@enfyra/mcp-server 0.1.13 → 0.1.15

package/src/lib/required-knowledge.js

@@ -1,188 +0,0 @@
-export const GLOBAL_RULES_ACK_KEY = 'EFYRA::GLOBAL-RULES::UNIQUE-FIELDS-ARE-INDEXED::2bW-20260701B';
-export const DYNAMIC_CODE_KNOWLEDGE_ACK_KEY = 'EFYRA::SECURE-REPO-CONTRACT::R9x-kelp-42Q::NO-RAW-TRUSTED';
-export const EXTENSION_KNOWLEDGE_ACK_KEY = 'EFYRA::EXTENSION-THEME-CONTRACT::VIOLET-IS-NOT-A-PLAN::7mQ';
-
-const REQUIRED_KNOWLEDGE_VERSION = '2026-07-01.global-rules-v2';
-
-export function globalRulesAckParam(z) {
-  return z.string().describe('Required global-rules acknowledgement key from get_enfyra_required_knowledge. Call that tool, read the global Enfyra MCP rules, then pass globalRulesAckKey exactly.');
-}
-
-export function dynamicCodeKnowledgeAckParam(z) {
-  return z.string().describe('Required dynamic-code acknowledgement key from get_enfyra_required_knowledge. Call that tool, read the dynamic server code knowledge, then pass dynamicCodeAckKey exactly.');
-}
-
-export function extensionKnowledgeAckParam(z) {
-  return z.string().describe('Required extension acknowledgement key from get_enfyra_required_knowledge. Call that tool, read the extension/theme knowledge, then pass extensionAckKey exactly.');
-}
-
-export function assertGlobalRulesAck(key) {
-  if (key !== GLOBAL_RULES_ACK_KEY) {
-    throw new Error('Missing or invalid global-rules acknowledgement. Call get_enfyra_required_knowledge, read the global Enfyra MCP rules, then pass globalRulesAckKey as globalRulesAckKey.');
-  }
-}
-
-export function assertGlobalRulesAckIf(condition, key) {
-  if (condition) assertGlobalRulesAck(key);
-}
-
-export function assertDynamicCodeKnowledgeAck(key) {
-  if (key !== DYNAMIC_CODE_KNOWLEDGE_ACK_KEY) {
-    throw new Error('Missing or invalid dynamic-code knowledge acknowledgement. Call get_enfyra_required_knowledge, read the dynamic server code contracts, then pass dynamicCodeAckKey as knowledgeAckKey.');
-  }
-}
-
-export function assertDynamicCodeKnowledgeAckIf(condition, key) {
-  if (condition) assertDynamicCodeKnowledgeAck(key);
-}
-
-export function assertExtensionKnowledgeAck(key) {
-  if (key !== EXTENSION_KNOWLEDGE_ACK_KEY) {
-    throw new Error('Missing or invalid extension knowledge acknowledgement. Call get_enfyra_required_knowledge, read the extension/theme contracts, then pass extensionAckKey as extensionKnowledgeAckKey.');
-  }
-}
-
-export function assertExtensionKnowledgeAckIf(condition, key) {
-  if (condition) assertExtensionKnowledgeAck(key);
-}
-
-export function buildRequiredKnowledgePayload() {
-  return {
-    version: REQUIRED_KNOWLEDGE_VERSION,
-    purpose: 'Read this before mutating Enfyra metadata, schema, routes, permissions, menus, packages, cache state, dynamic server code, or extension UI through MCP.',
-    globalRulesAckKey: GLOBAL_RULES_ACK_KEY,
-    dynamicCodeAckKey: DYNAMIC_CODE_KNOWLEDGE_ACK_KEY,
-    extensionAckKey: EXTENSION_KNOWLEDGE_ACK_KEY,
-    usage: [
-      'Pass globalRulesAckKey exactly as globalRulesAckKey when calling MCP tools that mutate Enfyra metadata, schema, routes, permissions, menus, packages, cache state, dynamic code, or extension UI.',
-      'Pass dynamicCodeAckKey exactly as knowledgeAckKey when calling MCP tools that create or update dynamic server code.',
-      'Pass extensionAckKey exactly as extensionKnowledgeAckKey when calling MCP tools that create or update Enfyra extension code.',
-    ],
-    globalRules: [
-      {
-        id: 'examples-are-reasoning-anchors',
-        rules: [
-          'Examples explain transferable decisions, not copy-paste mandates.',
-          'Preserve platform contracts and safety boundaries, then adapt names, routes, fields, menus, labels, and lifecycle to live metadata and the user goal.',
-          'When examples use chat, order, report, cloud, email, or support domains, treat those as analogies unless the current task is exactly that domain.',
-        ],
-      },
-      {
-        id: 'discover-before-changing',
-        rules: [
-          'Inspect live metadata/routes/features before schema, route, permission, extension, flow, or handler changes.',
-          'Use narrow inspection tools for the table, route, feature, or script being changed instead of broad discovery after the target is known.',
-          'Read sourceCode, not compiledCode, for editable dynamic scripts.',
-        ],
-      },
-      {
-        id: 'mutations-are-intentional',
-        rules: [
-          'Prefer business operation tools over generic CRUD when a specific tool exists.',
-          'Destructive operations are preview-first; pass confirm=true only after explicit user approval.',
-          'Do not manually reload caches unless natural partial reload is proven stale or a concrete reload error requires it.',
-          'Never fabricate ids, field names, relation names, paths, package names, or permission scopes.',
-        ],
-      },
-      {
-        id: 'schema-constraints',
-        rules: [
-          'For table schema, a field that appears in any uniques group must not appear in indexes.',
-          'A unique constraint already creates the indexed unique lookup for its fields.',
-          'Use uniques for data integrity and indexes only for non-unique query-performance fields that are not already unique.',
-          'Before create_table or update_table with indexes/uniques, inspect the current table and remove indexes that reference unique fields.',
-        ],
-      },
-      {
-        id: 'security-first',
-        rules: [
-          'Treat permission and owner/tenant scope as the first design step for any route, handler, hook, flow, extension, websocket, or data surface.',
-          'Route permission only lets authenticated users reach a route after RoleGuard; handlers, hooks, RLS, and scripts still enforce record ownership and tenant/project scope.',
-          'Do not expose unpublished fields, private relation facts, secret values, token hashes, stack traces, SQL, provider payloads, or generated passwords to user-facing clients.',
-        ],
-      },
-      {
-        id: 'shell-signals',
-        rules: [
-          'For app shell menu/account-panel notifications, decide the signal source before choosing count or dot.',
-          'Use a count only when the shell receives an exact or bounded count from a notification/summary source.',
-          'Use a dot when realtime only proves new attention exists.',
-          'Do not fetch destination domain lists such as messages, tickets, orders, or jobs solely to decorate the menu; the destination page owns domain fetching.',
-        ],
-      },
-    ],
-    dynamicServerCode: [
-      {
-        id: 'secure-vs-trusted-repositories',
-        rules: [
-          '@REPOS.main is the secure repository for the current route main table and preserves normal route query behavior.',
-          '@REPOS.secure.<table> is the secure explicit-table repository. Use it for public/user-facing custom handlers, hooks, websocket scripts, flows that return data, and third-party app integrations.',
-          '@REPOS.<table> is the trusted internal repository. It may read/write hidden fields and is only for server-owned maintenance/admin logic that intentionally needs that access.',
-          'Never return raw trusted-repository records to users. Project or sanitize output before returning it.',
-        ],
-      },
-      {
-        id: 'authorization-is-separate',
-        rules: [
-          'Secure repository selection does not prove the user is allowed to access a record.',
-          'Handlers and hooks still need route access, owner/tenant filters, membership checks, and explicit mutation authorization.',
-          'For canonical table reads and RLS, merge security filters into @QUERY.filter and preserve @QUERY.fields, @QUERY.deep, @QUERY.sort, @QUERY.limit, @QUERY.page, @QUERY.meta, @QUERY.aggregate, and debugMode.',
-        ],
-      },
-      {
-        id: 'hidden-field-query-surfaces',
-        rules: [
-          'Unpublished fields and private relations are sensitive even when the field is not selected.',
-          'Do not expose filter predicate-oracle behavior over hidden fields in user-facing endpoints.',
-          'Do not expose aggregate, _max, _min, _count, sort helpers, or counts over unpublished fields/private relations unless the endpoint intentionally exposes that fact.',
-          'If a normal REST read returns an isPublished=false field through fields/deep/dotted projection, treat it as an Enfyra core bug and verify the minimal REST repro.',
-        ],
-      },
-      {
-        id: 'dynamic-script-shape',
-        rules: [
-          'Use sourceCode and scriptLanguage; never send compiledCode.',
-          'Prefer macros such as @BODY, @QUERY, @PARAMS, @USER, @REQ, @RES, @REPOS, @HELPERS, @STORAGE, @SOCKET, and @THROW* when available.',
-          'Repository reads use filter, not where.',
-          'Create/update repository calls return collection-shaped data arrays; read result.data?.[0] for a single row.',
-        ],
-      },
-    ],
-    extensions: [
-      {
-        id: 'theme-contract-first',
-        rules: [
-          'Call get_extension_theme_contract before writing or reviewing page, widget, or global extension UI.',
-          'Call get_theme_class_reference when an exact eapp-* class or Nuxt UI color mapping is needed.',
-          'Use eapp-surface-*, eapp-text-*, eapp-divide-y, and eapp-divider for neutral app-shell surfaces.',
-          'Use eapp-primary-* or Nuxt UI primary only for runtime-primary identity/accent intent controlled by the app color picker.',
-          'Use semantic state colors only for true status/error/warning/success/info indicators, not for large KPI/list containers.',
-          'Do not use raw CSS variable utilities such as text-[var(...)], bg-[var(...)], or border-[var(...)] when class tokens exist.',
-          'Do not hard-code concrete palettes such as color="violet" or Tailwind palette accents for themeable UI.',
-        ],
-      },
-      {
-        id: 'extension-shell-boundary',
-        rules: [
-          'Extension roots render inside the Enfyra admin app shell. Do not add root-level page padding such as p-4 sm:p-6 xl:p-8.',
-          'Page extensions should be full-bleed by default and responsive from the first version.',
-          'Do not wrap whole pages in decorative cards; use cards only for repeated items, modals, or genuinely framed tools.',
-          'Use NuxtLink or Nuxt UI components with :to for visible navigation links; reserve navigateTo for imperative side effects.',
-          'Admin extension links for record management should point to /data/<table>, not public website paths stored on records.',
-        ],
-      },
-      {
-        id: 'extension-runtime-contract',
-        rules: [
-          'Save extensions as enfyra_extension Vue SFC records; no static import statements in extension code.',
-          'Do not call resolveComponent() in extension SFCs. Use auto-injected components such as <UButton>, <UBadge>, <PermissionGate>, and <Widget> directly in the template so the app/compiler resolves them correctly.',
-          'Load app packages with getPackages(["package-name"]) inside extension runtime code.',
-          'Prefer FormEditor/FormEditorLazy for direct table-backed forms when the form maps to metadata fields.',
-          'For long admin setup workflows, open CommonDrawer immediately and show loading/error/content inside it.',
-          'Use Widget with numeric enfyra_extension widget ids; pass safe reactive props/events and keep page-level mutation ownership in the page unless the widget intentionally owns the workflow.',
-          'Use useMenuNotificationRegistry for sidebar menu counts/dots and useAccountPanelRegistry count/badge fields for account panel notifications; register these from global extensions when they should update across the shell.',
-        ],
-      },
-    ],
-  };
-}

package/src/lib/response-format.js

@@ -1,187 +0,0 @@
-const RESPONSE_FORMAT = 'json+columnar-v1';
-const COLUMNAR_FORMAT = 'columnar-v1';
-const COMPRESSION_STATS_FIELD = 'compressionStats';
-
-function isPlainObject(value) {
-  if (!value || typeof value !== 'object') return false;
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-
-function valueForColumn(record, column) {
-  return Object.prototype.hasOwnProperty.call(record, column) ? record[column] : null;
-}
-
-function collectColumns(records) {
-  const columns = [];
-  const seen = new Set();
-  for (const record of records) {
-    for (const key of Object.keys(record)) {
-      if (seen.has(key)) continue;
-      seen.add(key);
-      columns.push(key);
-    }
-  }
-  return columns;
-}
-
-function toColumnar(value, seen = new WeakSet()) {
-  if (Array.isArray(value)) {
-    if (value.length > 0 && value.every(isPlainObject)) {
-      const columns = collectColumns(value);
-      return {
-        format: COLUMNAR_FORMAT,
-        columns,
-        rows: value.map((record) => columns.map((column) => toColumnar(valueForColumn(record, column), seen))),
-        rowCount: value.length,
-      };
-    }
-    return value.map((item) => toColumnar(item, seen));
-  }
-
-  if (!isPlainObject(value)) return value;
-  if (seen.has(value)) return '[Circular]';
-  seen.add(value);
-
-  const output = {};
-  for (const [key, entry] of Object.entries(value)) {
-    output[key] = toColumnar(entry, seen);
-  }
-  seen.delete(value);
-  return output;
-}
-
-function safeJsonStringify(value) {
-  const seen = new WeakSet();
-  return JSON.stringify(value, (_key, entry) => {
-    if (!entry || typeof entry !== 'object') return entry;
-    if (seen.has(entry)) return '[Circular]';
-    seen.add(entry);
-    return entry;
-  });
-}
-
-function estimateTokens(jsonText) {
-  if (!jsonText) return 0;
-  return Math.ceil(jsonText.length / 4);
-}
-
-function buildCompressionStats(originalPayload, candidatePayload, selectedPayload, applied) {
-  const originalTokens = estimateTokens(safeJsonStringify(originalPayload));
-  const candidateTokens = estimateTokens(safeJsonStringify(candidatePayload));
-  const responseTokens = estimateTokens(safeJsonStringify(selectedPayload));
-  const candidateSavedTokens = originalTokens - candidateTokens;
-  const candidateSavedPercent = originalTokens > 0
-    ? Number(((candidateSavedTokens / originalTokens) * 100).toFixed(2))
-    : 0;
-  const savedTokens = originalTokens - responseTokens;
-  const savedPercent = originalTokens > 0
-    ? Number(((savedTokens / originalTokens) * 100).toFixed(2))
-    : 0;
-  return {
-    originalTokens,
-    compactTokens: responseTokens,
-    savedTokens,
-    savedPercent,
-    applied,
-    candidateCompactTokens: candidateTokens,
-    candidateSavedTokens,
-    candidateSavedPercent,
-  };
-}
-
-function attachCompressionStats(originalPayload, candidatePayload, selectedPayload, applied) {
-  if (
-    isPlainObject(selectedPayload)
-    && selectedPayload.responseFormat === RESPONSE_FORMAT
-    && selectedPayload[COMPRESSION_STATS_FIELD]
-  ) {
-    return selectedPayload;
-  }
-  return {
-    ...selectedPayload,
-    [COMPRESSION_STATS_FIELD]: buildCompressionStats(originalPayload, candidatePayload, selectedPayload, applied),
-  };
-}
-
-function wrapPayload(payload) {
-  if (!isPlainObject(payload)) {
-    return {
-      responseFormat: RESPONSE_FORMAT,
-      value: payload,
-    };
-  }
-  return {
-    responseFormat: RESPONSE_FORMAT,
-    ...payload,
-  };
-}
-
-export function formatJsonPayload(payload) {
-  if (
-    isPlainObject(payload)
-    && payload.responseFormat === RESPONSE_FORMAT
-    && payload[COMPRESSION_STATS_FIELD]
-  ) {
-    return payload;
-  }
-
-  const originalPayload = wrapPayload(payload);
-  const columnarPayload = wrapPayload(toColumnar(payload));
-  const originalTokens = estimateTokens(safeJsonStringify(originalPayload));
-  const candidateTokens = estimateTokens(safeJsonStringify(columnarPayload));
-  const shouldApplyColumnar = candidateTokens < originalTokens;
-  const selectedPayload = shouldApplyColumnar ? columnarPayload : originalPayload;
-  return attachCompressionStats(originalPayload, columnarPayload, selectedPayload, shouldApplyColumnar);
-}
-
-export function jsonContent(payload, { pretty = false } = {}) {
-  return {
-    content: [{
-      type: 'text',
-      text: JSON.stringify(formatJsonPayload(payload), null, pretty ? 2 : 0),
-    }],
-  };
-}
-
-function tryParseJson(text) {
-  if (typeof text !== 'string') return null;
-  const trimmed = text.trim();
-  if (!trimmed || !/^[\[{]/.test(trimmed)) return null;
-  try {
-    return JSON.parse(trimmed);
-  } catch {
-    return null;
-  }
-}
-
-function formatContentItem(item) {
-  if (!item || item.type !== 'text') return item;
-  const parsed = tryParseJson(item.text);
-  if (!parsed) return item;
-  return {
-    ...item,
-    text: JSON.stringify(formatJsonPayload(parsed)),
-  };
-}
-
-export function formatToolResult(result) {
-  if (!result || !Array.isArray(result.content)) return result;
-  return {
-    ...result,
-    content: result.content.map(formatContentItem),
-  };
-}
-
-export function installColumnarToolFormatter(server) {
-  const registerTool = server.tool.bind(server);
-  server.tool = (name, description, schema, handler) => {
-    if (typeof handler !== 'function') {
-      return registerTool(name, description, schema, handler);
-    }
-    return registerTool(name, description, schema, async (...args) => {
-      const result = await handler(...args);
-      return formatToolResult(result);
-    });
-  };
-}

package/src/lib/route-guards.js

@@ -1,24 +0,0 @@
-function getId(item) {
-  return item?.id ?? item?._id ?? null;
-}
-
-function sameId(a, b) {
-  return String(a) === String(b);
-}
-
-export function validateMainTableRoutePath(tables, mainTableId, routePath) {
-  const table = tables.find((item) => sameId(getId(item), mainTableId));
-  if (!table) {
-    throw new Error(`Unknown table id "${mainTableId}"`);
-  }
-
-  const canonicalPath = `/${table.name}`;
-  if (routePath !== canonicalPath) {
-    throw new Error(
-      `mainTableId is only allowed for canonical table route "${canonicalPath}". ` +
-      `Omit mainTableId for custom route "${routePath}" and query explicit repos in handlers/hooks.`
-    );
-  }
-
-  return table;
-}

package/src/lib/route-permission-tools.js

@@ -1,160 +0,0 @@
-export function normalizeMethodName(method) {
-  return String(method || '').trim().toUpperCase();
-}
-
-export function normalizeMethodNames(methods) {
-  return [...new Set((methods || []).map(normalizeMethodName).filter(Boolean))];
-}
-
-export function getRecordId(record) {
-  return record?.id ?? record?._id ?? null;
-}
-
-export function getReferenceId(value) {
-  return typeof value === 'object' && value !== null ? getRecordId(value) : value;
-}
-
-export function sameRecordId(a, b) {
-  if (a === null || a === undefined || b === null || b === undefined) return false;
-  return String(a) === String(b);
-}
-
-export function resolveRoleByNameOrId(roles, { roleId, roleName } = {}) {
-  if (roleId && roleName) {
-    throw new Error('Provide roleId or roleName, not both.');
-  }
-  if (!roleId && !roleName) return null;
-  const normalizedRoleName = roleName ? String(roleName).trim().toLowerCase() : null;
-  const role = roles.find((item) => (
-    roleId
-      ? sameRecordId(getRecordId(item), roleId)
-      : String(item?.name || '').trim().toLowerCase() === normalizedRoleName
-  ));
-  if (!role) throw new Error(`Role not found: ${roleId || roleName}`);
-  return role;
-}
-
-export function methodNamesFromRecords(methods, methodIdNameMap = {}) {
-  return normalizeMethodNames((methods || []).map((method) => (
-    method?.name || methodIdNameMap[String(getRecordId(method))] || method
-  )));
-}
-
-export function routeAvailableMethodNames(route, methodIdNameMap = {}) {
-  return methodNamesFromRecords(route?.availableMethods || [], methodIdNameMap);
-}
-
-export function routePublicMethodNames(route, methodIdNameMap = {}) {
-  return methodNamesFromRecords(route?.publicMethods || [], methodIdNameMap);
-}
-
-export function permissionMethodNames(permission, methodIdNameMap = {}) {
-  return methodNamesFromRecords(permission?.methods || [], methodIdNameMap);
-}
-
-export function validateMethodsForRoute(route, methods, methodMap, methodIdNameMap = {}) {
-  const normalizedMethods = normalizeMethodNames(methods);
-  const knownMethods = new Set(Object.keys(methodMap || {}).map(normalizeMethodName));
-  const unknown = normalizedMethods.filter((method) => !knownMethods.has(method));
-  if (unknown.length) {
-    throw new Error(`Unknown enfyra_method.name values: ${unknown.join(', ')}`);
-  }
-
-  const availableMethods = routeAvailableMethodNames(route, methodIdNameMap);
-  if (availableMethods.length) {
-    const unavailable = normalizedMethods.filter((method) => !availableMethods.includes(method));
-    if (unavailable.length) {
-      throw new Error(`Route ${route?.path} does not list methods as available: ${unavailable.join(', ')}. Available: ${availableMethods.join(', ')}`);
-    }
-  }
-
-  return normalizedMethods;
-}
-
-export function sortedIdStrings(values) {
-  return [...new Set((values || []).map((value) => String(getReferenceId(value))).filter(Boolean))].sort();
-}
-
-export function sameIdSet(a, b) {
-  const left = sortedIdStrings(a);
-  const right = sortedIdStrings(b);
-  return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-
-export function routePermissionMatchesScope(permission, { roleId, allowedUserIds } = {}) {
-  const expectedUsers = sortedIdStrings(allowedUserIds);
-  const permissionUsers = sortedIdStrings(permission?.allowedUsers || []);
-  const permissionRoleId = getReferenceId(permission?.role);
-
-  if (roleId && !sameRecordId(permissionRoleId, roleId)) return false;
-  if (!roleId && permissionRoleId !== null && permissionRoleId !== undefined) return false;
-  return sameIdSet(permissionUsers, expectedUsers);
-}
-
-export function findRoutePermission(routePermissions, routeId, scope) {
-  return (routePermissions || []).find((permission) => (
-    sameRecordId(getReferenceId(permission?.route), routeId)
-    && routePermissionMatchesScope(permission, scope)
-  )) || null;
-}
-
-export function mergeMethodNames(existingMethods, requestedMethods, mode = 'merge') {
-  const requested = normalizeMethodNames(requestedMethods);
-  if (mode === 'replace') return requested;
-  return normalizeMethodNames([...normalizeMethodNames(existingMethods), ...requested]);
-}
-
-export function summarizeRoutePermission(permission, methodIdNameMap = {}) {
-  return {
-    id: getRecordId(permission),
-    isEnabled: permission?.isEnabled !== false,
-    description: permission?.description || null,
-    route: permission?.route?.path || permission?.route || null,
-    role: permission?.role ? {
-      id: getReferenceId(permission.role),
-      name: permission.role.name || null,
-    } : null,
-    allowedUsers: (permission?.allowedUsers || []).map((user) => ({
-      id: getReferenceId(user),
-      email: user?.email || null,
-    })),
-    methods: permissionMethodNames(permission, methodIdNameMap),
-  };
-}
-
-export function summarizeRouteAccess(route, routePermissions, methodIdNameMap = {}, expected = {}) {
-  const routeId = getRecordId(route);
-  const permissions = (routePermissions || [])
-    .filter((permission) => sameRecordId(getReferenceId(permission?.route), routeId))
-    .map((permission) => summarizeRoutePermission(permission, methodIdNameMap));
-
-  const expectedMethods = normalizeMethodNames(expected.methods || []);
-  const expectedRoleId = expected.roleId ? String(expected.roleId) : null;
-  const expectedAllowedUsers = sortedIdStrings(expected.allowedUserIds || []);
-  const hasExpectedScope = !!(expectedRoleId || expected.roleRequired || expected.allowedUserIds !== undefined);
-  const matchingPermissions = permissions.filter((permission) => {
-    if (!hasExpectedScope) return true;
-    if (expectedRoleId && String(permission.role?.id) !== expectedRoleId) return false;
-    if (!expectedRoleId && expected.roleRequired && permission.role) return false;
-    if (!sameIdSet(permission.allowedUsers.map((user) => user.id), expectedAllowedUsers)) return false;
-    return true;
-  });
-  const grantedMethods = normalizeMethodNames(matchingPermissions.flatMap((permission) => (
-    permission.isEnabled ? permission.methods : []
-  )));
-
-  return {
-    id: routeId,
-    path: route?.path,
-    isEnabled: route?.isEnabled !== false,
-    availableMethods: routeAvailableMethodNames(route, methodIdNameMap),
-    publicMethods: routePublicMethodNames(route, methodIdNameMap),
-    skipRoleGuardMethods: methodNamesFromRecords(route?.skipRoleGuardMethods || [], methodIdNameMap),
-    permissions,
-    expected: expectedMethods.length ? {
-      methods: expectedMethods,
-      grantedMethods,
-      missingMethods: expectedMethods.filter((method) => !grantedMethods.includes(method)),
-    } : null,
-  };
-}

package/src/lib/source-artifacts.js

@@ -1,82 +0,0 @@
-import { createHash } from 'node:crypto';
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-
-const DEFAULT_PREVIEW_CHARS = 1200;
-const DEFAULT_INLINE_LIMIT = 1400;
-const SOURCE_FIELD_NAMES = new Set([
-  'sourceCode',
-  'code',
-  'compiledCode',
-  'handlerScript',
-  'connectionHandlerScript',
-]);
-
-function sha256(value) {
-  return createHash('sha256').update(String(value), 'utf8').digest('hex');
-}
-
-function safePart(value) {
-  const source = String(value || 'source').trim();
-  return source.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80) || 'source';
-}
-
-function extensionForField(fieldName) {
-  if (fieldName === 'code') return '.vue';
-  return '.js';
-}
-
-export function writeSourceArtifact({ tableName, id, fieldName, source }) {
-  const hash = sha256(source);
-  const dir = join(tmpdir(), 'enfyra-mcp-sources');
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const fileName = [
-    safePart(tableName),
-    safePart(id),
-    safePart(fieldName),
-    hash.slice(0, 12),
-  ].join('-') + extensionForField(fieldName);
-  const path = join(dir, fileName);
-  writeFileSync(path, source, { mode: 0o600 });
-  return {
-    tmpFile: path,
-    length: source.length,
-    sha256: hash,
-    preview: source.length > DEFAULT_PREVIEW_CHARS
-      ? `${source.slice(0, DEFAULT_PREVIEW_CHARS)}...`
-      : source,
-  };
-}
-
-export function compactSourceField({ tableName, id, fieldName, source, alwaysWrite = false }) {
-  if (typeof source !== 'string') return source;
-  if (!alwaysWrite && source.length <= DEFAULT_INLINE_LIMIT) return source;
-  return writeSourceArtifact({ tableName, id, fieldName, source });
-}
-
-export function compactSourceFields(value, { tableName, idField = 'id', alwaysWrite = false } = {}) {
-  if (Array.isArray(value)) {
-    return value.map((item) => compactSourceFields(item, { tableName, idField, alwaysWrite }));
-  }
-  if (!value || typeof value !== 'object') return value;
-
-  const recordId = value[idField] ?? value._id ?? value.id ?? 'record';
-  const out = {};
-  for (const [key, fieldValue] of Object.entries(value)) {
-    if (SOURCE_FIELD_NAMES.has(key) && typeof fieldValue === 'string') {
-      out[key] = compactSourceField({
-        tableName,
-        id: recordId,
-        fieldName: key,
-        source: fieldValue,
-        alwaysWrite,
-      });
-    } else if (fieldValue && typeof fieldValue === 'object') {
-      out[key] = compactSourceFields(fieldValue, { tableName, idField, alwaysWrite });
-    } else {
-      out[key] = fieldValue;
-    }
-  }
-  return out;
-}