@memberjunction/cli 6.1.3 → 6.2.0-edge.0

package/dist/init-templates/citizen-builder/docs/ENTERPRISE_ORG_SETUP.md

@@ -0,0 +1,73 @@
+# Enterprise Organization Setup: Real Schemas & Business Context
+
+This document explains how enterprise organizations—such as **Blue Cypress (BC)**—configure the MemberJunction Citizen Agent Builder so business users build agents against their **real entity schemas and business relationships** instead of generic defaults.
+
+---
+
+## 1. The Two-App Architecture
+
+To provide an accurate, realistic authoring environment without exposing production customer data to personal machines, organizations publish two Open Apps:
+
+| Application | Description | Carries |
+|---|---|---|
+| **`<org>-platform`** (e.g. `bc-platform`) | Core schema & business logic | Custom entities, fields, relationships, standard actions, and queries. |
+| **`<org>-sampledata`** (e.g. `bc-sampledata`) | Realistic synthetic data | Loom-generated synthetic records mirroring production shapes and relational integrity. Depends on `<org>-platform`. |
+
+When a citizen builder boots their environment and installs `<org>-sampledata`, MemberJunction's Open App dependency engine automatically resolves and installs `<org>-platform` leaf-first.
+
+### Why This Model Works:
+1. **Identical Entity Shapes:** Entity and field names match production exactly. An agent written against `bc-sampledata` works on production without renaming a single field or query.
+2. **Zero PII Risk:** The data is 100% synthetic by construction. Compliance and security reviews pass automatically.
+3. **Seamless Promotion:** Promotion is simply deploying the agent's metadata to the production instance; no code rewrites or schema remapping are needed.
+
+---
+
+## 2. Configuration for Citizen Builders
+
+### Option A: Private GitHub Repository Access (Recommended)
+If your organization hosts `<org>-sampledata` in a private GitHub organization (e.g. `github.com/BlueCypress/`):
+
+1. Provide the user with a fine-grained, read-only GitHub Personal Access Token (PAT) with `Contents: Read` permission on the sample data and platform repositories.
+2. In the user's `.env`:
+   ```bash
+   # Enterprise Open App Target
+   OPEN_APP_INSTALL_URL=https://github.com/BlueCypress/bc-sampledata
+   
+   # Read-only GitHub PAT for private repo authentication
+   GITHUB_TOKEN=ghp_exampleTokenWithReadOnlyAccess
+   ```
+3. Run the bootstrap script:
+   ```bash
+   docker compose exec api /work/scripts/bootstrap.sh
+   ```
+
+### Option B: Local Directory Mount (Zero Token)
+If the user or team already has a local checkout of the platform app on their machine:
+1. Create a `docker-compose.override.yml`:
+   ```yaml
+   services:
+     api:
+       volumes:
+         - /path/to/local/bc-platform:/work/apps/bc-platform:ro
+   ```
+2. Run `mj app install /work/apps/bc-platform` inside the container.
+
+---
+
+## 3. Automated Capabilities Cataloging
+
+Once your organization's Open App is installed, run:
+```bash
+./scripts/generate-capabilities.sh
+```
+This queries your local database's entity and action catalogs to update `CAPABILITIES.md`. Your coding agent immediately learns every custom entity, field, and action specific to your company (e.g. `BC: Association Members`, `BC: Committee Terms`, `BC: Invoices`).
+
+---
+
+## 4. Packaging and Upstream Release of Sample Data
+
+When updating your organization's synthetic dataset:
+1. Generate synthetic records using Loom.
+2. Push them to a staging database using `mj sync push`.
+3. Capture the differential SQL emitted by `packages/MetadataSync/src/lib/sql-logger.ts` as the next `V<timestamp>__v<version>_Metadata_Sync.sql` migration in `<org>-sampledata`.
+4. Publish a release of `<org>-sampledata`. All citizen builders will receive the updated synthetic records on their next bootstrap.

package/dist/init-templates/citizen-builder/docs/PROMOTION_GUIDE.md

@@ -0,0 +1,70 @@
+# Promotion & Governance Guide: Reviewing Packaged Agents
+
+This guide is for MemberJunction platform administrators, team leads, and review boards responsible for evaluating and deploying agents authored via the Citizen Agent Builder.
+
+---
+
+## 1. What Arrives at Promotion
+
+A citizen builder submits an export archive (e.g. `dist/InvoiceAuditAgent-package.zip`), which contains:
+
+1. **`AGENT_MANIFEST.md`**: An executive summary describing:
+   - What the agent does and who built it.
+   - Classification: **Tier 1 (Declarative)** vs **Tier 2 (Runtime Action)**.
+   - Data Footprint: Explicit list of entities read and entities modified.
+   - Sample Execution Receipt: Verification trace from a test run.
+2. **Metadata Files**:
+   - `metadata/agents/.*<name>*.json`
+   - `metadata/prompts/.*<name>*.json`
+   - `metadata/prompts/templates/<name>*.md`
+   - (If Tier 2) `metadata/actions/.*<name>*.json`
+
+---
+
+## 2. The Review Process
+
+### Tier 1 (Declarative Agents) — Fast Track (5-Minute Review)
+Tier 1 agents contain **zero executable code** and **zero schema changes**. Reviewing them is straightforward:
+
+1. **Check Defaults in Manifest**:
+   - `ModelSelectionMode` is `"Agent Type"` (no hardcoded models).
+   - `ExposeAsAction` is `false` (unless a valid business rationale is documented).
+2. **Scan Prompts**:
+   - Verify no credentials, tokens, or raw SQL queries are embedded in prompt templates.
+   - Verify no hardcoded record IDs or personal names are used.
+3. **Approve**:
+   - Tier 1 submissions that satisfy these checks can be approved and imported immediately.
+
+### Tier 2 (Runtime Actions) — Code Review Gate
+Tier 2 agents include custom JavaScript actions running in the MemberJunction sandboxed runtime:
+
+1. **Review JavaScript Logic**:
+   - Inspect the code inside the action's metadata definition.
+   - Ensure the logic is deterministic, handles errors, and contains no obfuscated operations or network calls.
+2. **Review & Narrow Permissions**:
+   - Verify that `allowedEntities` is an explicit, minimal list of required entities.
+   - **Reject any submission with `allowAnyEntity: true` or wildcard entity grants.**
+3. **Decide Graduation**:
+   - **Keep as Runtime Action**: Approve the action metadata for deployment as sandboxed JS.
+   - **Promote to Package**: If the action is mission-critical or widely reused, have an engineer reimplement it as a strongly-typed TypeScript action in an `@mj-biz-apps/*` package.
+
+---
+
+## 3. Deploying the Agent
+
+### Option 1: Commit to the Organization's Platform Repo (Recommended)
+1. Extract the metadata files into your organization's repository (e.g. `bc-platform/metadata/`).
+2. Commit and push the changes:
+   ```bash
+   git add metadata/
+   git commit -m "feat(agents): add InvoiceAuditAgent from citizen builder"
+   git push
+   ```
+3. Your CI/CD deployment pipeline will push the metadata to staging and production.
+
+### Option 2: Direct Sync Push to Target Instance
+If deploying directly to a staging or production instance via CLI:
+```bash
+mj sync push --dir /path/to/extracted/metadata
+```
+The agent is now active and ready for end users.

package/dist/init-templates/citizen-builder/metadata/.mj-sync.json

@@ -0,0 +1,7 @@
+{
+  "version": "1.0",
+  "directories": [
+    "agents",
+    "prompts"
+  ]
+}

package/dist/init-templates/citizen-builder/metadata/agents/.customer-insight-agent.json

@@ -0,0 +1,55 @@
+[
+  {
+    "fields": {
+      "Name": "Customer Insight Specialist",
+      "CategoryID": "@lookup:MJ: AI Agent Categories.Name=Assistant",
+      "Description": "Deterministic flow agent that summarizes customer activity, evaluates account standing, and suggests next actions.",
+      "TypeID": "@lookup:MJ: AI Agent Types.Name=Flow",
+      "Status": "Active",
+      "ExecutionOrder": 0,
+      "ExposeAsAction": false,
+      "IconClass": "mj-icon-user-check",
+      "ArtifactCreationMode": "None",
+      "PayloadDownstreamPaths": "*",
+      "PayloadUpstreamPaths": "*",
+      "EnableContextCompression": false,
+      "ModelSelectionMode": "Agent Type"
+    },
+    "relatedEntities": {
+      "MJ: AI Agent Prompts": [
+        {
+          "fields": {
+            "AgentID": "@parent:ID",
+            "PromptID": "@lookup:MJ: AI Prompts.Name=Customer Insight Specialist Prompt",
+            "Status": "Active",
+            "ExecutionOrder": 1
+          },
+          "primaryKey": {
+            "ID": "E9A0C381-645F-4D2A-883F-E19C69D3B511"
+          }
+        }
+      ],
+      "MJ: AI Agent Steps": [
+        {
+          "fields": {
+            "AgentID": "@parent:ID",
+            "Name": "Generate Customer Insights",
+            "Description": "Evaluates account data using the Customer Insight Specialist Prompt",
+            "StepType": "Prompt",
+            "StartingStep": true,
+            "PromptID": "@lookup:MJ: AI Prompts.Name=Customer Insight Specialist Prompt",
+            "Status": "Active",
+            "PositionX": 100,
+            "PositionY": 100
+          },
+          "primaryKey": {
+            "ID": "D2E49B18-091A-4832-B81E-A38C91307D55"
+          }
+        }
+      ]
+    },
+    "primaryKey": {
+      "ID": "A7F01234-8899-4A1B-89E2-7722BCDEF001"
+    }
+  }
+]

package/dist/init-templates/citizen-builder/metadata/agents/.mj-sync.json

@@ -0,0 +1,45 @@
+{
+  "entity": "MJ: AI Agents",
+  "filePattern": "**/.*.json",
+  "defaults": {
+    "TypeID": "@lookup:MJ: AI Agent Types.Name=Flow",
+    "ModelSelectionMode": "Agent Type",
+    "ExposeAsAction": false,
+    "Status": "Active"
+  },
+  "pull": {
+    "createNewFileIfNotFound": true,
+    "newFileName": ".agents.json",
+    "appendRecordsToExistingFile": true,
+    "updateExistingRecords": true,
+    "preserveFields": [],
+    "excludeFields": [],
+    "mergeStrategy": "merge",
+    "backupBeforeUpdate": true,
+    "backupDirectory": ".backups",
+    "lookupFields": {
+      "TypeID": {
+        "entity": "MJ: AI Agent Types",
+        "field": "Name"
+      },
+      "CategoryID": {
+        "entity": "MJ: AI Agent Categories",
+        "field": "Name"
+      }
+    },
+    "relatedEntities": {
+      "MJ: AI Agent Prompts": {
+        "entity": "MJ: AI Agent Prompts",
+        "foreignKey": "AgentID"
+      },
+      "MJ: AI Agent Actions": {
+        "entity": "MJ: AI Agent Actions",
+        "foreignKey": "AgentID"
+      },
+      "MJ: AI Agent Steps": {
+        "entity": "MJ: AI Agent Steps",
+        "foreignKey": "AgentID"
+      }
+    }
+  }
+}

package/dist/init-templates/citizen-builder/metadata/prompts/.customer-insight-prompt.json

@@ -0,0 +1,15 @@
+[
+  {
+    "fields": {
+      "Name": "Customer Insight Specialist Prompt",
+      "Description": "Analyzes customer profile data and recent orders to provide executive account insights.",
+      "CategoryID": "@lookup:MJ: AI Prompt Categories.Name=Agent Type System Prompts",
+      "TypeID": "@lookup:MJ: AI Prompt Types.Name=Chat",
+      "Status": "Active",
+      "TemplateText": "@file:templates/customer-insight.template.md"
+    },
+    "primaryKey": {
+      "ID": "B1C90D1A-9321-4E18-912A-6844917B3C10"
+    }
+  }
+]

package/dist/init-templates/citizen-builder/metadata/prompts/.mj-sync.json

@@ -0,0 +1,45 @@
+{
+  "entity": "MJ: AI Prompts",
+  "filePattern": "**/.*.json",
+  "defaults": {
+    "CategoryID": "@lookup:MJ: AI Prompt Categories.Name=Agent Type System Prompts?create&Description=Prompts for Custom Agents",
+    "TypeID": "@lookup:MJ: AI Prompt Types.Name=Chat"
+  },
+  "ignoreDirectories": [
+    "output",
+    "templates"
+  ],
+  "pull": {
+    "createNewFileIfNotFound": true,
+    "newFileName": ".prompts.json",
+    "appendRecordsToExistingFile": true,
+    "updateExistingRecords": true,
+    "ignoreNullFields": true,
+    "ignoreVirtualFields": true,
+    "preserveFields": [
+      "TemplateText"
+    ],
+    "excludeFields": [
+      "TemplateID"
+    ],
+    "mergeStrategy": "merge",
+    "backupBeforeUpdate": true,
+    "backupDirectory": ".backups",
+    "externalizeFields": [
+      {
+        "field": "TemplateText",
+        "pattern": "@file:templates/{Name}.template.md"
+      }
+    ],
+    "lookupFields": {
+      "CategoryID": {
+        "entity": "MJ: AI Prompt Categories",
+        "field": "Name"
+      },
+      "TypeID": {
+        "entity": "MJ: AI Prompt Types",
+        "field": "Name"
+      }
+    }
+  }
+}

package/dist/init-templates/citizen-builder/metadata/prompts/templates/customer-insight.template.md

@@ -0,0 +1,18 @@
+# Customer Insight Specialist Prompt
+
+You are an expert customer account analyst. Your goal is to review customer profile data and order history, then synthesize a concise executive summary with actionable recommendations.
+
+## Instructions
+1. Analyze the customer account details, active status, and recent activity.
+2. Review any open orders or pending balances.
+3. Formulate 3 key insights:
+   - Account Health (engagement level and standing)
+   - Value / Purchase Pattern (frequent categories, average volume)
+   - Recommended Next Action (e.g. follow-up call, cross-sell recommendation, renewal notice)
+4. Maintain a professional, objective tone. Do not fabricate details not present in the input.
+
+## Output Format
+Deliver your response formatted cleanly with the following markdown sections:
+- **Executive Summary**
+- **Key Metrics & Observations**
+- **Actionable Recommendations**

package/dist/init-templates/citizen-builder/scripts/bootstrap.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# ==============================================================================
+# Citizen Agent Builder - Environment Bootstrap Script
+# Runs inside the MJAPI container or via:
+#   docker compose exec api /work/scripts/bootstrap.sh
+# ==============================================================================
+set -e
+
+echo "========================================================"
+echo " Starting MemberJunction Citizen Builder Bootstrap"
+echo "========================================================"
+
+cd /app
+
+# 1. Run core migrations
+echo "[1/4] Ensuring core MemberJunction database migrations are applied..."
+mj migrate
+
+# 2. Install Open App (More Cheese by default, or Org-specific app)
+APP_URL="${OPEN_APP_INSTALL_URL:-https://github.com/MemberJunction/more-cheese}"
+echo "[2/4] Installing business context Open App: $APP_URL..."
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    # Inject token into GitHub URL if private repo
+    AUTH_APP_URL=$(echo "$APP_URL" | sed -E "s|https://github.com/|https://$GITHUB_TOKEN@github.com/|")
+    mj app install "$AUTH_APP_URL" || echo "Warning: mj app install returned non-zero, continuing..."
+else
+    mj app install "$APP_URL" || echo "Warning: mj app install returned non-zero, continuing..."
+fi
+
+# 3. Generate Capabilities Catalog
+echo "[3/4] Generating CAPABILITIES.md catalog from database..."
+if [ -f "/work/scripts/generate-capabilities.sh" ]; then
+    bash /work/scripts/generate-capabilities.sh || echo "Warning: Capability generation skipped."
+fi
+
+# 4. Push local metadata
+echo "[4/4] Pushing starter metadata to local instance..."
+if [ -d "/work/metadata" ]; then
+    mj sync push --dir /work/metadata || echo "Initial sync completed or already up to date."
+fi
+
+echo "========================================================"
+echo " MemberJunction Citizen Builder is Ready!"
+echo " API: http://localhost:${API_PORT:-4000}"
+echo " Database: localhost:${DB_PORT:-1433}"
+echo "========================================================"

package/dist/init-templates/citizen-builder/scripts/docker-entrypoint.sh

@@ -0,0 +1,184 @@
+#!/bin/bash
+# ==============================================================================
+# MemberJunction Citizen Agent Builder - Container Entrypoint
+# Automates first-time installation via `mj install`, database provisioning,
+# Open App installation, and starts both MJAPI (:4000) and MJExplorer (:4200).
+# ==============================================================================
+set -e
+
+echo "========================================================================"
+echo " Starting MemberJunction Runtime Container"
+echo "========================================================================"
+
+DB_HOST="${DB_HOST:-sqlserver}"
+DB_PORT="${DB_PORT:-1433}"
+DB_PASSWORD="${DB_PASSWORD:-TestPassword123!}"
+DB_DATABASE="${DB_DATABASE:-MemberJunction}"
+
+# 1. Wait for SQL Server to be accessible
+echo "Waiting for SQL Server ($DB_HOST:$DB_PORT) to be ready..."
+until node -e "
+  const net = require('net');
+  const client = net.connect($DB_PORT, '$DB_HOST', () => {
+    client.destroy();
+    process.exit(0);
+  });
+  client.on('error', () => process.exit(1));
+  setTimeout(() => process.exit(1), 2000);
+" 2>/dev/null; do
+  echo "  Waiting for database connection..."
+  sleep 3
+done
+echo "SQL Server is reachable!"
+
+cd /workspace
+
+# 2. First-time setup: install MemberJunction if not already installed
+if [ ! -f "/workspace/package.json" ]; then
+  echo ""
+  echo "========================================================================"
+  echo " First-Time Setup: Installing MemberJunction via 'mj install'..."
+  echo " This runs once and initializes your database, API, and Explorer."
+  echo "========================================================================"
+
+  # Generate install configuration
+  cat << EOF > /tmp/install.config.json
+{
+  "PackageManager": "pnpm",
+  "dbUrl": "$DB_HOST",
+  "dbInstance": "",
+  "dbTrustServerCertificate": "Y",
+  "dbDatabase": "$DB_DATABASE",
+  "dbPort": $DB_PORT,
+  "codeGenLogin": "sa",
+  "codeGenPwD": "$DB_PASSWORD",
+  "mjAPILogin": "sa",
+  "mjAPIPwD": "$DB_PASSWORD",
+  "graphQLPort": 4000,
+  "authType": "Local",
+  "createNewUser": "Y",
+  "userEmail": "admin@memberjunction.org",
+  "userFirstName": "Admin",
+  "userLastName": "User",
+  "userName": "admin",
+  "openAIAPIKey": "${AI_VENDOR_API_KEY__OpenAILLM:-}",
+  "anthropicAPIKey": "${AI_VENDOR_API_KEY__AnthropicLLM:-}",
+  "geminiAPIKey": "${AI_VENDOR_API_KEY__GeminiLLM:-}"
+}
+EOF
+
+  # Execute headless install
+  mj install --yes --fast --config /tmp/install.config.json --dir /workspace
+  pnpm add -w @angular/compiler@21.2.22 2>/dev/null || true
+
+  # Install Open App business context (More Cheese default or custom enterprise app)
+  APP_URL="${OPEN_APP_INSTALL_URL:-https://github.com/MemberJunction/more-cheese}"
+  echo "Installing business context Open App: $APP_URL..."
+  if [ -n "$GITHUB_TOKEN" ]; then
+    AUTH_APP_URL=$(echo "$APP_URL" | sed -E "s|https://github.com/|https://$GITHUB_TOKEN@github.com/|")
+    mj app install "$AUTH_APP_URL" || echo "Notice: mj app install completed or skipped."
+  else
+    mj app install "$APP_URL" || echo "Notice: mj app install completed or skipped."
+  fi
+
+  # Generate capabilities catalog
+  if [ -f "/work/scripts/generate-capabilities.sh" ]; then
+    bash /work/scripts/generate-capabilities.sh || echo "Notice: Capabilities generation completed."
+  fi
+
+  # Push starter metadata
+  if [ -d "/work/metadata" ]; then
+    mj sync push --dir /work/metadata || echo "Notice: Initial metadata push completed."
+  fi
+
+  echo "MemberJunction installation and provisioning complete!"
+else
+  echo "Existing MemberJunction workspace detected in /workspace."
+  # Apply any pending migrations
+  mj migrate || echo "Database migrations up to date."
+fi
+
+# Configure MJExplorer host binding and compiler alignment
+if [ -f "apps/MJExplorer/package.json" ]; then
+  node -e "
+    const fs = require('fs');
+    const p = 'apps/MJExplorer/package.json';
+    const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+    let changed = false;
+    if (pkg.scripts && pkg.scripts.start && !pkg.scripts.start.includes('--host 0.0.0.0')) {
+      pkg.scripts.start = pkg.scripts.start.replace('ng serve', 'ng serve --host 0.0.0.0 --port 4200');
+      changed = true;
+    }
+    const cliVer = (pkg.devDependencies && pkg.devDependencies['@angular/compiler-cli']) || '21.2.22';
+    if (pkg.dependencies && pkg.dependencies['@angular/compiler'] !== cliVer) {
+      pkg.dependencies['@angular/compiler'] = cliVer;
+      changed = true;
+    }
+    if (changed) {
+      fs.writeFileSync(p, JSON.stringify(pkg, null, 2));
+    }
+  "
+fi
+
+# Sanitize dynamicPackages.client so non-browser packages are not bundled into MJExplorer
+if [ -f "mj.config.cjs" ]; then
+  node -e "
+    const fs = require('fs');
+    try {
+      const config = require('./mj.config.cjs');
+      if (config.dynamicPackages && Array.isArray(config.dynamicPackages.client)) {
+        let changed = false;
+        config.dynamicPackages.client.forEach(entry => {
+          if (!entry.PackageName.endsWith('-ng') || entry.PackageName === '@mj-biz-apps/sonar-ng') {
+            if (entry.Enabled !== false) {
+              entry.Enabled = false;
+              changed = true;
+            }
+          }
+        });
+        if (changed) {
+          let code = fs.readFileSync('mj.config.cjs', 'utf8');
+          const regex = /client:\s*\[[\s\S]*?\]\s*\},/m;
+          code = code.replace(regex, 'client: ' + JSON.stringify(config.dynamicPackages.client, null, 2) + '\n  },');
+          fs.writeFileSync('mj.config.cjs', code);
+        }
+      }
+    } catch (e) {
+      console.warn('Notice: dynamicPackages check skipped:', e.message);
+    }
+  "
+fi
+
+# 3. Start MJAPI and MJExplorer services via PM2
+echo "Starting MJAPI and MJExplorer services..."
+pm2 delete all 2>/dev/null || true
+
+# Start API service
+if [ -f "package.json" ]; then
+  if grep -q "start:api" package.json; then
+    pm2 start "npm run start:api" --name mjapi
+  elif [ -d "apps/MJAPI" ]; then
+    pm2 start "cd apps/MJAPI && npm start" --name mjapi
+  else
+    pm2 start "npm start" --name mjapi
+  fi
+fi
+
+# Start Explorer service
+if [ -f "package.json" ]; then
+  if grep -q "start:explorer" package.json; then
+    pm2 start "npm run start:explorer" --name mjexplorer
+  elif [ -d "apps/MJExplorer" ]; then
+    pm2 start "cd apps/MJExplorer && npm start" --name mjexplorer
+  fi
+fi
+
+echo "========================================================================"
+echo " 🎉 MemberJunction Stack is Running!"
+echo "    MJAPI:       http://localhost:4000 (GraphQL & API)"
+echo "    MJExplorer:  http://localhost:4200 (Web Interface)"
+echo "    Database:    localhost:$DB_PORT (DB: $DB_DATABASE)"
+echo "========================================================================"
+
+# Keep container running and stream logs
+exec pm2 logs

package/dist/init-templates/citizen-builder/scripts/generate-capabilities.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# ==============================================================================
+# Citizen Agent Builder - Capabilities Catalog Generator
+# Queries the local MemberJunction database and outputs an updated CAPABILITIES.md
+# so the local coding agent has an exact catalog of entities, actions, and agents.
+# ==============================================================================
+set -e
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUTPUT_FILE="$DIR/CAPABILITIES.md"
+
+if [ -f "$DIR/.env" ]; then
+  set -a
+  source "$DIR/.env"
+  set +a
+fi
+
+DB_PASSWORD="${DB_PASSWORD:-TestPassword123!}"
+
+echo "Generating CAPABILITIES.md from database catalog..."
+
+SQL_QUERY="
+SET NOCOUNT ON;
+PRINT '# System Capabilities Catalog';
+PRINT '';
+PRINT 'This catalog reflects the real entities, actions, and agents available in this MemberJunction instance.';
+PRINT 'Use these exact names when authoring agent steps, action bindings, and prompt templates.';
+PRINT '';
+PRINT '## 1. Available Entities';
+PRINT '| Entity Name | Description |';
+PRINT '|---|---|';
+SELECT '| \`' + Name + '\` | ' + REPLACE(REPLACE(COALESCE(Description, 'No description'), CHAR(13), ' '), CHAR(10), ' ') + ' |'
+FROM [__mj].[vwEntities]
+WHERE VirtualEntity = 0
+ORDER BY Name ASC;
+
+PRINT '';
+PRINT '## 2. Available Actions (Tools)';
+PRINT '| Action Name | Description |';
+PRINT '|---|---|';
+SELECT '| \`' + Name + '\` | ' + REPLACE(REPLACE(COALESCE(Description, 'No description'), CHAR(13), ' '), CHAR(10), ' ') + ' |'
+FROM [__mj].[vwActions]
+ORDER BY Name ASC;
+
+PRINT '';
+PRINT '## 3. Available Sub-Agents';
+PRINT '| Agent Name | Type | Description |';
+PRINT '|---|---|---|';
+SELECT '| \`' + Name + '\` | ' + Type + ' | ' + REPLACE(REPLACE(COALESCE(Description, 'No description'), CHAR(13), ' '), CHAR(10), ' ') + ' |'
+FROM [__mj].[vwAIAgents]
+ORDER BY Name ASC;
+"
+
+docker compose exec -T sqlserver /opt/mssql-tools18/bin/sqlcmd \
+  -S localhost -U sa -P "$DB_PASSWORD" -d MemberJunction -C -No -W -w 200 \
+  -Q "$SQL_QUERY" > "$OUTPUT_FILE" 2>/dev/null || {
+    echo "Notice: Database not yet initialized; creating baseline CAPABILITIES.md"
+    cat << 'EOF' > "$OUTPUT_FILE"
+# System Capabilities Catalog
+
+*This catalog is automatically populated once your local database is booted and bootstrapped.*
+
+## Available Core Actions
+* `Send Email` - Send notification or transactional emails
+* `Create Record` - Insert a new record into any permitted entity
+* `Update Record` - Update an existing record by ID
+* `Run Query` - Execute a dynamic query against entities
+* `Get Record` - Fetch a record by primary key
+
+Run `./scripts/bootstrap.sh` to populate the complete catalog from your installed Open App.
+EOF
+}
+
+echo "Capabilities catalog updated at: $OUTPUT_FILE"