@enfyra/mcp-server 0.1.62 → 0.1.63

package/dist/lib/mutation-guards.js

@@ -94,9 +94,23 @@ export function rejectUnsafeScriptPayload(tableName, payload) {
 export function validatePortableScriptSource(sourceCode) {
     if (typeof sourceCode !== 'string')
         return;
+    validateLogsContract(sourceCode);
+    validateSocketContract(sourceCode);
     validateAwaitedRepositoryCalls(sourceCode);
     validateNumericThrowDetails(sourceCode);
 }
+function validateSocketContract(sourceCode) {
+    const unsupportedEmit = /(?:@SOCKET|\$ctx\.\$socket)\s*\.\s*emit\s*\(/u.exec(sourceCode);
+    if (!unsupportedEmit)
+        return;
+    throw new Error('@SOCKET has no generic emit() method. In websocket event/connection scripts use reply, emitToCurrentRoom, or broadcastToRoom; from global HTTP/flow contexts use emitToGateway, emitToRoom, emitToUser, or broadcast.');
+}
+function validateLogsContract(sourceCode) {
+    const methodCall = /@LOGS\s*\.\s*(?:info|warn|error|debug|log)\s*\(/u.exec(sourceCode);
+    if (!methodCall)
+        return;
+    throw new Error('@LOGS is callable, not a console/logger object. Use @LOGS(message, details?) such as @LOGS("Approval requested", { requestId }); do not use @LOGS.info/@LOGS.warn/@LOGS.error/@LOGS.debug.');
+}
 function validateAwaitedRepositoryCalls(sourceCode) {
     const repoCallPattern = /(?:#secure\.[A-Za-z_][A-Za-z0-9_]*|#[A-Za-z_][A-Za-z0-9_]*|@REPOS\.secure\.[A-Za-z_][A-Za-z0-9_]*|@REPOS\.(?!secure\b)[A-Za-z_][A-Za-z0-9_]*)\s*\.\s*(find|create|update|delete|exists)\s*\(/g;
     let match;

package/dist/lib/mutation-guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"mutation-guards.js","sourceRoot":"","sources":["../../src/lib/mutation-guards.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,IAAI;IAClC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0NAA0N,CAAC,CAAC;IAC9O,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAI;IACvC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,yBAAyB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAK;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpG,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,EAAE,OAAO;IAClD,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,aAAa,GAAG,OAAO;aAC1B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,UAAU,GAAG,GAAG;iBACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACvB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;iBACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxB,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,8BAA8B,QAAQ,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC;QACxH,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5F,4HAA4H;YAC5H,4EAA4E,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9G,CAAC,aAAa,CAAC,MAAM;gBACnB,CAAC,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,oCAAoC,KAAK,CAAC,IAAI,yEAAyE;YACvH,mKAAmK,CACpK,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAS,EAAE,OAAO;IAC1D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,8FAA8F,CAAC,CAAC;IAClJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAU;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO;IAC3C,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,2BAA2B,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,8BAA8B,CAAC,UAAU;IAChD,MAAM,eAAe,GAAG,+LAA+L,CAAC;IACxN,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9F,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,oJAAoJ,CAC5N,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAU;IAC7C,MAAM,YAAY,GAAG,iEAAiE,CAAC;IACvF,MAAM,UAAU,GAAG,qFAAqF,CAAC;IAEzG,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC9F,MAAM,IAAI,KAAK,CACb,sQAAsQ,CACvQ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAU;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,OAAO,IAAI,IAAI,CAAC;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,SAAS,EAAE,OAAO;IACtE,IAAI,SAAS,KAAK,iBAAiB;QAAE,OAAO;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvF,2FAA2F,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;IACtF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,wBAAwB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,YAAY;aACvD,CAAC;SACH,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,KAAK,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;IACvF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,GAAG,CAAC,CAAC;IAE5D,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEpG,OAAO;QACL,KAAK;QACL,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;IAC/F,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,GAAG,CAAC,CAAC;IAE5D,MAAM,eAAe,GAAG,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,qCAAqC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpG,eAAe,CAAC,IAAI,CAAC;gBACnB,KAAK;gBACL,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,KAAK,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO,EAAE,eAAe;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mutation-guards.js","sourceRoot":"","sources":["../../src/lib/mutation-guards.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,wBAAwB;IACxB,kBAAkB;IAClB,qBAAqB;IACrB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,kCAAkC,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,IAAI;IAClC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0NAA0N,CAAC,CAAC;IAC9O,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAI;IACvC,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,yBAAyB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAK;IAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpG,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,EAAE,OAAO;IAClD,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,aAAa,GAAG,OAAO;aAC1B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,UAAU,GAAG,GAAG;iBACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACvB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;iBACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxB,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,8BAA8B,QAAQ,gDAAgD,CAAC,CAAC,CAAC,IAAI,CAAC;QACxH,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,uDAAuD,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5F,4HAA4H;YAC5H,4EAA4E,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9G,CAAC,aAAa,CAAC,MAAM;gBACnB,CAAC,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACnD,CAAC,CAAC,EAAE,CAAC;YACP,oCAAoC,KAAK,CAAC,IAAI,yEAAyE;YACvH,mKAAmK,CACpK,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAS,EAAE,OAAO;IAC1D,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,8FAA8F,CAAC,CAAC;IAClJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAU;IACrD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO;IAC3C,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACnC,8BAA8B,CAAC,UAAU,CAAC,CAAC;IAC3C,2BAA2B,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAU;IACxC,MAAM,eAAe,GAAG,+CAA+C,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzF,IAAI,CAAC,eAAe;QAAE,OAAO;IAC7B,MAAM,IAAI,KAAK,CACb,uNAAuN,CACxN,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAU;IACtC,MAAM,UAAU,GAAG,kDAAkD,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvF,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,IAAI,KAAK,CACb,4LAA4L,CAC7L,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,UAAU;IAChD,MAAM,eAAe,GAAG,+LAA+L,CAAC;IACxN,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,SAAS;QAC9F,MAAM,IAAI,KAAK,CACb,wDAAwD,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,oJAAoJ,CAC5N,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAU;IAC7C,MAAM,YAAY,GAAG,iEAAiE,CAAC;IACvF,MAAM,UAAU,GAAG,qFAAqF,CAAC;IAEzG,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC9F,MAAM,IAAI,KAAK,CACb,sQAAsQ,CACvQ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,UAAU;IACxC,MAAM,IAAI,GAAG,EAAE,CAAC;IAChB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,OAAO,IAAI,IAAI,CAAC;QAChB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,SAAS,EAAE,OAAO;IACtE,IAAI,SAAS,KAAK,iBAAiB;QAAE,OAAO;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,+DAA+D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvF,2FAA2F,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;IACtF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,4BAA4B,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,wBAAwB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,YAAY;aACvD,CAAC;SACH,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,KAAK,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;IACvF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,GAAG,CAAC,CAAC;IAE5D,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,qCAAqC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEpG,OAAO;QACL,KAAK;QACL,OAAO;QACP,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE;IAC/F,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,GAAG,CAAC,CAAC;IAE5D,MAAM,eAAe,GAAG,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,qCAAqC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpG,eAAe,CAAC,IAAI,CAAC;gBACnB,KAAK;gBACL,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,KAAK,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO,EAAE,eAAe;KACzB,CAAC;AACJ,CAAC"}

package/dist/lib/platform-operation-tools.d.ts

@@ -163,5 +163,6 @@ export declare function applyExtensionCodePatches(code: any, patches: any): {
     }[];
     results: any[];
 };
+export declare function assertFixedFlowStepConfigIsStatic(type: any, config: any, index?: number): void;
 export declare function registerPlatformOperationTools(server: any, ENFYRA_API_URL: any): void;
 export {};

package/dist/lib/platform-operation-tools.js

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 import { createHash } from 'node:crypto';
 import { fetchAPI } from './fetch.js';
-import { fetchTableCatalog, fetchTableMetadataByRef, resolveTableCatalogEntry } from './metadata-client.js';
+import { fetchTableCatalog, fetchTableMetadata, fetchTableMetadataByRef, resolveTableCatalogEntry } from './metadata-client.js';
+import { assertCustomEndpointRoute, assertDynamicEndpointContract, extractExplicitRepositoryTableNames, reviewDynamicEndpointContract, } from './dynamic-endpoint-contract.js';
 import { validatePortableScriptSource, validateScriptSourceIfPresent } from './mutation-guards.js';
 import { assertDynamicCodeKnowledgeAck, assertDynamicCodeKnowledgeAckIf, assertExtensionKnowledgeAck, assertGlobalRulesAck, dynamicCodeKnowledgeAckParam, extensionKnowledgeAckParam, globalRulesAckParam, } from './required-knowledge.js';
 const AUTO_INJECTED_EXTENSION_COMPONENT_TAGS = [
@@ -2236,20 +2237,20 @@ const FLOW_STEP_TOOL_GUIDANCE = [
     {
         tool: 'ensure_create_flow_step',
         type: 'create',
-        when: 'Create one record in one table from static config or previous flow values.',
+        when: 'Create one record from static config only. Fixed step config is not template-transformed; use a script step when data comes from @FLOW_PAYLOAD, @FLOW_LAST, or @FLOW.',
         config: { table: 'table_name', data: { field: 'value' } },
     },
     {
         tool: 'ensure_update_flow_step',
         type: 'update',
-        when: 'Update one known record by id.',
-        config: { table: 'table_name', id: '@FLOW_PAYLOAD.id', data: { field: 'value' } },
+        when: 'Update one statically known record. Use a script step when id or data comes from runtime flow values.',
+        config: { table: 'table_name', id: '<static-id>', data: { field: 'value' } },
     },
     {
         tool: 'ensure_delete_flow_step',
         type: 'delete',
-        when: 'Delete one known record by id.',
-        config: { table: 'table_name', id: '@FLOW_PAYLOAD.id' },
+        when: 'Delete one statically known record. Use a script step when id comes from runtime flow values.',
+        config: { table: 'table_name', id: '<static-id>' },
     },
     {
         tool: 'ensure_http_flow_step',
@@ -2311,6 +2312,36 @@ function chooseFlowStepTool(intent) {
         return FLOW_STEP_TOOL_GUIDANCE.find((item) => item.type === 'query');
     return FLOW_STEP_TOOL_GUIDANCE.find((item) => item.type === 'script');
 }
+const FIXED_FLOW_STEP_TYPES = new Set(['query', 'create', 'update', 'delete', 'http', 'sleep', 'trigger_flow', 'log']);
+const FLOW_RUNTIME_MACRO_PATTERN = /@FLOW(?:_PAYLOAD|_LAST|_META)?\b/u;
+function findFlowRuntimeMacro(value) {
+    if (typeof value === 'string')
+        return FLOW_RUNTIME_MACRO_PATTERN.exec(value)?.[0] || null;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const match = findFlowRuntimeMacro(item);
+            if (match)
+                return match;
+        }
+        return null;
+    }
+    if (!value || typeof value !== 'object')
+        return null;
+    for (const item of Object.values(value)) {
+        const match = findFlowRuntimeMacro(item);
+        if (match)
+            return match;
+    }
+    return null;
+}
+export function assertFixedFlowStepConfigIsStatic(type, config, index = 0) {
+    if (!FIXED_FLOW_STEP_TYPES.has(String(type)))
+        return;
+    const macro = findFlowRuntimeMacro(config);
+    if (!macro)
+        return;
+    throw new Error(`steps[${index}] uses ${macro} inside a ${type} config, but ESV fixed flow step configs are static and are not template-transformed. Use a script step for runtime payload/previous-step values, keep one business operation in that script, and call @LOGS(message, details?) for captured logs.`);
+}
 function planFlowSteps(steps) {
     const items = Array.isArray(steps) ? steps : [];
     return items.map((step, index) => {
@@ -2350,7 +2381,7 @@ function normalizeFlowWorkflowStep(step, index) {
         .replace(/[^a-z0-9]+/g, '_')
         .replace(/^_+|_+$/g, '')
         .slice(0, 64) || `step_${index + 1}`;
-    return {
+    const normalized = {
         index,
         key,
         name: input.name || intent,
@@ -2365,6 +2396,8 @@ function normalizeFlowWorkflowStep(step, index) {
         chosenByIntent: !input.type,
         recommendedTool: guidance.tool,
     };
+    assertFixedFlowStepConfigIsStatic(type, normalized.config, index);
+    return normalized;
 }
 async function runFlowWorkflow(apiUrl, opts) {
     const steps = parseJsonArrayArg('steps', opts.steps, []);
@@ -2392,7 +2425,7 @@ async function runFlowWorkflow(apiUrl, opts) {
             plan,
             requiredAckParams: ['globalRulesAckKey', ...(hasDynamicCode ? ['knowledgeAckKey'] : [])],
             nextSteps: [
-                'Review the plan. Prefer fixed step types; script is only for logic not covered by query/create/update/delete/http/sleep/trigger/log/condition.',
+                'Review the plan. Prefer fixed step types only for static config; ESV does not interpolate @FLOW_PAYLOAD/@FLOW_LAST/@FLOW inside fixed-step config. Use one focused script step when runtime values are required.',
                 'Call flow_workflow again with apply=true and the required ack params to create/update the flow and steps sequentially.',
                 'Use test_flow_step for script, condition, or high-risk steps before triggering the flow.',
             ],
@@ -2447,6 +2480,29 @@ function normalizeEndpointAccess(anonymousAccess, makePublic) {
         return makePublic ? 'public' : 'private';
     return anonymousAccess || 'private';
 }
+async function reviewCustomEndpointSource(apiUrl, method, sourceCode) {
+    const repositoryTables = extractExplicitRepositoryTableNames(sourceCode);
+    const selectedTables = repositoryTables.slice(0, 5);
+    const results = await Promise.allSettled(selectedTables.map(async (tableName) => [tableName, await fetchTableMetadata(apiUrl, tableName)]));
+    const tableMetadata = {};
+    const metadataUnavailable = [];
+    for (const [index, result] of results.entries()) {
+        if (result.status === 'fulfilled') {
+            tableMetadata[result.value[0]] = result.value[1];
+        }
+        else {
+            metadataUnavailable.push(selectedTables[index]);
+        }
+    }
+    return reviewDynamicEndpointContract({
+        routeKind: 'custom',
+        method,
+        sourceCode,
+        tableMetadata,
+        metadataUnavailable,
+        metadataTruncated: repositoryTables.length > selectedTables.length,
+    });
+}
 function sourceMatches(existingHandler, sourceCode, scriptLanguage, timeout) {
     if (!existingHandler)
         return false;
@@ -2484,18 +2540,25 @@ async function resolveApiEndpointWorkflowState(apiUrl, opts) {
     const normalizedPath = normalizeRestPath(opts.path);
     const methodName = normalizeMethodName(opts.method);
     const access = normalizeEndpointAccess(opts.anonymousAccess, opts.public);
+    assertDynamicEndpointContract(reviewDynamicEndpointContract({
+        routeKind: 'custom',
+        method: methodName,
+        sourceCode: opts.sourceCode,
+    }));
     const { methodMap, methodIdNameMap } = await getMethodContext(apiUrl);
     const methodId = methodMap[methodName];
     if (!methodId)
         throw new Error(`Unknown method "${methodName}". Valid methods: ${Object.keys(methodMap).sort().join(', ')}`);
-    const [routes, scriptValidation] = await Promise.all([
+    const [routes, scriptValidation, contractReview] = await Promise.all([
         fetchAll(apiUrl, '/enfyra_route?limit=1000&fields=id,_id,path,isEnabled,description,availableMethods.*,publicMethods.*,mainTable.name'),
         validateScriptSourceIfPresent(fetchAPI, apiUrl, 'enfyra_route_handler', {
             sourceCode: opts.sourceCode,
             scriptLanguage: opts.scriptLanguage || 'javascript',
         }),
+        reviewCustomEndpointSource(apiUrl, methodName, opts.sourceCode),
     ]);
     const route = routes.find((item) => item.path === normalizedPath) || null;
+    assertCustomEndpointRoute(route);
     const routeId = getId(route);
     const availableMethods = methodNamesFromRecords(route?.availableMethods || [], methodIdNameMap);
     const publicMethods = methodNamesFromRecords(route?.publicMethods || [], methodIdNameMap);
@@ -2615,6 +2678,7 @@ async function resolveApiEndpointWorkflowState(apiUrl, opts) {
         handler,
         role,
         scriptValidation,
+        contractReview,
         steps,
         firstRunnable,
         blocked,
@@ -2771,6 +2835,7 @@ async function runApiEndpointWorkflow(apiUrl, opts) {
         action: operations.length ? 'api_endpoint_workflow_advanced' : 'api_endpoint_workflow_planned',
         endpoint: latestState.endpoint,
         scriptValidation: latestState.scriptValidation,
+        contractReview: latestState.contractReview,
         steps: latestSteps,
         operations,
         complete: latestSteps.every((item) => ['completed', 'skipped'].includes(item.status)),
@@ -3486,12 +3551,12 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
     server.tool('api_endpoint_workflow', [
         'Step-by-step workflow for creating or updating a custom REST endpoint.',
         'Use this when an LLM is building or changing endpoint behavior and should follow live nextSteps instead of guessing raw metadata mutations.',
-        'With apply=false it validates sourceCode, reads live route/handler/access state, and returns pending steps.',
+        'With apply=false it validates sourceCode, blocks canonical-route collisions, reviews explicit repository metadata/security boundaries, reads live route/handler/access state, and returns pending steps.',
         'With apply=true it applies only the next pending step, then returns a fresh plan. With applyAll=true it advances all currently safe pending steps.',
     ].join(' '), {
         path: z.string().describe('Custom route path, e.g. /sum. Must not be a full URL.'),
         method: z.string().describe('HTTP method for the handler, e.g. GET or POST.'),
-        sourceCode: z.string().describe('Handler sourceCode. Use macros such as @QUERY, @BODY, @THROW400, @REPOS, and @USER. Repository calls are async and reads return result.data. Use @REPOS.main or #secure.table_name/@REPOS.secure.table_name for user-facing access; reserve trusted repos for intentional field-permission bypass. Do not send compiledCode.'),
+        sourceCode: z.string().describe('Handler sourceCode for a custom route, which has no main table. Use #secure.table_name or @REPOS.secure.table_name for user-facing explicit-table access. Repository calls are async and reads return result.data. Passing @BODY as create/update data is valid TypeORM-style usage; enforce endpoint-specific owner/tenant/business rules in code. Reserve trusted repos for intentional field-permission bypass. Do not send compiledCode.'),
         scriptLanguage: z.enum(['javascript', 'typescript']).optional().default('javascript').describe('Script language.'),
         anonymousAccess: z.enum(['public', 'private']).optional().default('private').describe('public adds the method to publicMethods; private removes this method from publicMethods.'),
         public: z.boolean().optional().describe('Compatibility alias for anonymousAccess. true means public, false means private.'),
@@ -3520,7 +3585,7 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
     ].join(' '), {
         path: z.string().describe('Custom route path, e.g. /sum. Must not be a full URL.'),
         method: z.string().describe('HTTP method for the handler, e.g. GET or POST.'),
-        sourceCode: z.string().describe('Handler sourceCode. Use macros such as @QUERY, @BODY, @THROW400, @REPOS, and @USER. Repository calls are async and reads return result.data. Use @REPOS.main or #secure.table_name/@REPOS.secure.table_name for user-facing access; reserve trusted repos for intentional field-permission bypass. Do not send compiledCode.'),
+        sourceCode: z.string().describe('Handler sourceCode for a custom route, which has no main table. Use #secure.table_name or @REPOS.secure.table_name for user-facing explicit-table access. Repository calls are async and reads return result.data. Passing @BODY as create/update data is valid TypeORM-style usage; enforce endpoint-specific owner/tenant/business rules in code. Reserve trusted repos for intentional field-permission bypass. Do not send compiledCode.'),
         scriptLanguage: z.enum(['javascript', 'typescript']).optional().default('javascript').describe('Script language.'),
         public: z.boolean().optional().default(false).describe('When true, the method is added to publicMethods for anonymous access.'),
         description: z.string().optional().describe('Route description.'),
@@ -3535,12 +3600,25 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
         assertDynamicCodeKnowledgeAck(knowledgeAckKey);
         const normalizedPath = normalizeRestPath(path);
         const methodName = normalizeMethodName(method);
-        const { methodMap, methodIdNameMap } = await getMethodContext(ENFYRA_API_URL);
+        assertDynamicEndpointContract(reviewDynamicEndpointContract({
+            routeKind: 'custom',
+            method: methodName,
+            sourceCode,
+        }));
+        const [{ methodMap, methodIdNameMap }, routes, scriptValidation, contractReview] = await Promise.all([
+            getMethodContext(ENFYRA_API_URL),
+            fetchAll(ENFYRA_API_URL, '/enfyra_route?limit=1000&fields=id,_id,path,isEnabled,availableMethods.*,publicMethods.*,mainTable.name'),
+            validateScriptSourceIfPresent(fetchAPI, ENFYRA_API_URL, 'enfyra_route_handler', {
+                sourceCode,
+                scriptLanguage,
+            }),
+            reviewCustomEndpointSource(ENFYRA_API_URL, methodName, sourceCode),
+        ]);
         const methodId = methodMap[methodName];
         if (!methodId)
             throw new Error(`Unknown method "${methodName}". Valid methods: ${Object.keys(methodMap).sort().join(', ')}`);
-        const routes = await fetchAll(ENFYRA_API_URL, '/enfyra_route?limit=1000&fields=id,_id,path,isEnabled,availableMethods.*,publicMethods.*,mainTable.name');
         let route = routes.find((item) => item.path === normalizedPath);
+        assertCustomEndpointRoute(route);
         let routeAction = 'existing';
         if (!route) {
             const createRouteResult = await fetchAPI(ENFYRA_API_URL, '/enfyra_route', {
@@ -3573,10 +3651,6 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
             routeAction = 'updated';
         }
         const routeId = getId(route);
-        const scriptValidation = await validateScriptSourceIfPresent(fetchAPI, ENFYRA_API_URL, 'enfyra_route_handler', {
-            sourceCode,
-            scriptLanguage,
-        });
         const existingHandler = await findHandler(ENFYRA_API_URL, routeId, methodId);
         let handlerResult;
         let handlerAction;
@@ -3642,6 +3716,7 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
                         routeAction,
                         handlerAction,
                         scriptValidation,
+                        contractReview,
                         routeReload,
                         smokeTest,
                         usage: {
@@ -3960,6 +4035,7 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
         'Workflow front door for creating or updating an Enfyra flow and its steps in one guided path.',
         'For a fully specified, non-destructive flow, use apply=true to create/update the flow and all steps sequentially in one call. Use apply=false only when step types or risk need review.',
         'Prefer this over choosing individual ensure_*_flow_step tools in guided mode.',
+        'Fixed query/create/update/delete/http/sleep/trigger/log config is static in current ESV and does not interpolate @FLOW_PAYLOAD/@FLOW_LAST/@FLOW; use a focused script step for runtime values.',
     ].join(' '), {
         name: z.string().describe('Flow name. Existing flow with this name is updated.'),
         triggerType: z.enum(['manual', 'schedule']).optional().default('manual').describe('manual for API/admin/hook/child flow usage, schedule for cron/time-based flows.'),
@@ -3971,7 +4047,7 @@ export function registerPlatformOperationTools(server, ENFYRA_API_URL) {
                 name: z.string().optional().describe('Human label. Defaults from intent.'),
                 intent: z.string().optional().describe('Plain-language step intent. Used to choose a fixed step type when type is omitted.'),
                 type: z.enum(['query', 'create', 'update', 'delete', 'http', 'condition', 'sleep', 'trigger_flow', 'log', 'script']).optional().describe('Explicit step type. Omit to let the workflow choose from intent.'),
-                config: z.union([z.record(z.any()), z.string()]).optional().describe('Step config object or JSON string. For query/create/update/delete/http/sleep/trigger/log steps, prefer config over sourceCode.'),
+                config: z.union([z.record(z.any()), z.string()]).optional().describe('Step config object or JSON string. Fixed-step config is static and cannot contain @FLOW_PAYLOAD/@FLOW_LAST/@FLOW. Use a focused script step for runtime values.'),
                 sourceCode: z.string().optional().describe('Only for script or condition steps. Use fixed step types when possible.'),
                 scriptLanguage: z.enum(['javascript', 'typescript']).optional().default('javascript'),
                 order: z.number().optional().describe('Step order. Defaults to index * 10.'),