@enfyra/mcp-server 0.1.36 → 0.1.38

package/dist/lib/required-knowledge.js

@@ -38,193 +38,228 @@ export function assertExtensionKnowledgeAckIf(condition, key) {
     if (condition)
         assertExtensionKnowledgeAck(key);
 }
-export function buildRequiredKnowledgePayload() {
-    return {
+export const KNOWLEDGE_SCOPES = ['full', 'schema', 'dynamic-code', 'extension', 'flow'];
+function requireScope(scope) {
+    const s = (scope || '').trim().toLowerCase();
+    if (KNOWLEDGE_SCOPES.includes(s))
+        return s;
+    return 'full';
+}
+const GLOBAL_RULES_SECTIONS = [
+    {
+        id: 'examples-are-reasoning-anchors',
+        rules: [
+            'Examples explain transferable decisions, not copy-paste mandates.',
+            'Preserve platform contracts and safety boundaries, then adapt names, routes, fields, menus, labels, and lifecycle to live metadata and the user goal.',
+            'When examples use chat, order, report, cloud, email, or support domains, treat those as analogies unless the current task is exactly that domain.',
+        ],
+    },
+    {
+        id: 'discover-before-changing',
+        rules: [
+            'Inspect live metadata/routes/features before schema, route, permission, extension, flow, or handler changes.',
+            'Use narrow inspection tools for the table, route, feature, or script being changed instead of broad discovery after the target is known.',
+            'When the thing to find lives in DB-backed runtime state rather than repo files, use search_admin_extensions for admin UI or search_runtime_zone for other runtime zones before raw query_table or broad trace tools.',
+            'Read sourceCode, not compiledCode, for editable dynamic scripts.',
+            'Read code, not sourceCode, for editable enfyra_extension Vue SFC records. sourceCode is for dynamic server scripts; extension UI should be located with search_admin_extensions and edited with patch_extension_code/update_extension_code.',
+        ],
+    },
+    {
+        id: 'runtime-zone-locators',
+        rules: [
+            'Use search_admin_extensions for menu + extension UI: page extensions, widget extensions, global shell extensions, menu chips, account panel entries, visible buttons, labels, icons, tabs, and blocks.',
+            'Use search_runtime_zone as the zone search/inspect tool for non-admin-UI DB-backed artifacts.',
+            'Search first, then inspect with nextInspect.input before editing.',
+            'Use search_runtime_zone with zone=api_runtime for routes, handlers, pre-hooks, post-hooks, guards, guard rules, and route permissions.',
+            'Use search_runtime_zone with zone=flow_runtime for flows and flow steps.',
+            'Use search_runtime_zone with zone=websocket_runtime for websocket gateways and events.',
+            'Use search_runtime_zone with zone=graphql_runtime for GraphQL exposure and resolver source.',
+            'Use search_runtime_zone with zone=schema_data for tables, columns, relations, field permissions, and column rules.',
+            'Use search_runtime_zone with zone=package_runtime for installed app/server packages.',
+            'Use search_runtime_zone with zone=storage_file for storage configs, folders, files, public asset state, and file permissions.',
+            'Use search_runtime_zone with zone=auth_security for roles, route permissions, field permissions, guards, OAuth configs, and access surfaces.',
+            'After search_runtime_zone mode=search, call search_runtime_zone mode=inspect with the returned nextInspect.input before editing source or metadata.',
+            'Use zone-specific write tools after inspection; do not mutate DB-backed runtime artifacts with generic CRUD when a business operation tool exists.',
+        ],
+    },
+    {
+        id: 'mutations-are-intentional',
+        rules: [
+            'Prefer business operation tools over generic CRUD when a specific tool exists.',
+            'Destructive operations are preview-first; pass confirm=true only after explicit user approval.',
+            'Do not manually reload caches unless natural partial reload is proven stale or a concrete reload error requires it.',
+            'Never fabricate ids, field names, relation names, paths, package names, or permission scopes.',
+        ],
+    },
+    {
+        id: 'schema-constraints',
+        rules: [
+            'Before creating a multi-table app, call get_schema_design_context first. Use its liveColumnTypes, createTableInput, columnDefinitionInput, relationDefinitionInput, and recommendedSequence instead of guessing metadata attributes.',
+            'Then call get_enfyra_examples with category=schema-relations only for reasoning patterns, not for domain-specific table names.',
+            'Use plural mutation tools for writes: create_tables/update_tables/delete_tables, create_columns/update_columns/delete_columns, create_relations/delete_relations, and create_records/update_records/delete_records. Pass native JSON arrays; use one item in the array for a single mutation.',
+            'Create entity tables with scalar columns first, then add relations once target tables exist. create_tables defers relation creation until all tables in the same batch exist.',
+            'Do not declare id, _id, createdAt, or updatedAt columns; Enfyra manages them automatically.',
+            'For one-pass relation-based unique/index constraints, declare the owning relations in the same create_tables item as the constraints. If relations already exist or will be created separately, add those constraints afterward with update_tables.',
+            'Use live Enfyra column types, not SQL dialect names. Common safe choices: varchar for short text, text/richtext for long prose, float for price/amount/rating/decimal-like values, int/bigint for counts, boolean, date/datetime/timestamp, enum, simple-json for structured objects/arrays when listed by live metadata, and code for source fields.',
+            'Do not use json/jsonb/longtext/decimal unless the live enfyra_column.type enum lists them. The MCP schema tools normalize common aliases where possible and return schemaNormalization.',
+            'Use Enfyra relations instead of scalar FK/id columns for normalized links. Do not create fields such as userId, course_id, categoryIds, authorId, or JSON arrays of related ids unless the user explicitly asks for denormalized snapshots.',
+            'If the app must deep-read a parent with child collections, create the child owning relation with inversePropertyName from the start; otherwise parent.deepChild queries will fail until an inverse relation is added.',
+            'When inserting/updating records with relations, use relation propertyName values in the body, not hidden physical FK columns. Inspect the table to learn propertyName values.',
+            'For record writes, always use create_records/update_records/delete_records with native array inputs; these tools validate every item against live metadata before posting/patching/deleting sequentially.',
+            'For reads, query_table accepts native object filter/deep/aggregate values. Deep keys are relation names; query_table auto-adds missing top-level deep relation keys to fields so nested records can appear. Inside deep, use fields/filter/sort/limit/page/deep; never use _fields.',
+            'Filters use Enfyra operators, not SQL operators. Use _contains, _starts_with, or _ends_with for text matching; do not use _like.',
+            'This auto-add behavior is MCP query_table only. Inside dynamic server scripts, repository find({ deep }) requires the relation property to also be present in top-level fields, otherwise row.<relation> may be undefined.',
+            'For table schema, a field that appears in any uniques group, including composite unique groups such as ["event","attendee"], must not appear in indexes.',
+            'A unique constraint already creates the indexed unique lookup for its fields, so do not add separate indexes for those same fields.',
+            'Use uniques for data integrity and indexes only for non-unique query-performance fields that are not already unique.',
+            'create_tables preflights all items before posting tables and rejects unique/index overlap for the whole batch; update_tables applies the same guard before patching constraints.',
+            'Before update_tables with indexes/uniques, inspect the current table and remove indexes that reference unique fields.',
+            'query_table always requires limit or all=true. Use meta=filterCount/totalCount or count_records for counts. Do not guess aggregate operators such as _sum/_count; call discover_query_capabilities first when an aggregate object is needed.',
+            'Run schema mutation calls through the plural tools; they serialize work internally. Do not parallelize schema mutation tool calls.',
+        ],
+    },
+    {
+        id: 'security-first',
+        rules: [
+            'Treat permission and owner/tenant scope as the first design step for any route, handler, hook, flow, extension, websocket, or data surface.',
+            'Route permission only lets authenticated users reach a route after RoleGuard; handlers, hooks, RLS, and scripts still enforce record ownership and tenant/project scope.',
+            'Do not expose unpublished fields, private relation facts, secret values, token hashes, stack traces, SQL, provider payloads, or generated passwords to user-facing clients.',
+        ],
+    },
+    {
+        id: 'shell-signals',
+        rules: [
+            'For app shell menu/account-panel notifications, decide the signal source before choosing count or dot.',
+            'Use a count only when the shell receives an exact or bounded count from a notification/summary source.',
+            'Use a dot when realtime only proves new attention exists.',
+            'Do not fetch destination domain lists such as messages, tickets, orders, or jobs solely to decorate the menu; the destination page owns domain fetching.',
+        ],
+    },
+];
+const DYNAMIC_CODE_SECTIONS = [
+    {
+        id: 'secure-vs-trusted-repositories',
+        rules: [
+            '@REPOS.main is the secure repository for the current route main table and preserves normal route query behavior.',
+            '@REPOS.secure.<table> is not portable across current Enfyra runtimes and MCP save tools reject it before saving sourceCode.',
+            'For explicit-table custom handlers, use #table_name or @REPOS.<table> with exact fields, relation filters, explicit authorization checks, and shaped/sanitized output.',
+            '@REPOS.<table> is the trusted internal repository. It may read/write hidden fields, so never return raw rows or broad projections.',
+            'Never return raw trusted-repository records to users. Project or sanitize output before returning it.',
+        ],
+    },
+    {
+        id: 'authorization-is-separate',
+        rules: [
+            'Secure repository selection does not prove the user is allowed to access a record.',
+            'Handlers and hooks still need route access, owner/tenant filters, membership checks, and explicit mutation authorization.',
+            'For canonical table reads and RLS, merge security filters into @QUERY.filter and preserve @QUERY.fields, @QUERY.deep, @QUERY.sort, @QUERY.limit, @QUERY.page, @QUERY.meta, @QUERY.aggregate, and debugMode.',
+        ],
+    },
+    {
+        id: 'hidden-field-query-surfaces',
+        rules: [
+            'Unpublished fields and private relations are sensitive even when the field is not selected.',
+            'Do not expose filter predicate-oracle behavior over hidden fields in user-facing endpoints.',
+            'Do not expose aggregate, _max, _min, _count, sort helpers, or counts over unpublished fields/private relations unless the endpoint intentionally exposes that fact.',
+            'If a normal REST read returns an isPublished=false field through fields/deep/dotted projection, treat it as an Enfyra core bug and verify the minimal REST repro.',
+        ],
+    },
+    {
+        id: 'dynamic-script-shape',
+        rules: [
+            'Use sourceCode and scriptLanguage; never send compiledCode.',
+            'Prefer macros such as @BODY, @QUERY, @PARAMS, @USER, @REQ, @RES, @REPOS, @HELPERS, @STORAGE, @SOCKET, and @THROW* when available.',
+            'Repository reads use filter, not where.',
+            'For dynamic file upload progress, clients send x-enfyra-upload-id on authenticated multipart requests and listen for $system:upload:progress; @STORAGE.$upload and blob-replacing @STORAGE.$update do not accept onProgress.',
+            'Inside dynamic scripts, prefer #table_name.find with limit:1 and explicit fields for one-record lookups. If a primary-key id filter fails in a runtime, fetch a small bounded candidate set by a unique business field or use the canonical route/main-table context; do not keep retrying @REPOS.<table>.find id filter shapes.',
+            'Relation filters use relation propertyName values, not physical FK-shaped names. Use { incident: { id: { _eq: id } } }, not { incidentId: { _eq: id } }.',
+            'Do not use @REPOS.secure.<table> or @REPOS.secure["table"] in generated sourceCode; use @REPOS.main when the route has a main table or #table_name/@REPOS.table_name with explicit fields and auth checks.',
+            'When using repository find({ deep }) in handlers/hooks/flows, include each deep relation name in top-level fields, then choose nested fields under deep.<relation>.fields.',
+            'Repository calls are async. Always await #table.find/create/update/delete/exists and @REPOS.table.find/create/update/delete/exists; reads return { data: [...], meta? }.',
+            'Create/update repository calls return collection-shaped data arrays; read result.data?.[0] for a single row.',
+            'For intentional HTTP errors, numeric helpers are raw HTTP message helpers: @THROW400(message), @THROW404(message), @THROW409(message), @THROW422(message, detailsObject?), @THROW500(message).',
+            'When numeric helpers include details, pass an object or array such as @THROW404("Project not found", { id }); do not use @THROW404("Project", id) as a semantic shortcut.',
+            'Use @THROW.http(status, message, details?) for dynamic status codes. Use @THROW.notFound(resource, id?) and @THROW.duplicate(resource, field, value) only when you intentionally want Enfyra-formatted semantic messages.',
+        ],
+    },
+];
+const EXTENSION_SECTIONS = [
+    {
+        id: 'theme-contract-first',
+        rules: [
+            'Call get_extension_theme_contract before writing or reviewing page, widget, or global extension UI.',
+            'Call get_theme_class_reference when an exact eapp-* class or Nuxt UI color mapping is needed.',
+            'Use eapp-surface-*, eapp-text-*, eapp-divide-y, and eapp-divider for neutral app-shell surfaces.',
+            'Use eapp-primary-* or Nuxt UI primary only for runtime-primary identity/accent intent controlled by the app color picker.',
+            'Use semantic state colors only for true status/error/warning/success/info indicators, not for large KPI/list containers.',
+            'Do not use raw CSS variable utilities such as text-[var(...)], bg-[var(...)], or border-[var(...)] when class tokens exist.',
+            'Do not hard-code concrete palettes such as color="violet" or Tailwind palette accents for themeable UI.',
+        ],
+    },
+    {
+        id: 'extension-shell-boundary',
+        rules: [
+            'Extension roots render inside the Enfyra admin app shell. Do not add root-level page padding such as p-4 sm:p-6 xl:p-8.',
+            'Page extensions should be full-bleed by default and responsive from the first version.',
+            'Do not wrap whole pages in decorative cards; use cards only for repeated items, modals, or genuinely framed tools.',
+            'Use NuxtLink or Nuxt UI components with :to for visible navigation links; reserve navigateTo for imperative side effects.',
+            'Admin extension links for record management should point to /data/<table>, not public website paths stored on records.',
+        ],
+    },
+    {
+        id: 'extension-runtime-contract',
+        rules: [
+            'Save extensions as enfyra_extension Vue SFC records; no static import statements in extension code.',
+            'Editable extension source is enfyra_extension.code. Do not request or write enfyra_extension.sourceCode.',
+            'Do not call resolveComponent() in extension SFCs. Use auto-injected components such as <UButton>, <UBadge>, <PermissionGate>, and <Widget> directly in the template so the app/compiler resolves them correctly.',
+            'Load app packages with getPackages(["package-name"]) inside extension runtime code.',
+            'Prefer FormEditor/FormEditorLazy for direct table-backed forms when the form maps to metadata fields.',
+            'For long admin setup workflows, open CommonDrawer immediately and show loading/error/content inside it.',
+            'Use Widget with numeric enfyra_extension widget ids; pass safe reactive props/events and keep page-level mutation ownership in the page unless the widget intentionally owns the workflow.',
+            'Use useMenuNotificationRegistry for sidebar menu counts/dots and useAccountPanelRegistry count/badge fields for account panel notifications; register these from global extensions when they should update across the shell.',
+        ],
+    },
+];
+const SCOPED_PURPOSES = {
+    full: 'Read this before mutating Enfyra metadata, schema, routes, permissions, menus, packages, cache state, dynamic server code, or extension UI through MCP.',
+    schema: 'Read this before mutating Enfyra metadata, schema, table data, routes, permissions, guards, or cache state through MCP.',
+    'dynamic-code': 'Read this before writing or mutating dynamic server code (handlers, hooks, flow steps, websocket events, GraphQL resolvers, bootstrap scripts) through MCP.',
+    extension: 'Read this before writing or mutating Enfyra admin extension UI, menus, or shell registrations through MCP.',
+    flow: 'Read this before creating or mutating Enfyra flows and flow steps through MCP.',
+};
+export function buildRequiredKnowledgePayload(scope = 'full') {
+    const resolvedScope = requireScope(scope);
+    const includeGlobal = true;
+    const includeDynamic = resolvedScope === 'full' || resolvedScope === 'dynamic-code' || resolvedScope === 'flow';
+    const includeExtensions = resolvedScope === 'full' || resolvedScope === 'extension';
+    const payload = {
         version: REQUIRED_KNOWLEDGE_VERSION,
-        purpose: 'Read this before mutating Enfyra metadata, schema, routes, permissions, menus, packages, cache state, dynamic server code, or extension UI through MCP.',
+        scope: resolvedScope,
+        purpose: SCOPED_PURPOSES[resolvedScope],
+        includedDomains: ['globalRules', ...(includeDynamic ? ['dynamicServerCode'] : []), ...(includeExtensions ? ['extensions'] : [])],
+        excludedDomains: [...(!includeDynamic ? ['dynamicServerCode'] : []), ...(!includeExtensions ? ['extensions'] : [])],
+        note: 'Ack keys (globalRulesAckKey, dynamicCodeAckKey, extensionAckKey) are always returned so you can use them when needed. Only domains listed in includedDomains have rules loaded. Domains in excludedDomains have NO rules in this response.',
         globalRulesAckKey: GLOBAL_RULES_ACK_KEY,
         dynamicCodeAckKey: DYNAMIC_CODE_KNOWLEDGE_ACK_KEY,
         extensionAckKey: EXTENSION_KNOWLEDGE_ACK_KEY,
         usage: [
             'Pass globalRulesAckKey exactly as globalRulesAckKey when calling MCP tools that mutate Enfyra metadata, schema, routes, permissions, menus, packages, cache state, dynamic code, or extension UI.',
-            'Pass dynamicCodeAckKey exactly as knowledgeAckKey when calling MCP tools that create or update dynamic server code.',
-            'Pass extensionAckKey exactly as extensionKnowledgeAckKey when calling MCP tools that create or update Enfyra extension code.',
-        ],
-        globalRules: [
-            {
-                id: 'examples-are-reasoning-anchors',
-                rules: [
-                    'Examples explain transferable decisions, not copy-paste mandates.',
-                    'Preserve platform contracts and safety boundaries, then adapt names, routes, fields, menus, labels, and lifecycle to live metadata and the user goal.',
-                    'When examples use chat, order, report, cloud, email, or support domains, treat those as analogies unless the current task is exactly that domain.',
-                ],
-            },
-            {
-                id: 'discover-before-changing',
-                rules: [
-                    'Inspect live metadata/routes/features before schema, route, permission, extension, flow, or handler changes.',
-                    'Use narrow inspection tools for the table, route, feature, or script being changed instead of broad discovery after the target is known.',
-                    'When the thing to find lives in DB-backed runtime state rather than repo files, use search_admin_extensions for admin UI or search_runtime_zone for other runtime zones before raw query_table or broad trace tools.',
-                    'Read sourceCode, not compiledCode, for editable dynamic scripts.',
-                    'Read code, not sourceCode, for editable enfyra_extension Vue SFC records. sourceCode is for dynamic server scripts; extension UI should be located with search_admin_extensions and edited with patch_extension_code/update_extension_code.',
-                ],
-            },
-            {
-                id: 'runtime-zone-locators',
-                rules: [
-                    'Use search_admin_extensions for menu + extension UI: page extensions, widget extensions, global shell extensions, menu chips, account panel entries, visible buttons, labels, icons, tabs, and blocks.',
-                    'Use search_runtime_zone as the zone search/inspect tool for non-admin-UI DB-backed artifacts.',
-                    'Search first, then inspect with nextInspect.input before editing.',
-                    'Use search_runtime_zone with zone=api_runtime for routes, handlers, pre-hooks, post-hooks, guards, guard rules, and route permissions.',
-                    'Use search_runtime_zone with zone=flow_runtime for flows and flow steps.',
-                    'Use search_runtime_zone with zone=websocket_runtime for websocket gateways and events.',
-                    'Use search_runtime_zone with zone=graphql_runtime for GraphQL exposure and resolver source.',
-                    'Use search_runtime_zone with zone=schema_data for tables, columns, relations, field permissions, and column rules.',
-                    'Use search_runtime_zone with zone=package_runtime for installed app/server packages.',
-                    'Use search_runtime_zone with zone=storage_file for storage configs, folders, files, public asset state, and file permissions.',
-                    'Use search_runtime_zone with zone=auth_security for roles, route permissions, field permissions, guards, OAuth configs, and access surfaces.',
-                    'After search_runtime_zone mode=search, call search_runtime_zone mode=inspect with the returned nextInspect.input before editing source or metadata.',
-                    'Use zone-specific write tools after inspection; do not mutate DB-backed runtime artifacts with generic CRUD when a business operation tool exists.',
-                ],
-            },
-            {
-                id: 'mutations-are-intentional',
-                rules: [
-                    'Prefer business operation tools over generic CRUD when a specific tool exists.',
-                    'Destructive operations are preview-first; pass confirm=true only after explicit user approval.',
-                    'Do not manually reload caches unless natural partial reload is proven stale or a concrete reload error requires it.',
-                    'Never fabricate ids, field names, relation names, paths, package names, or permission scopes.',
-                ],
-            },
-            {
-                id: 'schema-constraints',
-                rules: [
-                    'Before creating a multi-table app, call get_schema_design_context first. Use its liveColumnTypes, createTableInput, columnDefinitionInput, relationDefinitionInput, and recommendedSequence instead of guessing metadata attributes.',
-                    'Then call get_enfyra_examples with category=schema-relations only for reasoning patterns, not for domain-specific table names.',
-                    'Use plural mutation tools for writes: create_tables/update_tables/delete_tables, create_columns/update_columns/delete_columns, create_relations/delete_relations, and create_records/update_records/delete_records. Pass native JSON arrays; use one item in the array for a single mutation.',
-                    'Create entity tables with scalar columns first, then add relations once target tables exist. create_tables defers relation creation until all tables in the same batch exist.',
-                    'Do not declare id, _id, createdAt, or updatedAt columns; Enfyra manages them automatically.',
-                    'For one-pass relation-based unique/index constraints, declare the owning relations in the same create_tables item as the constraints. If relations already exist or will be created separately, add those constraints afterward with update_tables.',
-                    'Use live Enfyra column types, not SQL dialect names. Common safe choices: varchar for short text, text/richtext for long prose, float for price/amount/rating/decimal-like values, int/bigint for counts, boolean, date/datetime/timestamp, enum, simple-json for structured objects/arrays when listed by live metadata, and code for source fields.',
-                    'Do not use json/jsonb/longtext/decimal unless the live enfyra_column.type enum lists them. The MCP schema tools normalize common aliases where possible and return schemaNormalization.',
-                    'Use Enfyra relations instead of scalar FK/id columns for normalized links. Do not create fields such as userId, course_id, categoryIds, authorId, or JSON arrays of related ids unless the user explicitly asks for denormalized snapshots.',
-                    'If the app must deep-read a parent with child collections, create the child owning relation with inversePropertyName from the start; otherwise parent.deepChild queries will fail until an inverse relation is added.',
-                    'When inserting/updating records with relations, use relation propertyName values in the body, not hidden physical FK columns. Inspect the table to learn propertyName values.',
-                    'For record writes, always use create_records/update_records/delete_records with native array inputs; these tools validate every item against live metadata before posting/patching/deleting sequentially.',
-                    'For reads, query_table accepts native object filter/deep/aggregate values. Deep keys are relation names; query_table auto-adds missing top-level deep relation keys to fields so nested records can appear. Inside deep, use fields/filter/sort/limit/page/deep; never use _fields.',
-                    'Filters use Enfyra operators, not SQL operators. Use _contains, _starts_with, or _ends_with for text matching; do not use _like.',
-                    'This auto-add behavior is MCP query_table only. Inside dynamic server scripts, repository find({ deep }) requires the relation property to also be present in top-level fields, otherwise row.<relation> may be undefined.',
-                    'For table schema, a field that appears in any uniques group, including composite unique groups such as ["event","attendee"], must not appear in indexes.',
-                    'A unique constraint already creates the indexed unique lookup for its fields, so do not add separate indexes for those same fields.',
-                    'Use uniques for data integrity and indexes only for non-unique query-performance fields that are not already unique.',
-                    'create_tables preflights all items before posting tables and rejects unique/index overlap for the whole batch; update_tables applies the same guard before patching constraints.',
-                    'Before update_tables with indexes/uniques, inspect the current table and remove indexes that reference unique fields.',
-                    'query_table always requires limit or all=true. Use meta=filterCount/totalCount or count_records for counts. Do not guess aggregate operators such as _sum/_count; call discover_query_capabilities first when an aggregate object is needed.',
-                    'Run schema mutation calls through the plural tools; they serialize work internally. Do not parallelize schema mutation tool calls.',
-                ],
-            },
-            {
-                id: 'security-first',
-                rules: [
-                    'Treat permission and owner/tenant scope as the first design step for any route, handler, hook, flow, extension, websocket, or data surface.',
-                    'Route permission only lets authenticated users reach a route after RoleGuard; handlers, hooks, RLS, and scripts still enforce record ownership and tenant/project scope.',
-                    'Do not expose unpublished fields, private relation facts, secret values, token hashes, stack traces, SQL, provider payloads, or generated passwords to user-facing clients.',
-                ],
-            },
-            {
-                id: 'shell-signals',
-                rules: [
-                    'For app shell menu/account-panel notifications, decide the signal source before choosing count or dot.',
-                    'Use a count only when the shell receives an exact or bounded count from a notification/summary source.',
-                    'Use a dot when realtime only proves new attention exists.',
-                    'Do not fetch destination domain lists such as messages, tickets, orders, or jobs solely to decorate the menu; the destination page owns domain fetching.',
-                ],
-            },
-        ],
-        dynamicServerCode: [
-            {
-                id: 'secure-vs-trusted-repositories',
-                rules: [
-                    '@REPOS.main is the secure repository for the current route main table and preserves normal route query behavior.',
-                    '@REPOS.secure.<table> is not portable across current Enfyra runtimes and MCP save tools reject it before saving sourceCode.',
-                    'For explicit-table custom handlers, use #table_name or @REPOS.<table> with exact fields, relation filters, explicit authorization checks, and shaped/sanitized output.',
-                    '@REPOS.<table> is the trusted internal repository. It may read/write hidden fields, so never return raw rows or broad projections.',
-                    'Never return raw trusted-repository records to users. Project or sanitize output before returning it.',
-                ],
-            },
-            {
-                id: 'authorization-is-separate',
-                rules: [
-                    'Secure repository selection does not prove the user is allowed to access a record.',
-                    'Handlers and hooks still need route access, owner/tenant filters, membership checks, and explicit mutation authorization.',
-                    'For canonical table reads and RLS, merge security filters into @QUERY.filter and preserve @QUERY.fields, @QUERY.deep, @QUERY.sort, @QUERY.limit, @QUERY.page, @QUERY.meta, @QUERY.aggregate, and debugMode.',
-                ],
-            },
-            {
-                id: 'hidden-field-query-surfaces',
-                rules: [
-                    'Unpublished fields and private relations are sensitive even when the field is not selected.',
-                    'Do not expose filter predicate-oracle behavior over hidden fields in user-facing endpoints.',
-                    'Do not expose aggregate, _max, _min, _count, sort helpers, or counts over unpublished fields/private relations unless the endpoint intentionally exposes that fact.',
-                    'If a normal REST read returns an isPublished=false field through fields/deep/dotted projection, treat it as an Enfyra core bug and verify the minimal REST repro.',
-                ],
-            },
-            {
-                id: 'dynamic-script-shape',
-                rules: [
-                    'Use sourceCode and scriptLanguage; never send compiledCode.',
-                    'Prefer macros such as @BODY, @QUERY, @PARAMS, @USER, @REQ, @RES, @REPOS, @HELPERS, @STORAGE, @SOCKET, and @THROW* when available.',
-                    'Repository reads use filter, not where.',
-                    'For dynamic file upload progress, clients send x-enfyra-upload-id on authenticated multipart requests and listen for $system:upload:progress; @STORAGE.$upload and blob-replacing @STORAGE.$update do not accept onProgress.',
-                    'Inside dynamic scripts, prefer #table_name.find with limit:1 and explicit fields for one-record lookups. If a primary-key id filter fails in a runtime, fetch a small bounded candidate set by a unique business field or use the canonical route/main-table context; do not keep retrying @REPOS.<table>.find id filter shapes.',
-                    'Relation filters use relation propertyName values, not physical FK-shaped names. Use { incident: { id: { _eq: id } } }, not { incidentId: { _eq: id } }.',
-                    'Do not use @REPOS.secure.<table> or @REPOS.secure["table"] in generated sourceCode; use @REPOS.main when the route has a main table or #table_name/@REPOS.table_name with explicit fields and auth checks.',
-                    'When using repository find({ deep }) in handlers/hooks/flows, include each deep relation name in top-level fields, then choose nested fields under deep.<relation>.fields.',
-                    'Repository calls are async. Always await #table.find/create/update/delete/exists and @REPOS.table.find/create/update/delete/exists; reads return { data: [...], meta? }.',
-                    'Create/update repository calls return collection-shaped data arrays; read result.data?.[0] for a single row.',
-                    'For intentional HTTP errors, numeric helpers are raw HTTP message helpers: @THROW400(message), @THROW404(message), @THROW409(message), @THROW422(message, detailsObject?), @THROW500(message).',
-                    'When numeric helpers include details, pass an object or array such as @THROW404("Project not found", { id }); do not use @THROW404("Project", id) as a semantic shortcut.',
-                    'Use @THROW.http(status, message, details?) for dynamic status codes. Use @THROW.notFound(resource, id?) and @THROW.duplicate(resource, field, value) only when you intentionally want Enfyra-formatted semantic messages.',
-                ],
-            },
-        ],
-        extensions: [
-            {
-                id: 'theme-contract-first',
-                rules: [
-                    'Call get_extension_theme_contract before writing or reviewing page, widget, or global extension UI.',
-                    'Call get_theme_class_reference when an exact eapp-* class or Nuxt UI color mapping is needed.',
-                    'Use eapp-surface-*, eapp-text-*, eapp-divide-y, and eapp-divider for neutral app-shell surfaces.',
-                    'Use eapp-primary-* or Nuxt UI primary only for runtime-primary identity/accent intent controlled by the app color picker.',
-                    'Use semantic state colors only for true status/error/warning/success/info indicators, not for large KPI/list containers.',
-                    'Do not use raw CSS variable utilities such as text-[var(...)], bg-[var(...)], or border-[var(...)] when class tokens exist.',
-                    'Do not hard-code concrete palettes such as color="violet" or Tailwind palette accents for themeable UI.',
-                ],
-            },
-            {
-                id: 'extension-shell-boundary',
-                rules: [
-                    'Extension roots render inside the Enfyra admin app shell. Do not add root-level page padding such as p-4 sm:p-6 xl:p-8.',
-                    'Page extensions should be full-bleed by default and responsive from the first version.',
-                    'Do not wrap whole pages in decorative cards; use cards only for repeated items, modals, or genuinely framed tools.',
-                    'Use NuxtLink or Nuxt UI components with :to for visible navigation links; reserve navigateTo for imperative side effects.',
-                    'Admin extension links for record management should point to /data/<table>, not public website paths stored on records.',
-                ],
-            },
-            {
-                id: 'extension-runtime-contract',
-                rules: [
-                    'Save extensions as enfyra_extension Vue SFC records; no static import statements in extension code.',
-                    'Editable extension source is enfyra_extension.code. Do not request or write enfyra_extension.sourceCode.',
-                    'Do not call resolveComponent() in extension SFCs. Use auto-injected components such as <UButton>, <UBadge>, <PermissionGate>, and <Widget> directly in the template so the app/compiler resolves them correctly.',
-                    'Load app packages with getPackages(["package-name"]) inside extension runtime code.',
-                    'Prefer FormEditor/FormEditorLazy for direct table-backed forms when the form maps to metadata fields.',
-                    'For long admin setup workflows, open CommonDrawer immediately and show loading/error/content inside it.',
-                    'Use Widget with numeric enfyra_extension widget ids; pass safe reactive props/events and keep page-level mutation ownership in the page unless the widget intentionally owns the workflow.',
-                    'Use useMenuNotificationRegistry for sidebar menu counts/dots and useAccountPanelRegistry count/badge fields for account panel notifications; register these from global extensions when they should update across the shell.',
-                ],
-            },
         ],
+        globalRules: includeGlobal ? GLOBAL_RULES_SECTIONS : undefined,
+        dynamicServerCode: includeDynamic ? DYNAMIC_CODE_SECTIONS : undefined,
+        extensions: includeExtensions ? EXTENSION_SECTIONS : undefined,
     };
+    if (includeDynamic) {
+        payload.usage.push('Pass dynamicCodeAckKey exactly as knowledgeAckKey when calling MCP tools that create or update dynamic server code.');
+    }
+    if (includeExtensions) {
+        payload.usage.push('Pass extensionAckKey exactly as extensionKnowledgeAckKey when calling MCP tools that create or update Enfyra extension code.');
+    }
+    // Strip undefined keys
+    Object.keys(payload).forEach((k) => {
+        if (payload[k] === undefined)
+            delete payload[k];
+    });
+    return payload;
 }
 //# sourceMappingURL=required-knowledge.js.map

package/dist/lib/required-knowledge.js.map

@@ -1 +1 @@
-{"version":3,"file":"required-knowledge.js","sourceRoot":"","sources":["../../src/lib/required-knowledge.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,oFAAoF,CAAC;AACzH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uEAAuE,CAAC;AACtH,MAAM,CAAC,MAAM,2BAA2B,GAAG,4DAA4D,CAAC;AAExG,MAAM,0BAA0B,GAAG,6DAA6D,CAAC;AAEjG,MAAM,UAAU,mBAAmB,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sKAAsK,CAAC,CAAC;AACrM,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4KAA4K,CAAC,CAAC;AAC3M,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC,CAAC;AAClM,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAG;IACtC,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0KAA0K,CAAC,CAAC;IAC9L,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAS,EAAE,GAAG;IACnD,IAAI,SAAS;QAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAG;IAC/C,IAAI,GAAG,KAAK,8BAA8B,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,SAAS,EAAE,GAAG;IAC5D,IAAI,SAAS;QAAE,6BAA6B,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAG;IAC7C,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,SAAS,EAAE,GAAG;IAC1D,IAAI,SAAS;QAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,yJAAyJ;QAClK,iBAAiB,EAAE,oBAAoB;QACvC,iBAAiB,EAAE,8BAA8B;QACjD,eAAe,EAAE,2BAA2B;QAC5C,KAAK,EAAE;YACL,mMAAmM;YACnM,qHAAqH;YACrH,8HAA8H;SAC/H;QACD,WAAW,EAAE;YACX;gBACE,EAAE,EAAE,gCAAgC;gBACpC,KAAK,EAAE;oBACL,mEAAmE;oBACnE,uJAAuJ;oBACvJ,mJAAmJ;iBACpJ;aACF;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,KAAK,EAAE;oBACL,8GAA8G;oBAC9G,0IAA0I;oBAC1I,sNAAsN;oBACtN,kEAAkE;oBAClE,6OAA6O;iBAC9O;aACF;YACD;gBACE,EAAE,EAAE,uBAAuB;gBAC3B,KAAK,EAAE;oBACL,wMAAwM;oBACxM,+FAA+F;oBAC/F,mEAAmE;oBACnE,wIAAwI;oBACxI,0EAA0E;oBAC1E,wFAAwF;oBACxF,6FAA6F;oBAC7F,oHAAoH;oBACpH,sFAAsF;oBACtF,+HAA+H;oBAC/H,8IAA8I;oBAC9I,qJAAqJ;oBACrJ,oJAAoJ;iBACrJ;aACF;YACD;gBACE,EAAE,EAAE,2BAA2B;gBAC/B,KAAK,EAAE;oBACL,gFAAgF;oBAChF,gGAAgG;oBAChG,qHAAqH;oBACrH,+FAA+F;iBAChG;aACF;YACD;gBACE,EAAE,EAAE,oBAAoB;gBACxB,KAAK,EAAE;oBACL,sOAAsO;oBACtO,gIAAgI;oBAChI,+RAA+R;oBAC/R,+KAA+K;oBAC/K,6FAA6F;oBAC7F,qPAAqP;oBACrP,uVAAuV;oBACvV,yLAAyL;oBACzL,6OAA6O;oBAC7O,uNAAuN;oBACvN,+KAA+K;oBAC/K,2MAA2M;oBAC3M,qRAAqR;oBACrR,kIAAkI;oBAClI,4NAA4N;oBAC5N,0JAA0J;oBAC1J,qIAAqI;oBACrI,sHAAsH;oBACtH,kLAAkL;oBAClL,uHAAuH;oBACvH,8OAA8O;oBAC9O,oIAAoI;iBACrI;aACF;YACD;gBACE,EAAE,EAAE,gBAAgB;gBACpB,KAAK,EAAE;oBACL,6IAA6I;oBAC7I,0KAA0K;oBAC1K,6KAA6K;iBAC9K;aACF;YACD;gBACE,EAAE,EAAE,eAAe;gBACnB,KAAK,EAAE;oBACL,wGAAwG;oBACxG,wGAAwG;oBACxG,2DAA2D;oBAC3D,0JAA0J;iBAC3J;aACF;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,EAAE,EAAE,gCAAgC;gBACpC,KAAK,EAAE;oBACL,kHAAkH;oBAClH,6HAA6H;oBAC7H,wKAAwK;oBACxK,oIAAoI;oBACpI,uGAAuG;iBACxG;aACF;YACD;gBACE,EAAE,EAAE,2BAA2B;gBAC/B,KAAK,EAAE;oBACL,oFAAoF;oBACpF,2HAA2H;oBAC3H,6MAA6M;iBAC9M;aACF;YACD;gBACE,EAAE,EAAE,6BAA6B;gBACjC,KAAK,EAAE;oBACL,6FAA6F;oBAC7F,6FAA6F;oBAC7F,qKAAqK;oBACrK,mKAAmK;iBACpK;aACF;YACD;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,KAAK,EAAE;oBACL,6DAA6D;oBAC7D,mIAAmI;oBACnI,yCAAyC;oBACzC,8NAA8N;oBAC9N,kUAAkU;oBAClU,0JAA0J;oBAC1J,4MAA4M;oBAC5M,4KAA4K;oBAC5K,0KAA0K;oBAC1K,8GAA8G;oBAC9G,gMAAgM;oBAChM,2KAA2K;oBAC3K,2NAA2N;iBAC5N;aACF;SACF;QACD,UAAU,EAAE;YACV;gBACE,EAAE,EAAE,sBAAsB;gBAC1B,KAAK,EAAE;oBACL,qGAAqG;oBACrG,+FAA+F;oBAC/F,kGAAkG;oBAClG,2HAA2H;oBAC3H,0HAA0H;oBAC1H,6HAA6H;oBAC7H,yGAAyG;iBAC1G;aACF;YACD;gBACE,EAAE,EAAE,0BAA0B;gBAC9B,KAAK,EAAE;oBACL,yHAAyH;oBACzH,wFAAwF;oBACxF,oHAAoH;oBACpH,2HAA2H;oBAC3H,wHAAwH;iBACzH;aACF;YACD;gBACE,EAAE,EAAE,4BAA4B;gBAChC,KAAK,EAAE;oBACL,qGAAqG;oBACrG,0GAA0G;oBAC1G,kNAAkN;oBAClN,qFAAqF;oBACrF,uGAAuG;oBACvG,yGAAyG;oBACzG,4LAA4L;oBAC5L,8NAA8N;iBAC/N;aACF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"required-knowledge.js","sourceRoot":"","sources":["../../src/lib/required-knowledge.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,oFAAoF,CAAC;AACzH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uEAAuE,CAAC;AACtH,MAAM,CAAC,MAAM,2BAA2B,GAAG,4DAA4D,CAAC;AAExG,MAAM,0BAA0B,GAAG,6DAA6D,CAAC;AAEjG,MAAM,UAAU,mBAAmB,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sKAAsK,CAAC,CAAC;AACrM,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4KAA4K,CAAC,CAAC;AAC3M,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mKAAmK,CAAC,CAAC;AAClM,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAG;IACtC,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,0KAA0K,CAAC,CAAC;IAC9L,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAS,EAAE,GAAG;IACnD,IAAI,SAAS;QAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAG;IAC/C,IAAI,GAAG,KAAK,8BAA8B,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,SAAS,EAAE,GAAG;IAC5D,IAAI,SAAS;QAAE,6BAA6B,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAG;IAC7C,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;IAC5M,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,SAAS,EAAE,GAAG;IAC1D,IAAI,SAAS;QAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,CAAU,CAAC;AAGjG,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAK,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAmB,CAAC;IACpF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B;QACE,EAAE,EAAE,gCAAgC;QACpC,KAAK,EAAE;YACL,mEAAmE;YACnE,uJAAuJ;YACvJ,mJAAmJ;SACpJ;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE;YACL,8GAA8G;YAC9G,0IAA0I;YAC1I,sNAAsN;YACtN,kEAAkE;YAClE,6OAA6O;SAC9O;KACF;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE;YACL,wMAAwM;YACxM,+FAA+F;YAC/F,mEAAmE;YACnE,wIAAwI;YACxI,0EAA0E;YAC1E,wFAAwF;YACxF,6FAA6F;YAC7F,oHAAoH;YACpH,sFAAsF;YACtF,+HAA+H;YAC/H,8IAA8I;YAC9I,qJAAqJ;YACrJ,oJAAoJ;SACrJ;KACF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE;YACL,gFAAgF;YAChF,gGAAgG;YAChG,qHAAqH;YACrH,+FAA+F;SAChG;KACF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE;YACL,sOAAsO;YACtO,gIAAgI;YAChI,+RAA+R;YAC/R,+KAA+K;YAC/K,6FAA6F;YAC7F,qPAAqP;YACrP,uVAAuV;YACvV,yLAAyL;YACzL,6OAA6O;YAC7O,uNAAuN;YACvN,+KAA+K;YAC/K,2MAA2M;YAC3M,qRAAqR;YACrR,kIAAkI;YAClI,4NAA4N;YAC5N,0JAA0J;YAC1J,qIAAqI;YACrI,sHAAsH;YACtH,kLAAkL;YAClL,uHAAuH;YACvH,8OAA8O;YAC9O,oIAAoI;SACrI;KACF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE;YACL,6IAA6I;YAC7I,0KAA0K;YAC1K,6KAA6K;SAC9K;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE;YACL,wGAAwG;YACxG,wGAAwG;YACxG,2DAA2D;YAC3D,0JAA0J;SAC3J;KACF;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC5B;QACE,EAAE,EAAE,gCAAgC;QACpC,KAAK,EAAE;YACL,kHAAkH;YAClH,6HAA6H;YAC7H,wKAAwK;YACxK,oIAAoI;YACpI,uGAAuG;SACxG;KACF;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE;YACL,oFAAoF;YACpF,2HAA2H;YAC3H,6MAA6M;SAC9M;KACF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,KAAK,EAAE;YACL,6FAA6F;YAC7F,6FAA6F;YAC7F,qKAAqK;YACrK,mKAAmK;SACpK;KACF;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE;YACL,6DAA6D;YAC7D,mIAAmI;YACnI,yCAAyC;YACzC,8NAA8N;YAC9N,kUAAkU;YAClU,0JAA0J;YAC1J,4MAA4M;YAC5M,4KAA4K;YAC5K,0KAA0K;YAC1K,8GAA8G;YAC9G,gMAAgM;YAChM,2KAA2K;YAC3K,2NAA2N;SAC5N;KACF;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE;YACL,qGAAqG;YACrG,+FAA+F;YAC/F,kGAAkG;YAClG,2HAA2H;YAC3H,0HAA0H;YAC1H,6HAA6H;YAC7H,yGAAyG;SAC1G;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE;YACL,yHAAyH;YACzH,wFAAwF;YACxF,oHAAoH;YACpH,2HAA2H;YAC3H,wHAAwH;SACzH;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE;YACL,qGAAqG;YACrG,0GAA0G;YAC1G,kNAAkN;YAClN,qFAAqF;YACrF,uGAAuG;YACvG,yGAAyG;YACzG,4LAA4L;YAC5L,8NAA8N;SAC/N;KACF;CACF,CAAC;AAEF,MAAM,eAAe,GAAmC;IACtD,IAAI,EAAE,yJAAyJ;IAC/J,MAAM,EAAE,yHAAyH;IACjI,cAAc,EAAE,6JAA6J;IAC7K,SAAS,EAAE,4GAA4G;IACvH,IAAI,EAAE,gFAAgF;CACvF,CAAC;AAEF,MAAM,UAAU,6BAA6B,CAAC,QAAgB,MAAM;IAClE,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC;IAC3B,MAAM,cAAc,GAAG,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,cAAc,IAAI,aAAa,KAAK,MAAM,CAAC;IAChH,MAAM,iBAAiB,GAAG,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,WAAW,CAAC;IAEpF,MAAM,OAAO,GAAQ;QACnB,OAAO,EAAE,0BAA0B;QACnC,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,eAAe,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChI,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnH,IAAI,EAAE,4OAA4O;QAClP,iBAAiB,EAAE,oBAAoB;QACvC,iBAAiB,EAAE,8BAA8B;QACjD,eAAe,EAAE,2BAA2B;QAC5C,KAAK,EAAE;YACL,mMAAmM;SACpM;QACD,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;QAC9D,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS;QACrE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;IAEF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,8HAA8H,CAAC,CAAC;IACrJ,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/tool-routing.d.ts

@@ -25,6 +25,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "extension";
     title: string;
@@ -44,6 +45,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "schema";
     title: string;
@@ -63,6 +65,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "record-data";
     title: string;
@@ -82,6 +85,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "dynamic-script";
     title: string;
@@ -101,6 +105,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "route-access";
     title: string;
@@ -120,6 +125,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "guards-permissions-rules";
     title: string;
@@ -139,6 +145,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "flow";
     title: string;
@@ -158,6 +165,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "websocket";
     title: string;
@@ -177,6 +185,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "graphql";
     title: string;
@@ -196,6 +205,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "package";
     title: string;
@@ -215,6 +225,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "cache";
     title: string;
@@ -234,6 +245,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: string[];
     exampleCategories: any[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "logs-debug";
     title: string;
@@ -253,6 +265,7 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: any[];
     exampleCategories: any[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 } | {
     key: "auth-context";
     title: string;
@@ -272,11 +285,13 @@ export declare const TOOL_WORKFLOWS: ({
     requiredAck: any[];
     exampleCategories: string[];
     nextStepTemplate: string[];
+    recommendedScope: string;
 })[];
 export declare function listWorkflowSurfaces(): {
     key: "websocket" | "api-endpoint" | "extension" | "schema" | "record-data" | "dynamic-script" | "route-access" | "guards-permissions-rules" | "flow" | "graphql" | "package" | "cache" | "logs-debug" | "auth-context";
     title: string;
     useWhen: string[];
+    recommendedScope: string;
 }[];
 export declare function discoverWorkflowRoutes({ intent, surface, risk, detail, limit, }?: WorkflowRouteOptions): {
     action: string;
@@ -289,6 +304,7 @@ export declare function discoverWorkflowRoutes({ intent, surface, risk, detail,
         key: "websocket" | "api-endpoint" | "extension" | "schema" | "record-data" | "dynamic-script" | "route-access" | "guards-permissions-rules" | "flow" | "graphql" | "package" | "cache" | "logs-debug" | "auth-context";
         title: string;
         useWhen: string[];
+        recommendedScope: string;
         score: number;
     }[];
     surfaces: readonly ["api-endpoint", "extension", "schema", "record-data", "dynamic-script", "route-access", "guards-permissions-rules", "flow", "websocket", "graphql", "package", "cache", "logs-debug", "auth-context"];