@rubytech/create-maxy-code 0.1.0

package/payload/platform/lib/graph-mcp/dist/cypher-shim-write.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * Pure helpers for the shim-owned write_neo4j_cypher path (Task 797).
+ * Extracted from index.ts so the executeWrite tx body, response synthesis,
+ * and value serialization can be unit-tested without the shim's top-level
+ * process bootstrap (which spawns uvx and opens stdin/stdout pipes).
+ *
+ * The shim's index.ts wires these up: rewriter → shared driver → session.
+ * executeWrite(tx => runWriteTxBody(...)) → response synth → stdout.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrphanRollbackError = exports.ORPHAN_CHECK_CYPHER = void 0;
+exports.serializeValue = serializeValue;
+exports.runWriteTxBody = runWriteTxBody;
+exports.synthesiseWriteResponse = synthesiseWriteResponse;
+exports.synthesiseOrphanRollback = synthesiseOrphanRollback;
+exports.synthesiseShimError = synthesiseShimError;
+exports.ORPHAN_CHECK_CYPHER = "MATCH (n) WHERE n.createdBySession = $__autoSession " +
+    "AND n.createdAt >= $__autoStartTimestamp " +
+    "AND NOT (n)--() " +
+    "RETURN collect(elementId(n)) AS orphanIds, " +
+    "collect(distinct labels(n)) AS labelSets";
+class OrphanRollbackError extends Error {
+    orphanIds;
+    sampleLabels;
+    constructor(orphanIds, sampleLabels) {
+        super(`orphan rollback: ${orphanIds.length} unattached node(s)`);
+        this.orphanIds = orphanIds;
+        this.sampleLabels = sampleLabels;
+    }
+}
+exports.OrphanRollbackError = OrphanRollbackError;
+function serializeValue(v) {
+    if (v === null || v === undefined)
+        return v;
+    if (typeof v === "string" || typeof v === "boolean" || typeof v === "number") {
+        return v;
+    }
+    if (Array.isArray(v))
+        return v.map(serializeValue);
+    if (typeof v === "object") {
+        const obj = v;
+        if ("low" in obj &&
+            "high" in obj &&
+            typeof obj.low === "number" &&
+            typeof obj.high === "number" &&
+            Object.keys(obj).length === 2) {
+            if (obj.high === 0 || obj.high === -1)
+                return obj.low;
+            return String(obj);
+        }
+        if ("properties" in obj && "labels" in obj) {
+            return {
+                labels: obj.labels,
+                elementId: obj.elementId,
+                properties: serializeValue(obj.properties),
+            };
+        }
+        if ("properties" in obj && "type" in obj && "elementId" in obj) {
+            return {
+                type: obj.type,
+                elementId: obj.elementId,
+                properties: serializeValue(obj.properties),
+            };
+        }
+        if (obj.constructor &&
+            obj.constructor.name &&
+            obj.constructor.name !== "Object" &&
+            obj.constructor.name !== "Array") {
+            return String(obj);
+        }
+        const out = {};
+        for (const [k, val] of Object.entries(obj)) {
+            out[k] = serializeValue(val);
+        }
+        return out;
+    }
+    return v;
+}
+/**
+ * Body of the executeWrite tx. Runs the rewritten cypher, captures counters,
+ * runs the orphan check, throws OrphanRollbackError if any orphans remain
+ * (executeWrite catches the throw and rolls back the entire tx).
+ *
+ * Caller is responsible for: (a) opening the session, (b) wrapping this in
+ * `session.executeWrite(tx => runWriteTxBody(tx, ...))`, (c) calling close()
+ * in finally, (d) translating the outcome / OrphanRollbackError into the
+ * synthesised MCP response and audit log lines.
+ */
+async function runWriteTxBody(tx, rewrittenCypher, operatorParams, autoCtx) {
+    const tsRes = await tx.run("RETURN datetime() AS now");
+    const startTs = tsRes.records[0].get("now");
+    const merged = {
+        ...operatorParams,
+        __autoStartTimestamp: startTs,
+        __autoAgent: autoCtx.agent,
+        __autoSession: autoCtx.session,
+    };
+    const writeRes = await tx.run(rewrittenCypher, merged);
+    const counters = writeRes.summary.counters.updates();
+    const nodesCreated = counters.nodesCreated;
+    const relsCreated = counters.relationshipsCreated;
+    const propertiesSet = counters.propertiesSet;
+    const keys = writeRes.records.length > 0 ? writeRes.records[0].keys.map(String) : [];
+    const serializedRecords = writeRes.records.map((rec) => {
+        const out = {};
+        for (const k of keys) {
+            out[k] = serializeValue(rec.get(k));
+        }
+        return out;
+    });
+    const orphanRes = await tx.run(exports.ORPHAN_CHECK_CYPHER, merged);
+    const orphanIds = orphanRes.records[0].get("orphanIds") ?? [];
+    const labelSets = orphanRes.records[0].get("labelSets") ?? [];
+    if (orphanIds.length > 0) {
+        const flatLabels = Array.from(new Set(labelSets.flat()));
+        throw new OrphanRollbackError(orphanIds, flatLabels);
+    }
+    return { nodesCreated, relsCreated, propertiesSet, serializedRecords };
+}
+function synthesiseWriteResponse(id, w) {
+    const parts = [];
+    if (w.records.length > 0) {
+        parts.push(`${w.records.length} record${w.records.length === 1 ? "" : "s"} returned`);
+    }
+    parts.push(`${w.nodesCreated} nodes created`);
+    parts.push(`${w.relsCreated} relationships created`);
+    if (w.propertiesSet > 0)
+        parts.push(`${w.propertiesSet} properties set`);
+    if (w.records.length > 0) {
+        parts.push("");
+        parts.push(JSON.stringify(w.records, null, 2));
+    }
+    return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result: {
+            content: [{ type: "text", text: parts.join("\n") }],
+        },
+    });
+}
+function synthesiseOrphanRollback(id, orphanCount, sampleLabels) {
+    const labelLine = sampleLabels.length > 0
+        ? sampleLabels.slice(0, 5).join(", ")
+        : "(unknown — orphans had no labels)";
+    const text = `orphan rollback — ${orphanCount} node(s) created without an edge in the same transaction.\n` +
+        `Sample labels: ${labelLine}.\n\n` +
+        `The transaction was aborted; nothing was persisted. Anchor each new node to its semantic parent in the same statement (Graph Stewardship Doctrine Rule 1 in database-operator.md).`;
+    return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result: {
+            content: [{ type: "text", text }],
+            isError: true,
+        },
+    });
+}
+function synthesiseShimError(id, prefix, errMsg) {
+    return JSON.stringify({
+        jsonrpc: "2.0",
+        id,
+        result: {
+            content: [{ type: "text", text: `${prefix}: ${errMsg}` }],
+            isError: true,
+        },
+    });
+}
+//# sourceMappingURL=cypher-shim-write.js.map

package/payload/platform/lib/graph-mcp/dist/cypher-shim-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cypher-shim-write.js","sourceRoot":"","sources":["../src/cypher-shim-write.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA4DH,wCA+CC;AAYD,wCAyCC;AASD,0DAwBC;AAED,4DAqBC;AAED,kDAaC;AArOY,QAAA,mBAAmB,GAC9B,sDAAsD;IACtD,2CAA2C;IAC3C,kBAAkB;IAClB,6CAA6C;IAC7C,0CAA0C,CAAC;AAgC7C,MAAa,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IAFlB,YACkB,SAAmB,EACnB,YAAsB;QAEtC,KAAK,CAAC,oBAAoB,SAAS,CAAC,MAAM,qBAAqB,CAAC,CAAC;QAHjD,cAAS,GAAT,SAAS,CAAU;QACnB,iBAAY,GAAZ,YAAY,CAAU;IAGxC,CAAC;CACF;AAPD,kDAOC;AAcD,SAAgB,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,IACE,KAAK,IAAI,GAAG;YACZ,MAAM,IAAI,GAAG;YACb,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC;YACtD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,YAAY,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC3C,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;aAC3C,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;aAC3C,CAAC;QACJ,CAAC;QACD,IACE,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,WAAW,CAAC,IAAI;YACpB,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;YACjC,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAChC,CAAC;YACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,cAAc,CAClC,EAAW,EACX,eAAuB,EACvB,cAAuC,EACvC,OAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,MAAM,GAA4B;QACtC,GAAG,cAAc;QACjB,oBAAoB,EAAE,OAAO;QAC7B,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,aAAa,EAAE,OAAO,CAAC,OAAO;KAC/B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC3C,MAAM,WAAW,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAClD,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC7C,MAAM,IAAI,GACR,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACrD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,2BAAmB,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAc,IAAI,EAAE,CAAC;IAC5E,MAAM,SAAS,GACZ,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAgB,IAAI,EAAE,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;AACzE,CAAC;AASD,SAAgB,uBAAuB,CACrC,EAAmB,EACnB,CAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC1E,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,wBAAwB,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,iBAAiB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM,EAAE;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACpD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,wBAAwB,CACtC,EAAmB,EACnB,WAAmB,EACnB,YAAsB;IAEtB,MAAM,SAAS,GACb,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,mCAAmC,CAAC;IAC1C,MAAM,IAAI,GACR,qBAAqB,WAAW,6DAA6D;QAC7F,kBAAkB,SAAS,OAAO;QAClC,oLAAoL,CAAC;IACvL,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM,EAAE;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,OAAO,EAAE,IAAI;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,mBAAmB,CACjC,EAAmB,EACnB,MAAc,EACd,MAAc;IAEd,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM,EAAE;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC;YACzD,OAAO,EAAE,IAAI;SACd;KACF,CAAC,CAAC;AACL,CAAC"}

package/payload/platform/lib/graph-mcp/dist/cypher-validate.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Cypher schema validation for the graph-mcp proxy (Task 654).
+ *
+ * Tokenises a cypher string for labels (`:Label`) and relationship types
+ * (`[:REL_TYPE]`, including `[r:TYPE]`, `[:TYPE*1..5]`, `[:A|B]`) and checks
+ * each against a schema snapshot. Unknown tokens are returned with the
+ * Levenshtein-nearest known tokens of the same kind as suggestions.
+ *
+ * Design posture:
+ *   - Defence layer, not a cypher correctness gate. Pass-through on any
+ *     unparseable pattern — Neo4j remains the syntax authority.
+ *   - Empty schema snapshot (cache not ready, or Neo4j unreachable at boot)
+ *     fails OPEN: ok=true, no rejections. The boot-race treatment is a
+ *     deliberate choice — refusing all cypher would wedge the admin agent
+ *     harder than the typo class this layer prevents. The caller emits
+ *     `validated=false` on the existing [graph-query] line so operators
+ *     still see the bypass.
+ *   - String literals are stripped before tokenisation to avoid matching
+ *     `:Foo` inside quoted content (e.g. `WHERE n.note CONTAINS ':Foo'`).
+ */
+export interface SchemaSnapshot {
+    readonly labels: ReadonlySet<string>;
+    readonly relationshipTypes: ReadonlySet<string>;
+}
+export interface UnknownToken {
+    token: string;
+    kind: "label" | "relationship";
+    nearest: string[];
+    hint: string;
+}
+export type ForbiddenKind = "drop-database" | "create-index" | "create-constraint" | "call-dbms" | "call-db-create";
+export interface ForbiddenPattern {
+    kind: ForbiddenKind;
+    match: string;
+    hint: string;
+}
+export interface ValidationResult {
+    ok: boolean;
+    unknown: UnknownToken[];
+    forbidden: ForbiddenPattern[];
+    labelTokens: string[];
+    edgeTokens: string[];
+}
+export interface ValidateOptions {
+    /** "read" (default) skips DDL/admin forbidden checks. "write" applies them. */
+    mode?: "read" | "write";
+}
+export declare function stripStringLiterals(cypher: string): string;
+export declare function validate(cypher: string, snapshot: SchemaSnapshot, options?: ValidateOptions): ValidationResult;
+//# sourceMappingURL=cypher-validate.d.ts.map

package/payload/platform/lib/graph-mcp/dist/cypher-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cypher-validate.d.ts","sourceRoot":"","sources":["../src/cypher-validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,WAAW,GACX,gBAAgB,CAAC;AAErB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AA8DD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK1D;AA4ED,wBAAgB,QAAQ,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE,eAAoB,GAC5B,gBAAgB,CA4ClB"}

package/payload/platform/lib/graph-mcp/dist/cypher-validate.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Cypher schema validation for the graph-mcp proxy (Task 654).
+ *
+ * Tokenises a cypher string for labels (`:Label`) and relationship types
+ * (`[:REL_TYPE]`, including `[r:TYPE]`, `[:TYPE*1..5]`, `[:A|B]`) and checks
+ * each against a schema snapshot. Unknown tokens are returned with the
+ * Levenshtein-nearest known tokens of the same kind as suggestions.
+ *
+ * Design posture:
+ *   - Defence layer, not a cypher correctness gate. Pass-through on any
+ *     unparseable pattern — Neo4j remains the syntax authority.
+ *   - Empty schema snapshot (cache not ready, or Neo4j unreachable at boot)
+ *     fails OPEN: ok=true, no rejections. The boot-race treatment is a
+ *     deliberate choice — refusing all cypher would wedge the admin agent
+ *     harder than the typo class this layer prevents. The caller emits
+ *     `validated=false` on the existing [graph-query] line so operators
+ *     still see the bypass.
+ *   - String literals are stripped before tokenisation to avoid matching
+ *     `:Foo` inside quoted content (e.g. `WHERE n.note CONTAINS ':Foo'`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripStringLiterals = stripStringLiterals;
+exports.validate = validate;
+// DDL / admin patterns that the database-operator's raw write surface must
+// reject. The graph MCP shim is the only enforcement point — Neo4j Community
+// has no per-tool ACL, so the shim filters by syntactic shape before
+// forwarding the JSON-RPC line to the upstream cypher driver. Each pattern
+// is applied to a string-literal-stripped cypher body so that prose inside
+// quoted strings cannot trip a false positive.
+//
+// CALL apoc.* is intentionally NOT forbidden — apoc.refactor.mergeNodes is
+// the documented dedup primitive. CALL db.labels() and other read-only db.*
+// calls are allowed; only db.create* (createLabel, createProperty,
+// createRelationshipType) is forbidden because those are schema-mutating.
+const FORBIDDEN_PATTERNS = [
+    {
+        kind: "drop-database",
+        pattern: /\bDROP\s+(?:DATABASE|ALIAS|USER|ROLE)\b/i,
+        hint: "DROP DATABASE/USER/ROLE/ALIAS is admin DDL — not permitted on the operator surface.",
+    },
+    {
+        kind: "create-index",
+        pattern: /\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:RANGE\s+|TEXT\s+|POINT\s+|LOOKUP\s+|FULLTEXT\s+|BTREE\s+|VECTOR\s+)?INDEX\b/i,
+        hint: "Index DDL is admin-owned (seed-neo4j.sh applies indexes). Not permitted on the operator surface.",
+    },
+    {
+        kind: "create-constraint",
+        pattern: /\bCREATE\s+(?:OR\s+REPLACE\s+)?CONSTRAINT\b/i,
+        hint: "Constraint DDL is admin-owned (seed-neo4j.sh applies constraints). Not permitted on the operator surface.",
+    },
+    {
+        kind: "call-dbms",
+        pattern: /\bCALL\s+dbms\./i,
+        hint: "CALL dbms.* is admin/security surface. Not permitted on the operator surface.",
+    },
+    {
+        kind: "call-db-create",
+        pattern: /\bCALL\s+db\.create/i,
+        hint: "CALL db.create* mutates schema (label/property/type registration). Not permitted on the operator surface.",
+    },
+];
+// Bracket content containing a type reference. Examples this matches:
+//   [:PART_OF]
+//   [r:PART_OF]
+//   [:PART_OF*1..5]
+//   [r:PART_OF*]
+//   [:A|B]
+// The captured group is the TYPE(|TYPE)* alternation; the consumer splits it.
+const EDGE_PATTERN = /\[[^\]]*?:([A-Z_][A-Za-z0-9_]*(?:\|[A-Z_][A-Za-z0-9_]*)*)[^\]]*?\]/g;
+// Label reference in a node pattern. Applied to a remainder string that has
+// already had edge-bracket substrings stripped, so there is no overlap with
+// the edge pattern. The [A-Z] anchor excludes lowercase map keys.
+const LABEL_PATTERN = /:([A-Z][A-Za-z0-9_]*)/g;
+// Exported so the post-write audit (graph-write/audit.ts) can reuse the same
+// literal-stripping pass before its own static parsing — avoids duplicate
+// false-positive treatment across the two surfaces.
+function stripStringLiterals(cypher) {
+    // Replace single- and double-quoted literals with empty quotes. Preserves
+    // positional structure without retaining content that could match the
+    // label regex (e.g. ':SomeLabel' inside a string).
+    return cypher.replace(/'[^']*'|"[^"]*"/g, '""');
+}
+function extractTokens(cypher) {
+    const cleaned = stripStringLiterals(cypher);
+    const edges = new Set();
+    let match;
+    const edgePattern = new RegExp(EDGE_PATTERN.source, EDGE_PATTERN.flags);
+    while ((match = edgePattern.exec(cleaned)) !== null) {
+        for (const type of match[1].split("|")) {
+            const clean = type.trim();
+            if (clean)
+                edges.add(clean);
+        }
+    }
+    const remainder = cleaned.replace(edgePattern, "");
+    const labels = new Set();
+    const labelPattern = new RegExp(LABEL_PATTERN.source, LABEL_PATTERN.flags);
+    while ((match = labelPattern.exec(remainder)) !== null) {
+        labels.add(match[1]);
+    }
+    return { labels, edges };
+}
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    let prev = new Array(b.length + 1);
+    let curr = new Array(b.length + 1);
+    for (let j = 0; j <= b.length; j++)
+        prev[j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+        }
+        [prev, curr] = [curr, prev];
+    }
+    return prev[b.length];
+}
+function nearestMatches(token, known, limit = 3) {
+    if (known.size === 0)
+        return [];
+    const scored = [];
+    for (const k of known)
+        scored.push([k, levenshtein(token, k)]);
+    scored.sort((a, b) => a[1] - b[1] || a[0].localeCompare(b[0]));
+    return scored.slice(0, limit).map(([k]) => k);
+}
+function hintFor(token, kind, nearest) {
+    const didYouMean = nearest.length > 0 ? `Did you mean :${nearest[0]}? ` : "";
+    return `${didYouMean}Unknown ${kind} '${token}' — not in the current Neo4j schema. See .docs/neo4j.md for the canonical taxonomy.`;
+}
+function detectForbidden(cypher) {
+    // Strip literals so a property value like 'CREATE INDEX archive' cannot
+    // trip a false rejection. The shared `stripStringLiterals` keeps this
+    // treatment uniform with token extraction and audit static parsing.
+    const cleaned = stripStringLiterals(cypher);
+    const out = [];
+    for (const { kind, pattern, hint } of FORBIDDEN_PATTERNS) {
+        const found = cleaned.match(pattern);
+        if (found) {
+            out.push({ kind, match: found[0], hint });
+        }
+    }
+    return out;
+}
+function validate(cypher, snapshot, options = {}) {
+    const mode = options.mode ?? "read";
+    const forbidden = mode === "write" ? detectForbidden(cypher) : [];
+    const { labels, edges } = extractTokens(cypher);
+    // Fail-open when the snapshot is empty. An empty snapshot means "schema
+    // cache not loaded" (boot race, Neo4j unreachable). Rejecting every token
+    // would wedge the admin agent; letting it through preserves the observable
+    // `validated=false` signal on the existing [graph-query] line.
+    // Forbidden DDL/admin patterns still apply — those are syntactic, not
+    // schema-derived.
+    if (snapshot.labels.size === 0 && snapshot.relationshipTypes.size === 0) {
+        return {
+            ok: forbidden.length === 0,
+            unknown: [],
+            forbidden,
+            labelTokens: [...labels],
+            edgeTokens: [...edges],
+        };
+    }
+    const unknown = [];
+    for (const token of labels) {
+        if (!snapshot.labels.has(token)) {
+            const nearest = nearestMatches(token, snapshot.labels);
+            unknown.push({ token, kind: "label", nearest, hint: hintFor(token, "label", nearest) });
+        }
+    }
+    for (const token of edges) {
+        if (!snapshot.relationshipTypes.has(token)) {
+            const nearest = nearestMatches(token, snapshot.relationshipTypes);
+            unknown.push({ token, kind: "relationship", nearest, hint: hintFor(token, "relationship", nearest) });
+        }
+    }
+    // Write-mode caller treats `unknown` as a soft warning (audit), not a
+    // hard reject — operators legitimately introduce new labels via REMOVE
+    // n:Old SET n:New. Read-mode preserves prior behaviour: any unknown
+    // → ok=false.
+    const tokensOk = mode === "write" ? true : unknown.length === 0;
+    return {
+        ok: tokensOk && forbidden.length === 0,
+        unknown,
+        forbidden,
+        labelTokens: [...labels],
+        edgeTokens: [...edges],
+    };
+}
+//# sourceMappingURL=cypher-validate.js.map

package/payload/platform/lib/graph-mcp/dist/cypher-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cypher-validate.js","sourceRoot":"","sources":["../src/cypher-validate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AAoGH,kDAKC;AA4ED,4BAgDC;AA7LD,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,2EAA2E;AAC3E,+CAA+C;AAC/C,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,mEAAmE;AACnE,0EAA0E;AAC1E,MAAM,kBAAkB,GAInB;IACH;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,0CAA0C;QACnD,IAAI,EAAE,qFAAqF;KAC5F;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,gHAAgH;QACzH,IAAI,EAAE,kGAAkG;KACzG;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,8CAA8C;QACvD,IAAI,EAAE,2GAA2G;KAClH;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,+EAA+E;KACtF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,2GAA2G;KAClH;CACF,CAAC;AAEF,sEAAsE;AACtE,eAAe;AACf,gBAAgB;AAChB,oBAAoB;AACpB,iBAAiB;AACjB,WAAW;AACX,8EAA8E;AAC9E,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAE3F,4EAA4E;AAC5E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C,6EAA6E;AAC7E,0EAA0E;AAC1E,oDAAoD;AACpD,SAAgB,mBAAmB,CAAC,MAAc;IAChD,0EAA0E;IAC1E,sEAAsE;IACtE,mDAAmD;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAA6B,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3E,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,KAA0B,EAC1B,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CACd,KAAa,EACb,IAA8B,EAC9B,OAAiB;IAEjB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,GAAG,UAAU,WAAW,IAAI,KAAK,KAAK,qFAAqF,CAAC;AACrI,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,QAAQ,CACtB,MAAc,EACd,QAAwB,EACxB,UAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,sEAAsE;IACtE,kBAAkB;IAClB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,EAAE,EAAE;YACX,SAAS;YACT,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;YACxB,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC;SACvB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,cAAc;IACd,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACtC,OAAO;QACP,SAAS;QACT,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC;QACxB,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC;KACvB,CAAC;AACJ,CAAC"}

package/payload/platform/lib/graph-mcp/dist/index.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * Graph MCP shim — adopts upstream `mcp-neo4j-cypher` per brand.
+ *
+ * Task 557. Claude Code spawns this file as the `graph` MCP server; it
+ * starts the upstream Python server under `uvx` and proxies the JSON-RPC
+ * stdio stream byte-for-byte. While proxying, it:
+ *   1. Resolves `NEO4J_URI/USERNAME/PASSWORD` from the brand's own env
+ *      (falls back to `${PLATFORM_ROOT}/config/.neo4j-password`, matching
+ *      plugins/memory/mcp/src/lib/neo4j.ts:10-21).
+ *   2. Installs the Maxy stderr tee so upstream stderr lands in the
+ *      per-conversation stream log alongside every other plugin.
+ *   3. Locks the upstream server into read-only mode (`NEO4J_READ_ONLY=true`)
+ *      and a stable Maxy namespace (`NEO4J_NAMESPACE=maxy-graph`).
+ *   4. Parses JSON-RPC lines on the request path to record the cypher and
+ *      start time per `id`, and on the response path to emit one
+ *      `[graph-query] op=... brand=... port=... cypher="..." rows=... ms=...`
+ *      line per tool call. Forwarding is byte-accurate — the parser
+ *      observes, never mutates.
+ *
+ * Isolation model per MAXY-PRD.md:627 and create-maxy src/index.ts:504-824:
+ * each brand already owns its own Neo4j instance on its own port with its
+ * own password. This shim trusts that — no query-layer tenant filtering.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/graph-mcp/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}