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve4(root, ref) {
+    function resolve5(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3226,8 +3226,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path4) {
-      let input = path4;
+    function removeDotSegments(path8) {
+      let input = path8;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3479,8 +3479,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path4, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
+        const [path8, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path8 && path8 !== "/" ? path8 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -3639,55 +3639,55 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve4(baseURI, relativeURI, options) {
+    function resolve5(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative, options, skipNormalization) {
+    function resolveComponent(base, relative2, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative = parse3(serialize(relative, options), options);
+        relative2 = parse3(serialize(relative2, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative.scheme) {
-        target.scheme = relative.scheme;
-        target.userinfo = relative.userinfo;
-        target.host = relative.host;
-        target.port = relative.port;
-        target.path = removeDotSegments(relative.path || "");
-        target.query = relative.query;
+      if (!options.tolerant && relative2.scheme) {
+        target.scheme = relative2.scheme;
+        target.userinfo = relative2.userinfo;
+        target.host = relative2.host;
+        target.port = relative2.port;
+        target.path = removeDotSegments(relative2.path || "");
+        target.query = relative2.query;
       } else {
-        if (relative.userinfo !== void 0 || relative.host !== void 0 || relative.port !== void 0) {
-          target.userinfo = relative.userinfo;
-          target.host = relative.host;
-          target.port = relative.port;
-          target.path = removeDotSegments(relative.path || "");
-          target.query = relative.query;
+        if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
+          target.userinfo = relative2.userinfo;
+          target.host = relative2.host;
+          target.port = relative2.port;
+          target.path = removeDotSegments(relative2.path || "");
+          target.query = relative2.query;
         } else {
-          if (!relative.path) {
+          if (!relative2.path) {
             target.path = base.path;
-            if (relative.query !== void 0) {
-              target.query = relative.query;
+            if (relative2.query !== void 0) {
+              target.query = relative2.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative.path[0] === "/") {
-              target.path = removeDotSegments(relative.path);
+            if (relative2.path[0] === "/") {
+              target.path = removeDotSegments(relative2.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative.path;
+                target.path = "/" + relative2.path;
               } else if (!base.path) {
-                target.path = relative.path;
+                target.path = relative2.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative.query;
+            target.query = relative2.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -3695,7 +3695,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative.fragment;
+      target.fragment = relative2.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -3897,7 +3897,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve4,
+      resolve: resolve5,
       resolveComponent,
       equal,
       serialize,
@@ -6873,12 +6873,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs4, exportName) {
+    function addFormats(ajv, list, fs6, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs4[f]);
+        ajv.addFormat(f, fs6[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -7245,8 +7245,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path4, errorMaps, issueData } = params;
-  const fullPath = [...path4, ...issueData.path || []];
+  const { data, path: path8, errorMaps, issueData } = params;
+  const fullPath = [...path8, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7361,11 +7361,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path4, key) {
+  constructor(parent, value, path8, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path4;
+    this._path = path8;
     this._key = key;
   }
   get path() {
@@ -9112,8 +9112,8 @@ function deepPartialify(schema2) {
   if (schema2 instanceof ZodObject) {
     const newShape = {};
     for (const key in schema2.shape) {
-      const fieldSchema = schema2.shape[key];
-      newShape[key] = ZodOptional.create(deepPartialify(fieldSchema));
+      const fieldSchema2 = schema2.shape[key];
+      newShape[key] = ZodOptional.create(deepPartialify(fieldSchema2));
     }
     return new ZodObject({
       ...schema2._def,
@@ -9410,11 +9410,11 @@ var ZodObject = class _ZodObject extends ZodType {
   partial(mask) {
     const newShape = {};
     for (const key of util.objectKeys(this.shape)) {
-      const fieldSchema = this.shape[key];
+      const fieldSchema2 = this.shape[key];
       if (mask && !mask[key]) {
-        newShape[key] = fieldSchema;
+        newShape[key] = fieldSchema2;
       } else {
-        newShape[key] = fieldSchema.optional();
+        newShape[key] = fieldSchema2.optional();
       }
     }
     return new _ZodObject({
@@ -9428,8 +9428,8 @@ var ZodObject = class _ZodObject extends ZodType {
       if (mask && !mask[key]) {
         newShape[key] = this.shape[key];
       } else {
-        const fieldSchema = this.shape[key];
-        let newField = fieldSchema;
+        const fieldSchema2 = this.shape[key];
+        let newField = fieldSchema2;
         while (newField instanceof ZodOptional) {
           newField = newField._def.innerType;
         }
@@ -11285,10 +11285,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path4) {
-  if (!path4)
+function getElementAtPath(obj, path8) {
+  if (!path8)
     return obj;
-  return path4.reduce((acc, key) => acc?.[key], obj);
+  return path8.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11697,11 +11697,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path4, issues) {
+function prefixIssues(path8, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path4);
+    iss.path.unshift(path8);
     return iss;
   });
 }
@@ -11848,16 +11848,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path8 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -11884,17 +11884,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path8 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -11926,8 +11926,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path4) {
+  const path8 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path8) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -25052,13 +25052,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path4 = ref.slice(1).split("/").filter(Boolean);
-  if (path4.length === 0) {
+  const path8 = ref.slice(1).split("/").filter(Boolean);
+  if (path8.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path4[0] === defsKey) {
-    const key = path4[1];
+  if (path8[0] === defsKey) {
+    const key = path8[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -28828,7 +28828,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
+        await new Promise((resolve5) => setTimeout(resolve5, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error51) {
@@ -28845,7 +28845,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -28923,7 +28923,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve4(parseResult.data);
+            resolve5(parseResult.data);
           }
         } catch (error51) {
           reject(error51);
@@ -29184,12 +29184,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve4, interval);
+      const timeoutId = setTimeout(resolve5, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -30289,7 +30289,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
+      await new Promise((resolve5) => setTimeout(resolve5, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -30938,12 +30938,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve4();
+        resolve5();
       } else {
-        this._stdout.once("drain", resolve4);
+        this._stdout.once("drain", resolve5);
       }
     });
   }
@@ -31006,18 +31006,16 @@ function buildDataViews(entities) {
 }
 function buildFolders(opts) {
   return {
-    [opts.code]: {
-      label: opts.displayName,
-      description: opts.description || opts.displayName,
-      icon: "bi-folder",
-      color: "#2196F3",
-      entities: Object.fromEntries(
-        opts.entities.map((e) => [
-          e.name,
-          { viewName: e.name, quickAdd: true }
-        ])
-      )
-    }
+    label: opts.displayName,
+    description: opts.description || opts.displayName,
+    icon: "bi-folder",
+    color: "#2196F3",
+    entities: Object.fromEntries(
+      opts.entities.map((e) => [
+        e.name,
+        { viewName: "default", quickAdd: true }
+      ])
+    )
   };
 }
 function buildMenus(opts) {
@@ -31151,11 +31149,11 @@ function createModuleFiles(args) {
     entities: args.entities
   };
   const files = {};
-  const write = (rel, obj) => {
-    files[rel] = JSON.stringify(obj, null, "	") + "\n";
+  const write = (rel2, obj) => {
+    files[rel2] = JSON.stringify(obj, null, "	") + "\n";
   };
-  const writeText = (rel, text) => {
-    files[rel] = text;
+  const writeText = (rel2, text) => {
+    files[rel2] = text;
   };
   write("manifest.json", buildManifest(opts, moduleId));
   for (const e of opts.entities) {
@@ -31361,10 +31359,583 @@ function dbmlImport(_args) {
   };
 }
 
-// src/resources/index.ts
+// src/tools/entity-field.ts
+var path4 = __toESM(require("path"));
+
+// src/tools/_helpers.ts
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
-var RESOURCES_DIR = path3.resolve(__dirname, "..", "resources");
+function modulePaths(moduleDir) {
+  const root = path3.resolve(moduleDir);
+  return {
+    root,
+    manifest: path3.join(root, "manifest.json"),
+    entitiesDir: path3.join(root, "entities"),
+    uiDir: path3.join(root, "ui"),
+    securityDir: path3.join(root, "security"),
+    logicDir: path3.join(root, "logic"),
+    seedDataDir: path3.join(root, "seed-data"),
+    translationsDir: path3.join(root, "translations"),
+    dataViews: path3.join(root, "ui", "data_views.json"),
+    folders: path3.join(root, "ui", "folders.json"),
+    menus: path3.join(root, "ui", "menus.json"),
+    actions: path3.join(root, "ui", "actions.json"),
+    reports: path3.join(root, "ui", "reports.json"),
+    roles: path3.join(root, "security", "roles.json"),
+    jobs: path3.join(root, "logic", "jobs.json"),
+    settings: path3.join(root, "settings.json")
+  };
+}
+function readJson(absPath) {
+  if (!fs3.existsSync(absPath)) {
+    throw new Error(`Not found: ${absPath}`);
+  }
+  try {
+    return JSON.parse(fs3.readFileSync(absPath, "utf8"));
+  } catch (e) {
+    throw new Error(`${absPath}: ${e.message}`);
+  }
+}
+function readJsonOrDefault(absPath, dflt) {
+  if (!fs3.existsSync(absPath)) return dflt;
+  try {
+    return JSON.parse(fs3.readFileSync(absPath, "utf8"));
+  } catch (e) {
+    throw new Error(`${absPath}: ${e.message}`);
+  }
+}
+function jsonText(obj) {
+  return JSON.stringify(obj, null, "	") + "\n";
+}
+function rel(root, abs) {
+  return path3.relative(root, abs);
+}
+function loadManifest(moduleDir) {
+  const paths = modulePaths(moduleDir);
+  if (!fs3.existsSync(paths.manifest)) {
+    throw new Error(
+      `No manifest.json at ${paths.manifest} \u2014 is this a dForge module directory?`
+    );
+  }
+  const manifest = readJson(paths.manifest);
+  if (!manifest.code) {
+    throw new Error("manifest.json has no `code` field \u2014 corrupt module?");
+  }
+  return { manifest, paths };
+}
+function makeResult(summary, files, warning) {
+  const out = { summary, files };
+  if (warning) out.warning = warning;
+  return out;
+}
+function withTodayStamp(manifest) {
+  return { ...manifest, updated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10) };
+}
+
+// src/tools/entity-field.ts
+var fieldSchema = external_exports.object({
+  dbDatatype: external_exports.string().optional(),
+  fieldTypeCd: external_exports.string().optional(),
+  baseDatatypeCd: external_exports.string().optional(),
+  columnType: external_exports.string().optional(),
+  flags: external_exports.string().optional(),
+  isNullable: external_exports.boolean().optional(),
+  maxLen: external_exports.number().int().optional(),
+  orderNum: external_exports.number().int().optional(),
+  description: external_exports.string().optional(),
+  defaultValue: external_exports.unknown().optional(),
+  formula: external_exports.string().optional(),
+  link: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  params: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).passthrough().describe(
+  "Field spec. Common keys: dbDatatype, fieldTypeCd, flags (VEMHI letters), isNullable, maxLen, orderNum, description, link ({entity, otherKey}) for refs, formula for computed columns. Pass through whatever the entity.schema.json allows."
+);
+var entityFieldAddSchema = {
+  moduleDir: external_exports.string().describe("Path to the module root."),
+  entityName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("Entity code to add the field to."),
+  fieldName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("New field's code."),
+  field: fieldSchema
+};
+function entityFieldAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const entityPath = path4.join(paths.entitiesDir, `${args.entityName}.json`);
+  const entity = readJson(entityPath);
+  const fields = entity.fields ?? {};
+  if (Object.prototype.hasOwnProperty.call(fields, args.fieldName)) {
+    throw new Error(
+      `Field '${args.fieldName}' already exists on entity '${args.entityName}'. Use entity_field_modify to change it.`
+    );
+  }
+  entity.fields = { ...fields, [args.fieldName]: args.field };
+  const files = {
+    [rel(paths.root, entityPath)]: jsonText(entity),
+    "manifest.json": jsonText(withTodayStamp(manifest))
+  };
+  return makeResult(
+    `Added field '${args.fieldName}' to entity '${args.entityName}'.`,
+    files
+  );
+}
+var entityFieldModifySchema = {
+  moduleDir: external_exports.string(),
+  entityName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/),
+  fieldName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/),
+  field: fieldSchema.describe(
+    "Replacement spec. Replaces the existing field entirely \u2014 pass the full desired shape, not a partial patch."
+  )
+};
+function entityFieldModify(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const entityPath = path4.join(paths.entitiesDir, `${args.entityName}.json`);
+  const entity = readJson(entityPath);
+  const fields = entity.fields ?? {};
+  if (!Object.prototype.hasOwnProperty.call(fields, args.fieldName)) {
+    throw new Error(
+      `Field '${args.fieldName}' not found on entity '${args.entityName}'.`
+    );
+  }
+  entity.fields = { ...fields, [args.fieldName]: args.field };
+  return makeResult(
+    `Modified field '${args.fieldName}' on entity '${args.entityName}'.`,
+    {
+      [rel(paths.root, entityPath)]: jsonText(entity),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+var entityFieldRemoveSchema = {
+  moduleDir: external_exports.string(),
+  entityName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/),
+  fieldName: external_exports.string().regex(/^[a-z][a-z0-9_]*$/)
+};
+function entityFieldRemove(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const entityPath = path4.join(paths.entitiesDir, `${args.entityName}.json`);
+  const entity = readJson(entityPath);
+  const fields = entity.fields ?? {};
+  if (!Object.prototype.hasOwnProperty.call(fields, args.fieldName)) {
+    throw new Error(
+      `Field '${args.fieldName}' not found on entity '${args.entityName}'.`
+    );
+  }
+  const { [args.fieldName]: _removed, ...rest } = fields;
+  void _removed;
+  entity.fields = rest;
+  return makeResult(
+    `Removed field '${args.fieldName}' from entity '${args.entityName}'. Note: dependent views / formulas referencing this field will break \u2014 review them.`,
+    {
+      [rel(paths.root, entityPath)]: jsonText(entity),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    },
+    "Removing fields can break dependent views, role rights, formulas, action DSL, and seed data. Run `dforge_module_inspect` after writing to spot broken references."
+  );
+}
+
+// src/tools/action-add.ts
+var path5 = __toESM(require("path"));
+var actionAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("Action code (becomes the DSL filename and registry key)."),
+  entityCode: external_exports.string().regex(/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)?$/).describe(
+    "Entity this action targets. May be cross-module via dot notation ('fin.invoice')."
+  ),
+  label: external_exports.string().min(1).describe("Display label in the action menu."),
+  mode: external_exports.enum(["single", "each", "batch"]).default("single").describe(
+    "Execution mode. 'single' = whole selection at once, 'each' = per-record, 'batch' = explicit `for x in records` loop in DSL."
+  ),
+  icon: external_exports.string().optional().describe("Bootstrap icon class (e.g. 'play-fill')."),
+  background: external_exports.boolean().default(false).describe("Run asynchronously (queues to background_action table)."),
+  dslBody: external_exports.string().describe(
+    "Full DSL source. Should contain `params:`, optional `canExecute:`, optional `onBeforeStart:` (async only), and required `execute:` blocks."
+  )
+};
+function actionAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const actionsJson = readJsonOrDefault(paths.actions, {});
+  if (Object.prototype.hasOwnProperty.call(actionsJson, args.code)) {
+    throw new Error(
+      `Action '${args.code}' already exists in ui/actions.json. Use a different code or remove the existing entry first.`
+    );
+  }
+  const actionEntry = {
+    entity: args.entityCode,
+    label: args.label,
+    mode: args.mode,
+    background: args.background,
+    dsl: `./logic/actions/${args.code}.dsl`
+  };
+  if (args.icon) actionEntry.icon = args.icon;
+  actionsJson[args.code] = actionEntry;
+  const dslPath = path5.join(paths.logicDir, "actions", `${args.code}.dsl`);
+  const dslBody = args.dslBody.endsWith("\n") ? args.dslBody : args.dslBody + "\n";
+  return makeResult(
+    `Added action '${args.code}' targeting entity '${args.entityCode}' (mode=${args.mode}${args.background ? ", background" : ""}).`,
+    {
+      [rel(paths.root, paths.actions)]: jsonText(actionsJson),
+      [rel(paths.root, dslPath)]: dslBody,
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+
+// src/tools/view.ts
+var dataSourceSchema = external_exports.object({
+  entityCode: external_exports.string(),
+  level: external_exports.number().int().min(0).optional(),
+  label: external_exports.string().optional(),
+  columns: external_exports.array(external_exports.unknown()).optional(),
+  filter: external_exports.unknown().optional(),
+  order: external_exports.unknown().optional(),
+  parentSetField: external_exports.string().optional()
+}).passthrough();
+var dataViewSchema = external_exports.object({
+  viewType: external_exports.enum([
+    "grid",
+    "list",
+    "kanban",
+    "calendar",
+    "gallery",
+    "tree-grid",
+    "diagram",
+    "master-detail",
+    "library"
+  ]),
+  label: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  icon: external_exports.string().optional(),
+  dataSources: external_exports.array(dataSourceSchema).min(1),
+  filter: external_exports.unknown().optional(),
+  order: external_exports.unknown().optional(),
+  viewConfig: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).passthrough();
+var viewAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("View code (keys ui/data_views.json + URL slug)."),
+  view: dataViewSchema
+};
+function viewAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const views = readJsonOrDefault(paths.dataViews, {});
+  if (Object.prototype.hasOwnProperty.call(views, args.code)) {
+    throw new Error(
+      `View '${args.code}' already exists in ui/data_views.json. Use view_modify to change it.`
+    );
+  }
+  views[args.code] = args.view;
+  return makeResult(
+    `Added ${args.view.viewType} view '${args.code}' over [${args.view.dataSources.map((d) => d.entityCode).join(", ")}].`,
+    {
+      [rel(paths.root, paths.dataViews)]: jsonText(views),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+var viewModifySchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/),
+  view: dataViewSchema.describe(
+    "Replacement view spec \u2014 full shape, not a partial patch."
+  )
+};
+function viewModify(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const views = readJsonOrDefault(paths.dataViews, {});
+  if (!Object.prototype.hasOwnProperty.call(views, args.code)) {
+    throw new Error(
+      `View '${args.code}' not found. Use view_add to create it.`
+    );
+  }
+  views[args.code] = args.view;
+  return makeResult(`Modified view '${args.code}'.`, {
+    [rel(paths.root, paths.dataViews)]: jsonText(views),
+    "manifest.json": jsonText(withTodayStamp(manifest))
+  });
+}
+
+// src/tools/adds.ts
+var reportAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("Report code (keys ui/reports.json)."),
+  report: external_exports.object({
+    description: external_exports.string(),
+    layout: external_exports.record(external_exports.string(), external_exports.unknown()),
+    datasets: external_exports.record(external_exports.string(), external_exports.unknown()),
+    parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).passthrough().describe(
+    "Full report spec per reports.schema.json: { description, layout: { panels: [...] }, datasets: { code: {...} }, parameters? }."
+  )
+};
+function reportAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const reports = readJsonOrDefault(paths.reports, {});
+  if (Object.prototype.hasOwnProperty.call(reports, args.code)) {
+    throw new Error(`Report '${args.code}' already exists in ui/reports.json.`);
+  }
+  reports[args.code] = args.report;
+  return makeResult(`Added report '${args.code}'.`, {
+    [rel(paths.root, paths.reports)]: jsonText(reports),
+    "manifest.json": jsonText(withTodayStamp(manifest))
+  });
+}
+var settingAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_]*$/).describe("Setting code (keys settings.json)."),
+  setting: external_exports.object({
+    fieldTypeCd: external_exports.string(),
+    baseDatatypeCd: external_exports.string().optional(),
+    label: external_exports.string().optional(),
+    description: external_exports.string().optional(),
+    defaultValue: external_exports.unknown().optional(),
+    formula: external_exports.string().optional(),
+    required: external_exports.boolean().optional(),
+    params: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).passthrough()
+};
+function settingAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const settings = readJsonOrDefault(paths.settings, {});
+  if (Object.prototype.hasOwnProperty.call(settings, args.code)) {
+    throw new Error(`Setting '${args.code}' already exists.`);
+  }
+  settings[args.code] = args.setting;
+  return makeResult(`Added setting '${args.code}'.`, {
+    [rel(paths.root, paths.settings)]: jsonText(settings),
+    "manifest.json": jsonText(withTodayStamp(manifest))
+  });
+}
+var roleAddSchema = {
+  moduleDir: external_exports.string(),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_-]*\.[a-z][a-z0-9_-]*$/).describe(
+    "Role code, namespaced as `<module>.<role>` (e.g. 'crm.admin'). Conventional namespacing prevents collisions across modules."
+  ),
+  description: external_exports.string(),
+  rights: external_exports.record(external_exports.string(), external_exports.string()).describe(
+    "Map: entityCode (or actionCode/reportCode) \u2192 rights string. For entities: any combination of 'S' (Select), 'I' (Insert), 'U' (Update), 'D' (Delete), 'C' (Clone), e.g. 'SIUDC' for full. For actions/reports: 'E' (Execute)."
+  )
+};
+function roleAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const roles = readJsonOrDefault(paths.roles, {});
+  if (Object.prototype.hasOwnProperty.call(roles, args.code)) {
+    throw new Error(`Role '${args.code}' already exists.`);
+  }
+  roles[args.code] = { description: args.description, rights: args.rights };
+  return makeResult(
+    `Added role '${args.code}' with rights on ${Object.keys(args.rights).length} object(s).`,
+    {
+      [rel(paths.root, paths.roles)]: jsonText(roles),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+var folderAddSchema = {
+  moduleDir: external_exports.string(),
+  parentPath: external_exports.string().default("").describe(
+    "Slash-separated folder codes from root, e.g. 'central/east' nests under root \u2192 central \u2192 east. Empty = add directly under root."
+  ),
+  code: external_exports.string().regex(/^[a-z][a-z0-9_-]*$/).describe("New folder's code (key under parent.children)."),
+  folder: external_exports.object({
+    label: external_exports.string(),
+    description: external_exports.string().optional(),
+    color: external_exports.string().optional(),
+    icon: external_exports.string().optional(),
+    inheritSecurity: external_exports.boolean().optional(),
+    entities: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+    children: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).passthrough()
+};
+function folderAdd(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const root = readJsonOrDefault(paths.folders, {
+    label: manifest.displayName
+  });
+  let cursor = root;
+  const segments = args.parentPath.split("/").filter(Boolean);
+  for (const seg of segments) {
+    const children2 = cursor.children ?? {};
+    if (!children2[seg]) {
+      throw new Error(
+        `Folder path segment '${seg}' not found under '${segments.slice(0, segments.indexOf(seg)).join("/") || "(root)"}'.`
+      );
+    }
+    cursor = children2[seg];
+  }
+  const children = cursor.children ?? {};
+  if (children[args.code]) {
+    throw new Error(`Folder '${args.code}' already exists at '${args.parentPath || "(root)"}'.`);
+  }
+  children[args.code] = args.folder;
+  cursor.children = children;
+  return makeResult(
+    `Added folder '${args.code}' under '${args.parentPath || "(root)"}'.`,
+    {
+      [rel(paths.root, paths.folders)]: jsonText(root),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+var dependencyAddSchema = {
+  moduleDir: external_exports.string(),
+  moduleCode: external_exports.string().regex(/^[a-z][a-z0-9_-]*$/).describe("Module to depend on."),
+  version: external_exports.string().default(">=0.1.0").describe("Semver range."),
+  entities: external_exports.array(external_exports.string()).optional().describe(
+    "If only specific entities from the dependency are used, list them \u2014 produces the object-style dep `{ version, entities }` for partial coupling. Omit to depend on the whole module."
+  )
+};
+function dependencyAdd(args) {
+  const { manifest } = loadManifest(args.moduleDir);
+  if (manifest.code === args.moduleCode) {
+    throw new Error("A module can't depend on itself.");
+  }
+  const deps = manifest.dependencies ?? {};
+  if (Object.prototype.hasOwnProperty.call(deps, args.moduleCode)) {
+    throw new Error(
+      `Dependency on '${args.moduleCode}' already exists. Edit manifest.json directly to change the version.`
+    );
+  }
+  const value = args.entities && args.entities.length > 0 ? { version: args.version, entities: args.entities } : args.version;
+  const newManifest = withTodayStamp({
+    ...manifest,
+    dependencies: { ...deps, [args.moduleCode]: value }
+  });
+  return makeResult(
+    `Added dependency on '${args.moduleCode}' (${args.version})${args.entities ? ` for entities [${args.entities.join(", ")}]` : ""}.`,
+    { "manifest.json": jsonText(newManifest) }
+  );
+}
+
+// src/tools/role-right.ts
+var roleRightSetSchema = {
+  moduleDir: external_exports.string(),
+  roleCode: external_exports.string().describe("Role code as it appears in security/roles.json (e.g. 'crm.admin')."),
+  object: external_exports.string().describe(
+    "Entity / action / report code to grant rights on. For cross-module rights, use dotted form ('fin.invoice')."
+  ),
+  rights: external_exports.string().describe(
+    "Rights string. Entities: any combination of S/I/U/D/C (use '' to revoke all). Actions/reports: 'E' or ''."
+  )
+};
+function roleRightSet(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const roles = readJson(paths.roles);
+  const role = roles[args.roleCode];
+  if (!role) {
+    throw new Error(
+      `Role '${args.roleCode}' not found in security/roles.json. Use role_add to create it.`
+    );
+  }
+  const rights = role.rights ?? {};
+  if (args.rights === "") {
+    const { [args.object]: _gone, ...rest } = rights;
+    void _gone;
+    role.rights = rest;
+  } else {
+    role.rights = { ...rights, [args.object]: args.rights };
+  }
+  return makeResult(
+    args.rights === "" ? `Revoked all rights on '${args.object}' from role '${args.roleCode}'.` : `Set rights on '${args.object}' for role '${args.roleCode}' to '${args.rights}'.`,
+    {
+      [rel(paths.root, paths.roles)]: jsonText(roles),
+      "manifest.json": jsonText(withTodayStamp(manifest))
+    }
+  );
+}
+
+// src/tools/module-inspect.ts
+var fs4 = __toESM(require("fs"));
+var path6 = __toESM(require("path"));
+var moduleInspectSchema = {
+  moduleDir: external_exports.string()
+};
+function moduleInspect(args) {
+  const { paths, manifest } = loadManifest(args.moduleDir);
+  const entities = manifest.entities ?? {};
+  const entitySummaries = Object.entries(entities).map(([name, relPath]) => {
+    const abs = path6.join(paths.root, relPath.replace(/^\.\//, ""));
+    const e = readJsonOrDefault(abs, {});
+    const fields = e.fields ?? {};
+    return {
+      name,
+      isExtension: Boolean(e.extends),
+      traits: e.traits ?? [],
+      fieldCount: Object.keys(fields).length,
+      fields: Object.keys(fields),
+      hasNumberSequence: Boolean(e.numberSequence),
+      toString: e.toString
+    };
+  });
+  const views = readJsonOrDefault(paths.dataViews, {});
+  const viewSummaries = Object.entries(views).map(([code, v]) => ({
+    code,
+    viewType: v.viewType ?? "?",
+    sources: (v.dataSources ?? []).map(
+      (s) => s.entityCode ?? "?"
+    )
+  }));
+  const foldersTree = readJsonOrDefault(paths.folders, {});
+  const folderDepth = computeDepth(foldersTree);
+  const menus = readJsonOrDefault(paths.menus, {});
+  const menuSummaries = Object.entries(menus).map(([code, m]) => ({
+    code,
+    itemCount: Object.keys(m.items ?? {}).length
+  }));
+  const rolesJson = readJsonOrDefault(paths.roles, {});
+  const roleSummaries = Object.entries(rolesJson).map(([code, r]) => {
+    const rights = r.rights ?? {};
+    return { code, objectCount: Object.keys(rights).length, rights };
+  });
+  const actions = readJsonOrDefault(paths.actions, {});
+  const actionSummaries = Object.entries(actions).map(([code, a]) => ({
+    code,
+    entity: a.entity ?? "?",
+    mode: a.mode ?? "single",
+    background: Boolean(a.background)
+  }));
+  const reports = Object.keys(readJsonOrDefault(paths.reports, {}));
+  const settings = Object.keys(readJsonOrDefault(paths.settings, {}));
+  const jobs = Object.keys(readJsonOrDefault(paths.jobs, {}));
+  const seedFiles = fs4.existsSync(paths.seedDataDir) ? fs4.readdirSync(paths.seedDataDir).filter((f) => f.endsWith(".json")).sort() : [];
+  const translations = fs4.existsSync(paths.translationsDir) ? fs4.readdirSync(paths.translationsDir).filter((f) => f.endsWith(".json")).sort() : [];
+  const summary = {
+    module: {
+      code: manifest.code,
+      displayName: manifest.displayName,
+      version: manifest.version,
+      dependencies: manifest.dependencies ?? {},
+      auditHistory: manifest.auditHistory,
+      kind: manifest.kind,
+      tags: manifest.tags
+    },
+    entities: entitySummaries,
+    views: viewSummaries,
+    folders: { tree: foldersTree, depth: folderDepth },
+    menus: menuSummaries,
+    roles: roleSummaries,
+    actions: actionSummaries,
+    reports,
+    settings,
+    jobs,
+    seedFiles,
+    translations
+  };
+  return {
+    summary: `Module '${manifest.code}' v${manifest.version}: ${entitySummaries.length} entities, ${viewSummaries.length} views, ${roleSummaries.length} roles, ${actionSummaries.length} actions, ${reports.length} reports.`,
+    files: { "_inspect.json": JSON.stringify(summary, null, "	") + "\n" }
+  };
+}
+function computeDepth(folder, current = 1) {
+  const children = folder.children;
+  if (!children) return current;
+  const childDepths = Object.values(children).map(
+    (c) => computeDepth(c, current + 1)
+  );
+  return childDepths.length === 0 ? current : Math.max(...childDepths);
+}
+
+// src/resources/index.ts
+var fs5 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
+var RESOURCES_DIR = path7.resolve(__dirname, "..", "resources");
 function schema(name, label, description) {
   return {
     uri: `dforge://schema/${name}`,
@@ -31443,13 +32014,13 @@ var resources = [
     read: () => readVendored("docs/conventions.md")
   }
 ];
-function readVendored(rel) {
-  const p = path3.join(RESOURCES_DIR, rel);
-  if (!fs3.existsSync(p)) {
-    return `// Resource missing at build time: ${rel}
+function readVendored(rel2) {
+  const p = path7.join(RESOURCES_DIR, rel2);
+  if (!fs5.existsSync(p)) {
+    return `// Resource missing at build time: ${rel2}
 // Run scripts/vendor-resources.sh in dforge-mcp to refresh from dForge-core.`;
   }
-  return fs3.readFileSync(p, "utf8");
+  return fs5.readFileSync(p, "utf8");
 }
 
 // src/server.ts
@@ -31457,9 +32028,26 @@ var server = new McpServer({
   name: "dforge-mcp",
   version: "0.1.0"
 });
+function envelope(fn) {
+  return async (args) => {
+    try {
+      const r = fn(args);
+      return {
+        content: [{ type: "text", text: JSON.stringify(r, null, 2) }]
+      };
+    } catch (e) {
+      return {
+        content: [
+          { type: "text", text: `Error: ${e.message}` }
+        ],
+        isError: true
+      };
+    }
+  };
+}
 server.tool(
   "dforge_module_create",
-  "Build the file map for a brand-new dForge module. Returns { files: { '<relPath>': '<contents>' } } \u2014 the client decides whether to write them. Always preview the file map with the user before writing.",
+  "PHASE 1: Build the file map for a brand-new dForge module. Returns { files: { '<relPath>': '<contents>' } } \u2014 the client decides whether to write them. Always preview the file map with the user before writing.",
   createModuleSchema,
   async (args) => {
     const files = createModuleFiles(args);
@@ -31480,9 +32068,36 @@ server.tool(
     };
   }
 );
+server.tool(
+  "dforge_module_inspect",
+  "Read the current state of an existing module from disk and return a structured summary. Call this BEFORE any patch tool so you know what entities/views/roles already exist and don't try to re-create them.",
+  moduleInspectSchema,
+  envelope(moduleInspect)
+);
+server.tool(
+  "dforge_module_pack",
+  "Pack a module directory into a .dforge tarball. Requires the dforge-cli native binary on PATH (or set DFORGE_CLI_BINARY).",
+  packModuleSchema,
+  async (args) => {
+    const result = packModule(args);
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  }
+);
+server.tool(
+  "dforge_module_install",
+  "PHASE 6: Install a module (directory or .dforge tarball) to a running tenant. Runs the FULL server-side validator \u2014 the only real validator. Reads DFORGE_URL / DFORGE_TOKEN env if not passed as args.",
+  installModuleSchema,
+  async (args) => {
+    const result = installModule(args);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+      isError: !result.ok
+    };
+  }
+);
 server.tool(
   "dforge_entity_add",
-  "Add an entity to an existing module. Reads manifest from disk, returns the updated file map (manifest + new entity + regenerated UI/security). Other files on disk are NOT touched.",
+  "PHASE 2: Add an entity to an existing module. Reads manifest from disk, returns the updated file map (manifest + new entity + regenerated UI/security). Other files on disk are NOT touched.",
   addEntitySchema,
   async (args) => {
     const { files, warning } = addEntityFiles(args);
@@ -31492,7 +32107,7 @@ server.tool(
           type: "text",
           text: JSON.stringify(
             {
-              summary: `Adds entity '${args.entity.name}' to ${args.moduleDir}. ${Object.keys(files).length} files changed.`,
+              summary: `Adds entity '${args.entity.name}' to ${args.moduleDir}.`,
               warning,
               files
             },
@@ -31505,27 +32120,76 @@ server.tool(
   }
 );
 server.tool(
-  "dforge_module_pack",
-  "Pack a module directory into a .dforge tarball. Requires the dforge-cli native binary on PATH (or set DFORGE_CLI_BINARY).",
-  packModuleSchema,
-  async (args) => {
-    const result = packModule(args);
-    return {
-      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-    };
-  }
+  "dforge_entity_field_add",
+  "PHASE 2 / backtrack: Add a single new field to an existing entity. Use this (not entity_add) when refining an existing entity \u2014 preserves the rest of the entity definition.",
+  entityFieldAddSchema,
+  envelope(entityFieldAdd)
 );
 server.tool(
-  "dforge_module_install",
-  "Install a module (directory or .dforge tarball) to a running tenant. Reads DFORGE_URL / DFORGE_TOKEN env if not passed as args.",
-  installModuleSchema,
-  async (args) => {
-    const result = installModule(args);
-    return {
-      content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-      isError: !result.ok
-    };
-  }
+  "dforge_entity_field_modify",
+  "PHASE 2 / backtrack: Replace an existing field's spec on an entity. Pass the full desired field shape, not a partial diff.",
+  entityFieldModifySchema,
+  envelope(entityFieldModify)
+);
+server.tool(
+  "dforge_entity_field_remove",
+  "PHASE 2 / backtrack: Remove a field from an entity. WARNING: may break dependent views, role rights, formulas, action DSL, seed data \u2014 re-run dforge_module_inspect after.",
+  entityFieldRemoveSchema,
+  envelope(entityFieldRemove)
+);
+server.tool(
+  "dforge_action_add",
+  "PHASE 3: Add a DSL action targeting an entity. Writes logic/actions/<code>.dsl plus an entry in ui/actions.json. Phase 3 is optional \u2014 only call when business logic genuinely requires custom actions.",
+  actionAddSchema,
+  envelope(actionAdd)
+);
+server.tool(
+  "dforge_view_add",
+  "PHASE 4: Add a data view to ui/data_views.json. viewType-specific viewConfig is supplied verbatim \u2014 pull dforge://schema/data-views first to know the shape.",
+  viewAddSchema,
+  envelope(viewAdd)
+);
+server.tool(
+  "dforge_view_modify",
+  "PHASE 4 / backtrack: Replace an existing view spec. Pass the full desired shape.",
+  viewModifySchema,
+  envelope(viewModify)
+);
+server.tool(
+  "dforge_report_add",
+  "PHASE 4: Add a report to ui/reports.json. Read dforge://schema/reports for the layout/datasets/parameters shape.",
+  reportAddSchema,
+  envelope(reportAdd)
+);
+server.tool(
+  "dforge_setting_add",
+  "PHASE 4 (polish): Add a configurable module-level setting to settings.json. Settings are folder-scoped at runtime \u2014 values inherit through the folder tree.",
+  settingAddSchema,
+  envelope(settingAdd)
+);
+server.tool(
+  "dforge_role_add",
+  "PHASE 5: Add a role to security/roles.json. Roles are namespaced (e.g. 'crm.admin'). Rights are S/I/U/D/C for entities, E for actions/reports.",
+  roleAddSchema,
+  envelope(roleAdd)
+);
+server.tool(
+  "dforge_role_right_set",
+  "PHASE 5 / backtrack: Grant or revoke a single right on a single object for a role. Cheaper than role_add when iterating on rights matrix.",
+  roleRightSetSchema,
+  envelope(roleRightSet)
+);
+server.tool(
+  "dforge_folder_add",
+  "PHASE 5 (optional): Add a sub-folder to ui/folders.json. Folders are SECURITY boundaries (row-level filters + per-folder role mappings). Most modules don't need any beyond the root \u2014 only use when intake said data must be separated per folder.",
+  folderAddSchema,
+  envelope(folderAdd)
+);
+server.tool(
+  "dforge_dependency_add",
+  "Add a dependency on another dForge module to manifest.json. Use the entities list form when only specific entities are imported (smaller coupling).",
+  dependencyAddSchema,
+  envelope(dependencyAdd)
 );
 server.tool(
   "dforge_dbml_import",