@enfyra/mcp-server 0.1.65 → 0.1.67

package/dist/lib/toolset-filter.js

@@ -1,6 +1,6 @@
 export const MCP_TOOLSETS = ['guided', 'full'];
 export const MCP_PROFILES = ['all', 'extension', 'schema', 'runtime', 'operations'];
-const CORE_TOOL_NAMES = [
+export const CORE_TOOL_NAMES = [
     'get_enfyra_required_knowledge',
     'get_enfyra_examples',
     'discover_enfyra_workflows',
@@ -11,15 +11,17 @@ const CORE_TOOL_NAMES = [
     'get_enfyra_api_context',
     'get_current_user',
     'get_permission_profile',
+    'search_enfyra_tools',
+    'execute_enfyra_tool',
+    'select_enfyra_workflow',
 ];
+const CORE_TOOL_SET = new Set(CORE_TOOL_NAMES);
 const PROFILE_TOOL_NAMES = {
     extension: [
         ...CORE_TOOL_NAMES,
         'search_admin_extensions',
         'search_runtime_zone',
         'inspect_table',
-        'inspect_feature',
-        'trace_metadata_usage',
         'get_table_metadata',
         'query_table',
         'count_records',
@@ -44,8 +46,6 @@ const PROFILE_TOOL_NAMES = {
         'debug_field_exposure',
         'inspect_table',
         'inspect_route',
-        'inspect_feature',
-        'trace_metadata_usage',
         'get_table_metadata',
         'get_all_tables',
         'get_schema_design_context',
@@ -72,7 +72,6 @@ const PROFILE_TOOL_NAMES = {
         'search_runtime_zone',
         'inspect_table',
         'inspect_route',
-        'get_script_source',
         'patch_script_source',
         'update_script_source',
         'validate_dynamic_script',
@@ -103,9 +102,6 @@ const PROFILE_TOOL_NAMES = {
         'search_runtime_zone',
         'inspect_table',
         'inspect_route',
-        'inspect_feature',
-        'trace_metadata_usage',
-        'get_all_routes',
         'query_table',
         'count_records',
         'find_one_record',
@@ -141,6 +137,16 @@ export function normalizeMcpProfile(value) {
     const raw = String(value || '').trim().toLowerCase();
     return MCP_PROFILES.includes(raw) ? raw : 'all';
 }
+export function normalizeDynamicToolPacks(value, toolset, profile) {
+    if (toolset === 'full' || profile !== 'all')
+        return false;
+    const raw = String(value ?? '').trim().toLowerCase();
+    if (['0', 'false', 'off', 'no'].includes(raw))
+        return false;
+    if (['1', 'true', 'on', 'yes'].includes(raw))
+        return true;
+    return true;
+}
 export function isToolVisibleInToolset(toolName, toolset, profile = 'all') {
     if (toolset === 'full')
         return true;
@@ -148,23 +154,65 @@ export function isToolVisibleInToolset(toolName, toolset, profile = 'all') {
         return GUIDED_TOOL_NAMES.has(toolName);
     return PROFILE_TOOL_SETS[profile].has(toolName);
 }
-export function installToolsetFilter(server, toolset, profile = 'all') {
+export function installToolsetFilter(server, toolset, profile = 'all', { dynamic = false } = {}) {
     const registerTool = server.tool.bind(server);
     const hiddenTools = [];
-    server.tool = (name, description, schema, handler) => {
-        if (!isToolVisibleInToolset(name, toolset, profile)) {
-            hiddenTools.push(name);
-            return undefined;
-        }
-        return registerTool(name, description, schema, handler);
+    const registrations = new Map();
+    const refreshHiddenTools = () => {
+        hiddenTools.splice(0, hiddenTools.length, ...[...registrations.values()]
+            .filter((tool) => !tool.visible)
+            .map((tool) => tool.name));
+    };
+    server.tool = (...args) => {
+        const name = String(args[0]);
+        const description = typeof args[1] === 'string' ? args[1] : '';
+        const inputSchema = (typeof args[1] === 'string' ? args[2] : args[1]) || {};
+        const handler = args.at(-1);
+        const annotations = args.length >= 5 ? args.at(-2) : undefined;
+        const eligible = isToolVisibleInToolset(name, toolset, profile);
+        const visible = eligible && (!dynamic || CORE_TOOL_SET.has(name));
+        const registration = registerTool(...args);
+        if (registration && !visible)
+            registration.enabled = false;
+        registrations.set(name, { name, description, inputSchema, annotations, handler, visible, registration });
+        refreshHiddenTools();
+        return registration;
     };
-    return {
+    const state = {
         toolset,
         profile,
+        dynamic,
         hiddenTools,
+        getTool: (name) => registrations.get(name),
+        listTools: () => [...registrations.values()],
+        listVisibleToolNames: () => [...registrations.values()]
+            .filter((tool) => tool.visible)
+            .map((tool) => tool.name),
+        setActiveTools: (toolNames) => {
+            const requested = new Set(toolNames);
+            for (const coreTool of CORE_TOOL_NAMES)
+                requested.add(coreTool);
+            let changed = false;
+            for (const tool of registrations.values()) {
+                const visible = isToolVisibleInToolset(tool.name, toolset, profile)
+                    && (!dynamic || requested.has(tool.name));
+                if (tool.visible === visible)
+                    continue;
+                tool.visible = visible;
+                if (tool.registration)
+                    tool.registration.enabled = visible;
+                changed = true;
+            }
+            refreshHiddenTools();
+            if (changed)
+                server.sendToolListChanged?.();
+            const visibleToolNames = state.listVisibleToolNames();
+            return { changed, visibleToolNames, hiddenToolCount: hiddenTools.length };
+        },
     };
+    return state;
 }
-export function summarizeToolsetForInstructions(toolset, profile = 'all') {
+export function summarizeToolsetForInstructions(toolset, profile = 'all', dynamic = false) {
     if (toolset === 'full') {
         return 'Toolset mode: full. All Enfyra MCP tools are visible, including low-level escape hatches; domain profile filtering is disabled.';
     }
@@ -172,13 +220,23 @@ export function summarizeToolsetForInstructions(toolset, profile = 'all') {
         return [
             `Toolset mode: guided, domain profile: ${profile}. Only normal ${profile} workflow tools and shared discovery/context tools are visible.`,
             'Use this focused surface when the task belongs to one domain and lower context overhead is important.',
+            'Use search_enfyra_tools for hidden long-tail read-only tools; hidden mutations require the full toolset.',
             'Set ENFYRA_MCP_PROFILE=all for the complete guided surface, or ENFYRA_MCP_TOOLSET=full only for expert debugging or compatibility work.',
         ].join(' ');
     }
+    if (!dynamic) {
+        return [
+            'Toolset mode: guided, domain profile: all. The complete curated guided surface is visible.',
+            'Use discover_enfyra_workflows for routing and search_enfyra_tools for hidden long-tail read-only tools.',
+            'Set ENFYRA_MCP_DYNAMIC_TOOLS=on to start with a compact routing surface on hosts that refresh tools/list_changed.',
+            'Low-level escape hatches require ENFYRA_MCP_TOOLSET=full.',
+        ].join(' ');
+    }
     return [
-        'Toolset mode: guided, domain profile: all. The visible tool surface is curated for broad model compatibility.',
-        'Prefer discover_enfyra_workflows, search_runtime_zone, inspect_* tools, and operation-level ensure/workflow tools.',
-        'Use ENFYRA_MCP_PROFILE=extension, schema, runtime, or operations to reduce context for a known domain. Low-level escape hatches require ENFYRA_MCP_TOOLSET=full.',
+        'Toolset mode: guided, domain profile: all. Dynamic workflow packs start with a compact routing surface.',
+        'Call select_enfyra_workflow with the task surface to expose the exact direct workflow tools for this session.',
+        'Use search_enfyra_tools for hidden long-tail read-only tools; hidden mutations require the full toolset.',
+        'Set ENFYRA_MCP_DYNAMIC_TOOLS=off or use ENFYRA_MCP_PROFILE=extension, schema, runtime, or operations as a static fallback for hosts that do not refresh tools/list_changed. Low-level escape hatches require ENFYRA_MCP_TOOLSET=full.',
     ].join(' ');
 }
 //# sourceMappingURL=toolset-filter.js.map

package/dist/lib/toolset-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolset-filter.js","sourceRoot":"","sources":["../../src/lib/toolset-filter.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAK7F,MAAM,eAAe,GAAG;IACtB,+BAA+B;IAC/B,qBAAqB;IACrB,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,wBAAwB;IACxB,kBAAkB;IAClB,wBAAwB;CAChB,CAAC;AAEX,MAAM,kBAAkB,GAA0D;IAChF,SAAS,EAAE;QACT,GAAG,eAAe;QAClB,yBAAyB;QACzB,qBAAqB;QACrB,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,oBAAoB;QACpB,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,0BAA0B;QAC1B,8BAA8B;QAC9B,oBAAoB;QACpB,oBAAoB;QACpB,uBAAuB;QACvB,sBAAsB;QACtB,aAAa;QACb,eAAe;QACf,uBAAuB;QACvB,yBAAyB;QACzB,yBAAyB;KAC1B;IACD,MAAM,EAAE;QACN,GAAG,eAAe;QAClB,gCAAgC;QAChC,qBAAqB;QACrB,sBAAsB;QACtB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,oBAAoB;QACpB,gBAAgB;QAChB,2BAA2B;QAC3B,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;KAC1B;IACD,OAAO,EAAE;QACP,GAAG,eAAe;QAClB,gCAAgC;QAChC,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,uBAAuB;QACvB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,oBAAoB;QACpB,gBAAgB;QAChB,gBAAgB;QAChB,cAAc;QACd,oBAAoB;QACpB,qBAAqB;QACrB,cAAc;QACd,mBAAmB;QACnB,cAAc;QACd,yBAAyB;QACzB,cAAc;QACd,oBAAoB;QACpB,yBAAyB;QACzB,0BAA0B;QAC1B,wBAAwB;QACxB,eAAe;QACf,iBAAiB;KAClB;IACD,UAAU,EAAE;QACV,GAAG,eAAe;QAClB,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,sBAAsB;QACtB,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,qBAAqB;QACrB,gBAAgB;QAChB,oBAAoB;QACpB,aAAa;QACb,UAAU;QACV,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,sBAAsB;QACtB,uBAAuB;QACvB,cAAc;QACd,eAAe;KAChB;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CACrC,CAAC;AAErD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAiB,CAAC,CAAC,CAAC,CAAC,GAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,OAAmB,EAAE,UAAsB,KAAK;IACvG,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAW,EAAE,OAAmB,EAAE,UAAsB,KAAK;IAChG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAY,EAAE,WAAgB,EAAE,MAAW,EAAE,OAAY,EAAE,EAAE;QAC1E,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAmB,EAAE,UAAsB,KAAK;IAC9F,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,iIAAiI,CAAC;IAC3I,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,yCAAyC,OAAO,iBAAiB,OAAO,iEAAiE;YACzI,uGAAuG;YACvG,yIAAyI;SAC1I,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO;QACL,+GAA+G;QAC/G,oHAAoH;QACpH,kKAAkK;KACnK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}
+{"version":3,"file":"toolset-filter.js","sourceRoot":"","sources":["../../src/lib/toolset-filter.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AACxD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AAK7F,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,+BAA+B;IAC/B,qBAAqB;IACrB,2BAA2B;IAC3B,wBAAwB;IACxB,0BAA0B;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,wBAAwB;IACxB,kBAAkB;IAClB,wBAAwB;IACxB,qBAAqB;IACrB,qBAAqB;IACrB,wBAAwB;CAChB,CAAC;AAEX,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;AAEvD,MAAM,kBAAkB,GAA0D;IAChF,SAAS,EAAE;QACT,GAAG,eAAe;QAClB,yBAAyB;QACzB,qBAAqB;QACrB,eAAe;QACf,oBAAoB;QACpB,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,0BAA0B;QAC1B,8BAA8B;QAC9B,oBAAoB;QACpB,oBAAoB;QACpB,uBAAuB;QACvB,sBAAsB;QACtB,aAAa;QACb,eAAe;QACf,uBAAuB;QACvB,yBAAyB;QACzB,yBAAyB;KAC1B;IACD,MAAM,EAAE;QACN,GAAG,eAAe;QAClB,gCAAgC;QAChC,qBAAqB;QACrB,sBAAsB;QACtB,eAAe;QACf,eAAe;QACf,oBAAoB;QACpB,gBAAgB;QAChB,2BAA2B;QAC3B,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,eAAe;QACf,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;QAClB,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;KAC1B;IACD,OAAO,EAAE;QACP,GAAG,eAAe;QAClB,gCAAgC;QAChC,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,qBAAqB;QACrB,sBAAsB;QACtB,yBAAyB;QACzB,uBAAuB;QACvB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,oBAAoB;QACpB,gBAAgB;QAChB,gBAAgB;QAChB,cAAc;QACd,oBAAoB;QACpB,qBAAqB;QACrB,cAAc;QACd,mBAAmB;QACnB,cAAc;QACd,yBAAyB;QACzB,cAAc;QACd,oBAAoB;QACpB,yBAAyB;QACzB,0BAA0B;QAC1B,wBAAwB;QACxB,eAAe;QACf,iBAAiB;KAClB;IACD,UAAU,EAAE;QACV,GAAG,eAAe;QAClB,qBAAqB;QACrB,eAAe;QACf,eAAe;QACf,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,qBAAqB;QACrB,gBAAgB;QAChB,oBAAoB;QACpB,aAAa;QACb,UAAU;QACV,YAAY;QACZ,iBAAiB;QACjB,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,sBAAsB;QACtB,uBAAuB;QACvB,cAAc;QACd,eAAe;KAChB;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAC1C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CACrC,CAAC;AAErD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAiB,CAAC,CAAC,CAAC,CAAC,GAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,OAAmB,EAAE,OAAmB;IAChG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,OAAmB,EAAE,UAAsB,KAAK;IACvG,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAW,EACX,OAAmB,EACnB,UAAsB,KAAK,EAC3B,EAAE,OAAO,GAAG,KAAK,KAA4B,EAAE;IAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoC,CAAC;IAElE,MAAM,kBAAkB,GAAG,GAAG,EAAE;QAC9B,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;aACrE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;aAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3C,IAAI,YAAY,IAAI,CAAC,OAAO;YAAE,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC;QAC3D,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACzG,kBAAkB,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,KAAK,GAA6B;QACtC,OAAO;QACP,OAAO;QACP,OAAO;QACP,WAAW;QACX,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAClD,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QAC5C,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;aACpD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;aAC9B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,cAAc,EAAE,CAAC,SAA2B,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,KAAK,MAAM,QAAQ,IAAI,eAAe;gBAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;uBAC9D,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;oBAAE,SAAS;gBACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;gBACvB,IAAI,IAAI,CAAC,YAAY;oBAAE,IAAI,CAAC,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC3D,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,IAAI,OAAO;gBAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC5C,MAAM,gBAAgB,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAmB,EAAE,UAAsB,KAAK,EAAE,OAAO,GAAG,KAAK;IAC/G,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,iIAAiI,CAAC;IAC3I,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,yCAAyC,OAAO,iBAAiB,OAAO,iEAAiE;YACzI,uGAAuG;YACvG,0GAA0G;YAC1G,yIAAyI;SAC1I,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,4FAA4F;YAC5F,yGAAyG;YACzG,mHAAmH;YACnH,2DAA2D;SAC5D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO;QACL,yGAAyG;QACzG,+GAA+G;QAC/G,0GAA0G;QAC1G,uOAAuO;KACxO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/lib/types.d.ts

@@ -15,6 +15,83 @@ export interface ToolResult {
     _meta?: Record<string, unknown>;
 }
 export type UnknownRecord = Record<string, unknown>;
+export interface McpToolAnnotations {
+    title: string;
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+    openWorldHint: boolean;
+}
+export interface McpToolContract {
+    name: string;
+    annotations: McpToolAnnotations;
+    catalogExecutable: boolean;
+}
+export interface RegisteredToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    annotations?: McpToolAnnotations;
+    handler: (...args: any[]) => any;
+    visible: boolean;
+    registration?: {
+        enabled: boolean;
+    };
+}
+export interface ToolsetRegistrationState {
+    toolset: string;
+    profile: string;
+    dynamic: boolean;
+    hiddenTools: string[];
+    getTool(name: string): RegisteredToolDefinition | undefined;
+    listTools(): RegisteredToolDefinition[];
+    listVisibleToolNames(): string[];
+    setActiveTools(toolNames: Iterable<string>): {
+        changed: boolean;
+        visibleToolNames: string[];
+        hiddenToolCount: number;
+    };
+}
+export type ToolAvailabilityStatus = 'allowed' | 'denied' | 'unknown';
+export interface ToolAvailability {
+    status: ToolAvailabilityStatus;
+    reason: string;
+}
+export interface ModelEvalTraceEvent {
+    tool: string;
+    arguments?: Record<string, unknown>;
+    result?: unknown;
+    isError?: boolean;
+}
+export interface ModelEvalRun {
+    scenarioId: string;
+    model: string;
+    events: ModelEvalTraceEvent[];
+}
+export interface ModelEvalScenario {
+    id: string;
+    prompt: string;
+    surface: string;
+    requiredToolGroups: string[][];
+    verificationTools: string[];
+    maxToolCalls: number;
+    mutationExpected: boolean;
+    destructiveExpected?: boolean;
+}
+export interface ModelEvalCheck {
+    key: string;
+    passed: boolean;
+    detail: string;
+    blocking?: boolean;
+}
+export interface ModelEvalScore {
+    scenarioId: string;
+    model: string;
+    score: number;
+    optimizationScore: number;
+    recommended: boolean;
+    checks: ModelEvalCheck[];
+}
 export interface MetadataContext {
     dbType: "postgres" | "mysql" | "mongodb" | "mariadb" | "sqlite" | null;
     enfyraVersion: string | null;

package/dist/lib/workflow-tool-packs.d.ts

@@ -0,0 +1,2 @@
+import type { ToolsetRegistrationState } from './types.js';
+export declare function registerWorkflowToolPack(server: any, state: ToolsetRegistrationState): any;

package/dist/lib/workflow-tool-packs.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { jsonContent } from './response-format.js';
+import { WORKFLOW_SURFACES, workflowToolNames } from './tool-routing.js';
+const MAX_ACTIVE_WORKFLOWS = 2;
+export function registerWorkflowToolPack(server, state) {
+    const activeSurfaces = new Set();
+    return server.tool('select_enfyra_workflow', [
+        'Select a workflow surface and expose its exact direct MCP tools for this stdio session.',
+        'Use replace for normal tasks, add only when one task genuinely spans two surfaces, and reset to return to the compact routing surface.',
+        'This changes tool visibility only; it does not grant permissions or bypass Enfyra PAT/RBAC.',
+    ].join(' '), {
+        surface: z.enum(WORKFLOW_SURFACES).optional().describe('Required for replace/add. Omit only with mode=reset.'),
+        mode: z.enum(['replace', 'add', 'reset']).optional().default('replace'),
+    }, async ({ surface, mode }) => {
+        if (mode !== 'reset' && !surface)
+            throw new Error('surface is required when mode is replace or add.');
+        if (mode === 'reset') {
+            activeSurfaces.clear();
+        }
+        else if (mode === 'replace') {
+            activeSurfaces.clear();
+            activeSurfaces.add(surface);
+        }
+        else {
+            activeSurfaces.add(surface);
+            if (activeSurfaces.size > MAX_ACTIVE_WORKFLOWS) {
+                activeSurfaces.delete(surface);
+                throw new Error(`At most ${MAX_ACTIVE_WORKFLOWS} workflow surfaces may be active. Use mode=replace or reset first.`);
+            }
+        }
+        const packTools = [...activeSurfaces].flatMap(workflowToolNames);
+        const result = state.setActiveTools(packTools);
+        return jsonContent({
+            action: 'enfyra_workflow_selected',
+            mode,
+            dynamic: state.dynamic,
+            activeSurfaces: [...activeSurfaces],
+            visibleToolCount: result.visibleToolNames.length,
+            visibleTools: result.visibleToolNames,
+            hiddenToolCount: result.hiddenToolCount,
+            changed: result.changed,
+            guidance: state.dynamic
+                ? [
+                    'Refresh tools/list after this response if the host has not already processed notifications/tools/list_changed.',
+                    'Call the newly visible workflow tools directly so their exact schemas, annotations, and safety gates remain active.',
+                    'Use search_enfyra_tools only for hidden read-only long-tail helpers.',
+                ]
+                : [
+                    'Dynamic packs are disabled for this static profile/toolset; the configured profile remains visible.',
+                    'Use ENFYRA_MCP_DYNAMIC_TOOLS=on with guided/all on hosts that support tools/list_changed.',
+                ],
+        });
+    });
+}
+//# sourceMappingURL=workflow-tool-packs.js.map

package/dist/lib/workflow-tool-packs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-tool-packs.js","sourceRoot":"","sources":["../../src/lib/workflow-tool-packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAwB,MAAM,mBAAmB,CAAC;AAG/F,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,UAAU,wBAAwB,CAAC,MAAW,EAAE,KAA+B;IACnF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmB,CAAC;IAElD,OAAO,MAAM,CAAC,IAAI,CAChB,wBAAwB,EACxB;QACE,yFAAyF;QACzF,wIAAwI;QACxI,6FAA6F;KAC9F,CAAC,IAAI,CAAC,GAAG,CAAC,EACX;QACE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC9G,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAoE,EAAE,EAAE;QAC5F,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtG,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,cAAc,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,cAAc,CAAC,GAAG,CAAC,OAAQ,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,OAAQ,CAAC,CAAC;YAC7B,IAAI,cAAc,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;gBAC/C,cAAc,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,WAAW,oBAAoB,oEAAoE,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,WAAW,CAAC;YACjB,MAAM,EAAE,0BAA0B;YAClC,IAAI;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;YACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,CAAC,MAAM;YAChD,YAAY,EAAE,MAAM,CAAC,gBAAgB;YACrC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACrB,CAAC,CAAC;oBACE,gHAAgH;oBAChH,qHAAqH;oBACrH,sEAAsE;iBACvE;gBACH,CAAC,CAAC;oBACE,qGAAqG;oBACrG,2FAA2F;iBAC5F;SACN,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/mcp-server-entry.js

@@ -3,7 +3,7 @@
  */
 import { config } from 'dotenv';
 config();
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { createHash } from 'node:crypto';
@@ -68,17 +68,23 @@ import { assertCreateHandlerRouteBoundary } from './lib/dynamic-endpoint-contrac
 import { assertGenericRecordMutationAllowed, parseRecordBatchData, parseRecordData, prepareRecordBatchMutation, prepareRecordMutation, validatePortableScriptSource, validateScriptSourceIfPresent } from './lib/mutation-guards.js';
 import { assertDynamicCodeKnowledgeAck, assertDynamicCodeKnowledgeAckIf, assertExtensionKnowledgeAckIf, assertGlobalRulesAck, acknowledgeRequiredKnowledge, buildRequiredKnowledgePayload, dynamicCodeKnowledgeAckParam, extensionKnowledgeAckParam, globalRulesAckParam, } from './lib/required-knowledge.js';
 import { validateMainTableRoutePath } from './lib/route-guards.js';
+import { buildDeletePostcondition, buildQuerySchemaReceipt } from './lib/record-contracts.js';
 import { installColumnarToolFormatter, jsonContent } from './lib/response-format.js';
 import { startMcpUsageTelemetry } from './lib/mcp-usage-telemetry.js';
 import { startRuntimeCacheSocket } from './lib/runtime-cache-socket.js';
 import { executeSequentialBatch } from './lib/sequential-batch.js';
-import { compactSourceFields, writeSourceArtifact } from './lib/source-artifacts.js';
-import { installToolsetFilter, normalizeMcpProfile, normalizeMcpToolset, summarizeToolsetForInstructions } from './lib/toolset-filter.js';
+import { compactSourceFields, readSourceArtifactResource, writeSourceArtifact } from './lib/source-artifacts.js';
+import { installToolsetFilter, normalizeDynamicToolPacks, normalizeMcpProfile, normalizeMcpToolset, summarizeToolsetForInstructions } from './lib/toolset-filter.js';
+import { installToolAnnotations } from './lib/tool-contracts.js';
+import { installToolOutputContracts } from './lib/tool-output-contracts.js';
+import { registerToolCatalogTools } from './lib/tool-catalog.js';
+import { registerWorkflowToolPack } from './lib/workflow-tool-packs.js';
 import { findRoutePermission, mergeMethodNames, normalizeMethodNames, resolveRoleByNameOrId, routeAvailableMethodNames, routePublicMethodNames, summarizeRouteAccess, summarizeRoutePermission, validateMethodsForRoute, } from './lib/route-permission-tools.js';
 // Initialize auth module
 initAuth(ENFYRA_API_URL, ENFYRA_API_TOKEN);
 const MCP_TOOLSET = normalizeMcpToolset(process.env.ENFYRA_MCP_TOOLSET);
 const MCP_PROFILE = normalizeMcpProfile(process.env.ENFYRA_MCP_PROFILE);
+const MCP_DYNAMIC_TOOLS = normalizeDynamicToolPacks(process.env.ENFYRA_MCP_DYNAMIC_TOOLS, MCP_TOOLSET, MCP_PROFILE);
 const CAPABILITY_AREAS = [
     {
         area: 'Schema and metadata',
@@ -418,6 +424,30 @@ function summarizePermissionProfile(user) {
         })),
     };
 }
+async function resolveCatalogToolAvailability(toolNames) {
+    const fields = DEFAULT_ME_PERMISSION_FIELDS.join(',');
+    const result = await fetchAPI(ENFYRA_API_URL, `/me?fields=${encodeURIComponent(fields)}`);
+    const user = firstDataRecord(result);
+    if (user?.isRootAdmin) {
+        return Object.fromEntries(toolNames.map((name) => [name, {
+                status: 'allowed',
+                reason: 'The configured PAT belongs to a root administrator.',
+            }]));
+    }
+    const requirements = summarizePermissionProfile(user).mcpRequirements;
+    return Object.fromEntries(toolNames.map((name) => {
+        const requirement = requirements.find((item) => item.tools.includes(name));
+        if (!requirement) {
+            return [name, {
+                    status: 'unknown',
+                    reason: 'No static admin-route capability mapping exists for this tool; Enfyra PAT/RBAC remains authoritative at execution time.',
+                }];
+        }
+        return [name, requirement.allowed
+                ? { status: 'allowed', reason: `Current PAT grants ${requirement.methods.map((item) => item.method).join(', ')} ${requirement.route}.` }
+                : { status: 'denied', reason: `Current PAT lacks one or more required methods on ${requirement.route}.` }];
+    }));
+}
 function parseJsonArg(value, fallback = undefined) {
     if (value === undefined || value === null || value === '')
         return fallback;
@@ -503,10 +533,10 @@ function summarizeMutationResult(result, action, tableName) {
 async function getTableSummary(tableName) {
     return summarizeTable(await fetchTableMetadata(ENFYRA_API_URL, tableName));
 }
-async function getPrimaryFieldName(tableName) {
-    const table = await getTableSummary(tableName);
-    if (table?.primaryKey)
-        return table.primaryKey;
+async function getPrimaryFieldName(tableName, table = null) {
+    const resolvedTable = table ?? await getTableSummary(tableName);
+    if (resolvedTable?.primaryKey)
+        return resolvedTable.primaryKey;
     const metadata = await fetchMetadataContext(ENFYRA_API_URL);
     return metadata.dbType === 'mongodb' ? '_id' : 'id';
 }
@@ -810,12 +840,19 @@ const server = new McpServer({
     version: '1.0.0',
 }, {
     instructions: buildMcpServerInstructions(ENFYRA_API_URL, {
-        toolsetSummary: summarizeToolsetForInstructions(MCP_TOOLSET, MCP_PROFILE),
+        toolsetSummary: summarizeToolsetForInstructions(MCP_TOOLSET, MCP_PROFILE, MCP_DYNAMIC_TOOLS),
     }),
 });
+installToolOutputContracts(server);
 installColumnarToolFormatter(server);
-installToolsetFilter(server, MCP_TOOLSET, MCP_PROFILE);
+const toolsetState = installToolsetFilter(server, MCP_TOOLSET, MCP_PROFILE, { dynamic: MCP_DYNAMIC_TOOLS });
+installToolAnnotations(server);
 startMcpUsageTelemetry(ENFYRA_API_URL, `${MCP_TOOLSET}:${MCP_PROFILE}`);
+server.registerResource('enfyra-source-artifact', new ResourceTemplate('enfyra-source://artifact/{artifactId}', { list: undefined }), {
+    title: 'Enfyra source artifact',
+    description: 'Process-scoped source or diff artifact created by an Enfyra MCP inspect or preview tool.',
+    mimeType: 'text/plain',
+}, async (uri) => ({ contents: [readSourceArtifactResource(uri.href)] }));
 // ============================================================================
 // METADATA TOOLS
 // ============================================================================
@@ -904,7 +941,7 @@ server.tool('discover_enfyra_workflows', [
     risk: z.string().optional().default('unknown').describe('Highest expected operation risk. Preferred values: read, write, destructive, debug, unknown. Natural terms such as low, medium, or high are accepted and normalized.'),
     detail: z.enum(['summary', 'plan', 'full']).optional().default('summary').describe('summary lists candidate workflows; plan adds tool sequence and avoidTools; full also includes matching keywords.'),
     limit: z.number().int().positive().max(10).optional().default(5).describe('Maximum workflows to return.'),
-}, async (input) => jsonContent(discoverWorkflowRoutes(input, MCP_PROFILE)));
+}, async (input) => jsonContent(discoverWorkflowRoutes(input, MCP_PROFILE, MCP_DYNAMIC_TOOLS)));
 server.tool('discover_enfyra_system', [
     'Call this first when you need to understand the live Enfyra instance.',
     'Returns a concise capability map from live metadata/routes/method rows, including schema management, REST route behavior, GraphQL enablement, and relation handling.',
@@ -1344,7 +1381,7 @@ server.tool('get_enfyra_api_context', [
     };
     return jsonContent(payload);
 });
-server.tool('query_table', 'Query any route-backed table. Response is minimal unless fields is explicit. Every call must pass either limit or all=true. Use count_records or meta=filterCount/totalCount for counts; call discover_query_capabilities before using aggregate objects instead of guessing _sum/_count operators. For enfyra_extension, editable extension source is `code`, not `sourceCode`; prefer search_admin_extensions and patch_extension_code/update_extension_code for admin UI.', {
+server.tool('query_table', 'Query any route-backed table with a live metadata preflight. Explicit fields are validated before the REST read and the result includes schemaReceipt, so a separate metadata call is optional unless the schema itself must be inspected. Response is minimal unless fields is explicit. Every call must pass either limit or all=true. Use count_records or meta=filterCount/totalCount for counts; call discover_query_capabilities before using aggregate objects instead of guessing _sum/_count operators. For enfyra_extension, editable extension source is `code`, not `sourceCode`; prefer search_admin_extensions and patch_extension_code/update_extension_code for admin UI.', {
     tableName: z.string().describe('Table name to query'),
     filter: jsonObjectParam(z, 'Filter object').optional().describe('Filter object. Example: {"status": {"_eq": "active"}}.'),
     sort: z.string().optional().describe('Sort field. Prefix with - for descending (e.g., "createdAt", "-id")'),
@@ -1371,9 +1408,12 @@ server.tool('query_table', 'Query any route-backed table. Response is minimal un
     parseJsonArg(deep, undefined);
     parseJsonArg(aggregate, undefined);
     const queryParams = new URLSearchParams();
-    const requestedFields = fields && fields.length > 0 ? fields : [await getPrimaryFieldName(tableName)];
+    const table = await getTableSummary(tableName);
+    const primaryKey = await getPrimaryFieldName(tableName, table);
+    const requestedFields = fields && fields.length > 0 ? fields : [primaryKey];
     const deepFieldSelection = applyDeepFieldSelections(requestedFields, deep);
     const selectedFields = deepFieldSelection.fields;
+    const schemaReceipt = buildQuerySchemaReceipt({ ...table, primaryKey }, selectedFields);
     if (filterParam)
         queryParams.set('filter', filterParam);
     const normalizedSort = normalizeSortParam(sort);
@@ -1407,6 +1447,7 @@ server.tool('query_table', 'Query any route-backed table. Response is minimal un
             aggregate: aggregate ? parseJsonArg(aggregate, null) : null,
         },
         minimalDefaultApplied: !(fields && fields.length > 0),
+        schemaReceipt,
         meta: result?.meta,
         data: compactSourceFields(result?.data || [], { tableName }),
         detailHint: fields && fields.length > 0
@@ -1753,7 +1794,7 @@ function isNotFoundDeleteError(error) {
         || message.includes('not exists')
         || message.includes('does not exist');
 }
-server.tool('delete_records', 'Delete one or more route-backed records in one MCP call. Pass items as a native JSON array; for one delete, pass one item. The tool previews every target when confirm=false, rejects duplicate ids, and deletes sequentially when confirm=true. By default, confirm=true skips records that were already removed by cascade or a previous cleanup step.', {
+server.tool('delete_records', 'Delete one or more route-backed records in one MCP call. Pass items as a native JSON array; for one delete, pass one item. The tool previews every target when confirm=false, rejects duplicate ids, and deletes sequentially when confirm=true. Confirmed deletes automatically re-read the requested primary keys and return postcondition.confirmedAbsent plus remainingIds, so a separate absence query is optional. By default, confirm=true skips records that were already removed by cascade or a previous cleanup step.', {
     tableName: z.string().describe('Table name'),
     items: bulkObjectArrayParam(z, 'Delete items').describe('Native JSON array of delete items: [{ "id": "...", "queryParams": { ... }? }].'),
     maxItems: z.number().int().min(1).max(100).optional().default(100).describe('Safety cap for one MCP batch. Default/max is 100.'),
@@ -1795,6 +1836,12 @@ server.tool('delete_records', 'Delete one or more route-backed records in one MC
                         duplicateIdsRejected: true,
                         destructive: true,
                         previews,
+                        postcondition: {
+                            verificationMethod: 'not_run_preview',
+                            requestedIds: parsedItems.map((item) => item.id),
+                            remainingIds: previews.filter((item) => item.preview).map((item) => item.id),
+                            confirmedAbsent: false,
+                        },
                         next: 'Call delete_records again with the same items and confirm=true to delete these route-backed records sequentially.',
                     }, null, 2) }] };
     }
@@ -1825,6 +1872,26 @@ server.tool('delete_records', 'Delete one or more route-backed records in one MC
             throw error;
         }
     }
+    const requestedIds = parsedItems.map((item) => item.id);
+    let postcondition;
+    try {
+        const verificationQuery = new URLSearchParams({
+            filter: JSON.stringify({ [primaryKey]: { _in: requestedIds } }),
+            limit: String(parsedItems.length),
+            fields: primaryKey,
+        });
+        const verification = await fetchAPI(ENFYRA_API_URL, `/${tableName}?${verificationQuery.toString()}`);
+        postcondition = buildDeletePostcondition(requestedIds, verification?.data ?? [], primaryKey);
+    }
+    catch (error) {
+        postcondition = {
+            verificationMethod: 'route_read_by_primary_keys',
+            requestedIds,
+            remainingIds: [],
+            confirmedAbsent: false,
+            verificationError: String(error?.message || error),
+        };
+    }
     return { content: [{ type: 'text', text: JSON.stringify({
                     action: 'deleted_records',
                     tableName,
@@ -1836,6 +1903,7 @@ server.tool('delete_records', 'Delete one or more route-backed records in one MC
                     skipNotFound,
                     deleted,
                     skippedNotFound,
+                    postcondition,
                 }, null, 2) }] };
 });
 server.tool('list_methods', 'List enfyra_method records with their UI colors. Use this before creating route methods or method-colored UI.', {}, async () => {
@@ -3150,6 +3218,10 @@ server.tool('install_package', [
         result,
     });
 });
+registerToolCatalogTools(server, toolsetState, {
+    resolveAvailability: resolveCatalogToolAvailability,
+});
+registerWorkflowToolPack(server, toolsetState);
 // ============================================================================
 // MAIN
 // ============================================================================