@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/docs/superpowers/specs/2026-07-22-task-1899-reconcile-report-only-design.md

@@ -0,0 +1,121 @@
+# Task 1899 — the account-dir reconcile reports and never moves
+
+Design agreed 2026-07-22. Source task: `.tasks/1899-account-dir-reconcile-moves-live-state.md`.
+
+## The problem this removes
+
+`reconcileAccount` treats every account-root entry that is neither in the account's
+`SCHEMA.md` `allowed-top-level` block nor in the hand-maintained
+`PROTECTED_TOP_LEVEL` set as a stray, and moves it into `<account>/.quarantine/`.
+The closed list has never matched what the platform and its agents write at an
+account root, so every mismatch is a live feature or live data going dark with no
+error anywhere. `PROTECTED_TOP_LEVEL` has been extended once per casualty
+(`calendar-availability.json` was Task 1877). The sweep is what changes; the
+allowed-list is not made complete here, because once nothing moves an undeclared
+entry costs one log line rather than a broken feature.
+
+## Units
+
+### 1. `platform/services/claude-session-manager/src/account-dir-schema-reconcile.ts`
+
+The move block, `quarantineDest`, and the `mkdirSync` / `renameSync` /
+`appendFileSync` imports are deleted. `ReconcileCounts` loses `quarantined` and
+stays the pure formatter's input, so `formatReconcileLine` still takes exactly
+what it prints:
+
+```
+[fs-reconcile] stray-top-level=<n> over-deep=<n> bad-name=<n>
+```
+
+`reconcileAccount` returns a new `ReconcileResult`: the counts plus
+`strayNames: string[]`. `PROTECTED_TOP_LEVEL` and `QUARANTINE_DIR` both stay.
+They no longer protect anything from being moved, because nothing moves; they
+keep known platform entries and existing quarantine directories out of the stray
+count so the standing line stays readable and a clean account still reports zero.
+
+### 2. `runReconcile` names the strays
+
+One line per account that has any, emitted before the summary:
+
+```
+[fs-reconcile] op=strays account=<id> names=<a,b,c>
+```
+
+No cap on the name list. A count alone cannot distinguish six pieces of debris
+from a live plugin config, and a truncated list would hide the entry an operator
+is hunting for.
+
+### 3. `platform/services/claude-session-manager/src/index.ts`
+
+The call-site comment states that the pass quarantines. It is rewritten to state
+that it reports and never moves, and why: a closed allowed-list that lags what
+the platform writes turns a metric into data loss.
+
+### 4. `platform/scripts/quarantine-restore.mjs`
+
+One-shot, run per install with `--accounts-root <dir>`, plus `--dry-run`. For
+each `<account>/.quarantine/manifest.jsonl` it walks records newest-first and for
+each `originalPath`:
+
+| On disk | Action | Log |
+|---|---|---|
+| Target free at the account root | move it back | `op=restore account=<id> name=<n> result=moved` |
+| Target occupied by a copy the platform rewrote | leave the quarantined copy alone | `result=skipped-live-copy` |
+| Target occupied by a newer copy this same run restored | leave the quarantined copy alone | `result=skipped-superseded` |
+| Source absent (already restored by hand) | nothing | `result=absent` |
+
+Three further outcomes were added during code review, each because its absence
+would have been a silent skip of exactly the kind this task exists to end:
+
+| Condition | Log | Effect |
+|---|---|---|
+| A manifest line that will not parse, or lacks a string `originalPath` / `quarantinePath` | `line=<n> result=unparsable` | counted, run continues |
+| A record whose source escapes `<account>/.quarantine/` or whose target escapes the account | `line=<n> result=refused-outside-account` | counted, exit code 1 |
+| The rename fails, or the manifest will not open | `result=failed` / `result=manifest-unreadable` | counted, exit code 1 |
+
+The containment check exists because `.quarantine` is in the write guard's
+allowed-top-level set, so an account-scoped agent can append to its own manifest,
+while the script runs as the platform user across every account. Without it a
+crafted record moves one account's live data into another. Every record the
+reconcile ever wrote was a bare basename plus a path under `.quarantine/`, so the
+check refuses nothing genuine.
+
+Newest-first is what makes the occupied case correct for a name quarantined more
+than once: the most recent copy is considered first, and every older copy of that
+name then finds the target occupied. The live copy wins because the platform
+rewrote it after the move, which the four `wa-channel-bindings.json` records on
+account `5e99bba5` prove happened.
+
+A restored record is appended to `<account>/.quarantine/restored.jsonl` and the
+manifest is left intact, so the history of what moved and what came back
+survives. The script never deletes.
+
+### 5. `platform/templates/account-schema/SCHEMA.md`
+
+The paragraph telling the agent that `.quarantine/` holds entries the reconcile
+moved out of the top level describes behaviour this task deletes. It is reworded
+to say the directory is a historical store from the pre-1899 sweep that nothing
+adds to any more. Re-filing its contents through the `data-manager` specialist
+still stands.
+
+## Tests
+
+New and rewritten cases go in the existing
+`src/__tests__/account-dir-schema-reconcile.test.ts`; several of its 18 cases
+assert quarantine moves and are rewritten to assert no move. The restore script
+gets `platform/scripts/__tests__/quarantine-restore.test.sh`, matching how every
+other `platform/scripts/` test is written.
+
+## Out of scope
+
+- Completing the `account-owned-dirs` declarations, and extending declarations
+  from dirs to files so `data-portal.json` has a declaration path. Task 1902.
+- The portal index push. It is correct and was starved of its config.
+- The standing portal audit going silent when a config disappears. Task 1901.
+- `over-deep` and `bad-name`. Both already count without moving.
+- Installer payload twins. The payload has no committed copy of any file touched
+  here; `packages/create-maxy-code/scripts/bundle.js` copies `platform/` at
+  bundle time.
+- Publishing, installing on the laptop's three reconcile-carrying installs, and
+  running the restore. All await the operator's publish command, because the
+  currently-installed sweep would re-take anything restored before it.

package/payload/platform/docs/superpowers/specs/2026-07-22-task-1910-two-way-portal-exchange-design.md

@@ -0,0 +1,103 @@
+# Task 1910 — Two-way portal file exchange (design)
+
+Design for [`.tasks/1910-two-way-portal-file-exchange.md`](../../../../.tasks/1910-two-way-portal-file-exchange.md). Operator decision 2026-07-22: the data portal becomes a two-way folder exchange, reversing the one-way scope decisions of Tasks 1831, 1905 and 1906.
+
+## The problem in one line
+
+Today the portal is two stores that never meet: a flat, destination-less R2 upload area the client writes to, and a read-only device folder index the client browses. Neither can reach the other.
+
+## Manifest state machine
+
+Three new columns on `manifest`: `targetPath` (the exposed folder chosen at upload, empty means untargeted), `devicePath` (where the bytes actually landed, written only after a verified device write, so its presence *is* the proof the move happened), and `deleted` (the client asked to withdraw a file that has already moved).
+
+| State | Columns | Bytes live in | Uploads panel |
+|---|---|---|---|
+| In transit | `ingested=0`, `devicePath=''` | R2 | shown, downloads from R2 |
+| Moved | `ingested=1`, `devicePath` set, R2 object gone | device | shown only when the file is not reachable in the folder tree |
+| Withdrawn | `deleted=1` | device, pending removal | hidden |
+
+**One listing rule:** the uploads panel shows a row when the bytes are still in R2, or when the moved file is not reachable in the folder tree. A targeted file therefore leaves the panel and appears in its folder; an untargeted file stays in the panel and downloads through the device. No file is ever listed twice, and no file becomes unreachable.
+
+`devicePath` rather than a boolean is deliberate: a boolean would say a move happened without saying where, and the audit's `unpublishedRouted` check needs the path to compare against the published index.
+
+**Withdrawal ends in row deletion, not a tombstone.** Once the device file is confirmed absent the row is removed. A tombstone would grow the manifest without bound and force every listing read to filter it, and the R2 object is already gone, so the row describes nothing.
+
+### Serving a moved untargeted file
+
+A moved untargeted file sits at `uploads/<ownerId>/<filename>`, and `uploads` is deliberately never exposed (`schema-exposed-dirs.mjs:9-14`). `resolveFetchTarget` refuses any path whose top segment is outside the exposed set (`portal-fetch.ts:182`), and the signed message carries `accountId`, `relPath` and an expiry but no owner (`portal-fetch.ts:56`), so as it stands the device would both refuse the path and be unable to tell whose uploads folder was asked for.
+
+Two link types with two distinct signed messages resolve this:
+
+| Link type | Signed message | Device admission rule |
+|---|---|---|
+| Exposed-folder file | `accountId \n relPath \n exp` (unchanged) | top segment ∈ exposed set |
+| Own-upload file | `accountId \n uploads \n ownerId \n relPath \n exp` | path is exactly `uploads/<signed ownerId>/…` |
+
+The owner is inside the HMAC, so a portal cannot mint a link into another person's upload folder, and the device still decides admission itself rather than trusting the path. `uploads/` gains no exposure to the folder tree; only a link naming its own owner reaches it.
+
+Two message shapes rather than one extended shape, because the exposed-folder message is unchanged and an already-deployed portal never mints the second type. Device and portal redeploy at different times (installer publish versus `site-deploy`), so a single extended message would break every existing download in the window between them.
+
+## Upload key
+
+`ownerId/targetPath/filename`, collapsing to `ownerId/filename` when untargeted.
+
+The target must be in the key. With a flat `ownerId/filename` key, the same filename dropped into two different folders collides on `objectKey UNIQUE`: the upsert would overwrite the first object, reset `ingested`, and the first file would never land. `authorizeKey` (`_lib/authorize.ts:22-32`) already admits deeper keys, rejecting only `..` and a leading separator, so the owner-isolation gate is unchanged by this.
+
+Same owner, same folder, same filename still upserts, which is success criterion 7's replace case.
+
+## Target validation, and where the boundary actually is
+
+A target is legal when it passes the person's grant (`grantAllows`, `_lib/session.ts:87`) **and** carries a folder row (`isDir=1`) in the published `directory` index for that account.
+
+This means you can only drop where you can see, which introduces no new permission concept: the set of legal upload targets is exactly the set of folders already rendered to that person. An empty target is always legal.
+
+**The portal check is convenience; the device check is the boundary.** The pull re-derives the exposed set itself through `resolveExposedDirs`, refusing anything outside it, the same two-ended pattern `portal-fetch.ts` uses for signed downloads. A compromised portal cannot route a file into a folder the device does not expose. The two ends are pinned to agree by a parity test over one shared fixture set, mirroring the existing HMAC parity test.
+
+Refusal fails closed: the file stays pending, the refusal is logged with the exact failing segment, and it is never silently rerouted to the default. A silent reroute would put a client's file somewhere they did not choose and could not find.
+
+## Large uploads
+
+The client slices anything above one part into 25 MiB pieces against an R2 multipart session; files at or below one part keep today's single request. The cap is 1 GiB, checked at session creation against the declared size and again at completion against the summed parts.
+
+Slicing is on the client because the ceiling is the isolate: an upload is read wholly into Function memory (`upload.ts:137`), which is why 25 MiB was chosen in the first place (`upload.ts:8-15`). Parts preserve that bound exactly while removing the total-size limit. Cloudflare's proxied-body cap is not the constraint here; the portal is on Pages, not behind the tunnel that bounds the admin `/data` page (Task 1174).
+
+## Atomic index replace
+
+`directory` gains a `generation` column and a per-account pointer table. The push writes rows at the next generation, flips the pointer in one statement, then deletes superseded rows.
+
+The flip is the atomic point, so a listing racing a push sees the old tree or the new one, never a half-built one. Cleanup afterwards need not be atomic because nothing reads a superseded generation. This supersedes backlog Task 1842, which recorded the delete-then-insert window as an open defect; at 60 second cadence that window would otherwise be hit sixty times more often than at hourly.
+
+## Cadence
+
+The index push becomes a 60 second loop in the admin server's loop registry, beside the pull that already runs there. The scheduling heartbeat's hourly gate and its `auditPortalIndexPush` are retired.
+
+That heartbeat spawn is the path whose own header records it has "never been observed running on a device" (`portal-index-push.mjs:11-13`). Moving the push into the loop registry replaces an unobserved spawn with the mechanism the pull demonstrably uses, and removes the hourly gate that made the client's tree stale by up to two hours. Importing across the tree boundary is precedented: `portal-fetch.ts:22` already imports `schema-exposed-dirs.mjs` from the plugins tree. The script stays runnable standalone.
+
+## Audit
+
+The five-minute `[data-portal-audit]` gains four fields, each answering a failure that emits no event of its own:
+
+- `lastPushAgeSec` — the push stopped running. Healthy under 180.
+- `unmovedObjects` — an R2 object survived its own pull, so the move leaked.
+- `deletePendingRows` — a withdrawal never reached the device.
+- `unpublishedRouted` — a routed file landed somewhere the index never published, so the client cannot see what they uploaded.
+
+Enumeration becomes the union of accounts presenting a config and accounts with a prior push record, reporting `config-absent` rather than falling silent. That is Task 1901's fix, folded in here because this task retires the audit 1901 would have patched.
+
+## Download routing
+
+`/api/download?key=` keeps serving R2 bytes while the row is in transit. Once the row has moved the object is gone, so the same request mints an own-upload signed link and 302s to the device, which is what keeps criterion 5 true without the client learning that the bytes changed home.
+
+## Client
+
+Folder rows and the open listing become drop targets with a drop state. The picker takes multiple files and a multi-file drop uploads each in turn. Upload rows gain `DownloadURL` drag-out, matching what device rows already have (`portal.js:226-233`). Uploads show per-file progress and distinct messages per failure class, replacing today's single "Upload failed." for every status. The page re-reads every 60 seconds while its tab is visible.
+
+Polling was rejected in Tasks 1885 and 1900 on the explicit reasoning that "a poll against an hourly tree is waste". The premise dies with the hourly push: against a 60 second tree the poll is the thing that makes a device-side change visible without the client clicking anything, which is success criterion 4.
+
+## Out of scope
+
+Client deletion or rename of device-authored files the client did not upload; the trust boundary is that a client may withdraw their own file, not destroy a business record. Folder upload and zip download, both directions being files only. Portal-side folder creation, rename and move. The third D1 client (Task 1843). The admin `/data` page and Task 1174. Graph ingestion of pulled files, unchanged from Task 1906.
+
+## Dependency
+
+Live acceptance is blocked until Task 1909 restores the quarantined `data-portal.json` on both sitedesk accounts; the portal has enumerated zero accounts since 2026-07-21T19:16:05Z. Code and unit verification do not depend on it.

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.js

@@ -86,4 +86,55 @@ FOR (p:Person) REQUIRE p.email IS UNIQUE;
 (0, node_test_1.default)("nearestLabel: empty candidates returns null", () => {
     strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("Person", []), null);
 });
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: extracts labels from a multi-label union", () => {
+    const text = `
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Person|Organization|KnowledgeDocument)
+ON EACH [n.name, n.body];
+`;
+    const labels = (0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text);
+    strict_1.default.deepEqual(labels, ["KnowledgeDocument", "Organization", "Person"]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: extracts a union spanning several lines", () => {
+    const text = `
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Person|UserProfile
+    |FAQPage|EmailAccount
+    |AssistantMessage)
+ON EACH [n.name];
+`;
+    const labels = (0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text);
+    strict_1.default.deepEqual(labels, [
+        "AssistantMessage",
+        "EmailAccount",
+        "FAQPage",
+        "Person",
+        "UserProfile",
+    ]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: single and union forms coexist", () => {
+    const text = `
+CREATE CONSTRAINT person_email_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Task|Project)
+ON EACH [n.name];
+`;
+    const labels = (0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text);
+    strict_1.default.deepEqual(labels, ["Person", "Project", "Task"]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: strips backticks from a reserved-word label", () => {
+    // Cypher escapes a label colliding with a reserved word in backticks. The
+    // backticks are quoting, not part of the label name.
+    const text = `
+CREATE INDEX order_account IF NOT EXISTS
+FOR (n:\`Order\`) ON (n.accountId);
+
+CREATE INDEX case_account IF NOT EXISTS
+FOR (n:\`Case\`) ON (n.accountId);
+`;
+    const labels = (0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text);
+    strict_1.default.deepEqual(labels, ["Case", "Order"]);
+});
 //# sourceMappingURL=schema-cypher-parser.test.js.map

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-cypher-parser.test.js","sourceRoot":"","sources":["../../src/__tests__/schema-cypher-parser.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,wEAIoC;AAEpC,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,IAAI,GAAG;;;;;;;;;;;;CAYd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,WAAW;QACX,mBAAmB;QACnB,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,+EAA+E,CAAC;IAC7F,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE;QAClD,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,+DAA+D;IAC/D,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,0EAA0E;IAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5D,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,eAAe,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,mEAAmE;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"schema-cypher-parser.test.js","sourceRoot":"","sources":["../../src/__tests__/schema-cypher-parser.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,wEAIoC;AAEpC,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,IAAI,GAAG;;;;;;;;;;;;CAYd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,WAAW;QACX,mBAAmB;QACnB,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,+EAA+E,CAAC;IAC7F,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE;QAClD,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,+DAA+D;IAC/D,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,0EAA0E;IAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5D,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,eAAe,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,mEAAmE;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,IAAI,GAAG;;;;;;CAMd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,kBAAkB;QAClB,cAAc;QACd,SAAS;QACT,QAAQ;QACR,aAAa;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,IAAI,GAAG;;;;;;;CAOd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,IAAI,GAAG;;;;;;CAMd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.d.ts

@@ -22,8 +22,8 @@
  */
 /**
  * Extract every Neo4j label declared in a `schema.cypher` file by scanning
- * `FOR (alias:Label)` constraint and index forms. Returns a sorted, de-duped
- * list. Pure function — no I/O.
+ * `FOR (alias:Label)` and `FOR (alias:A|B|C)` constraint and index forms.
+ * Returns a sorted, de-duped list. Pure function — no I/O.
  */
 export declare function parseLabelsFromSchemaCypher(schemaCypher: string): string[];
 /**

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-cypher-parser.d.ts","sourceRoot":"","sources":["../src/schema-cypher-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAM1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBxD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC5B,WAAW,SAAI,GACd,MAAM,GAAG,IAAI,CAYf"}
+{"version":3,"file":"schema-cypher-parser.d.ts","sourceRoot":"","sources":["../src/schema-cypher-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAgBH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBxD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC5B,WAAW,SAAI,GACd,MAAM,GAAG,IAAI,CAYf"}

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.js

@@ -25,16 +25,32 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseLabelsFromSchemaCypher = parseLabelsFromSchemaCypher;
 exports.levenshtein = levenshtein;
 exports.nearestLabel = nearestLabel;
-const LABEL_PATTERN = /FOR\s*\(\s*\w+\s*:\s*(\w+)\s*\)/g;
+// Matches both declaration forms:
+//   FOR (p:Person)                     single-label constraint / index
+//   FOR (n:Person|Organization|...)    the entity_search_admin fulltext union,
+//                                      which may wrap across several lines
+// Before Task 1893 only the single form was matched, so seven labels declared
+// solely in the union (AdminConversation, AssistantMessage, EmailAccount,
+// FAQPage, OpeningHoursSpecification, PublicConversation, UserMessage) read as
+// undeclared to every consumer of this parser.
+// Backticks are allowed in the label run because Cypher escapes a label whose
+// name collides with a reserved word that way — `:`Order`` and `:`Case`` are
+// declared escaped in schema.cypher. The backticks are quoting, not part of the
+// label, so they are stripped below.
+const LABEL_PATTERN = /FOR\s*\(\s*\w+\s*:\s*([A-Za-z0-9_|\s`]+?)\s*\)/g;
 /**
  * Extract every Neo4j label declared in a `schema.cypher` file by scanning
- * `FOR (alias:Label)` constraint and index forms. Returns a sorted, de-duped
- * list. Pure function — no I/O.
+ * `FOR (alias:Label)` and `FOR (alias:A|B|C)` constraint and index forms.
+ * Returns a sorted, de-duped list. Pure function — no I/O.
  */
 function parseLabelsFromSchemaCypher(schemaCypher) {
     const found = new Set();
     for (const match of schemaCypher.matchAll(LABEL_PATTERN)) {
-        found.add(match[1]);
+        for (const part of match[1].split("|")) {
+            const label = part.replace(/`/g, "").trim();
+            if (label)
+                found.add(label);
+        }
     }
     return [...found].sort();
 }

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-cypher-parser.js","sourceRoot":"","sources":["../src/schema-cypher-parser.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AASH,kEAMC;AAQD,kCAgBC;AAOD,oCAgBC;AA5DD,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD;;;;GAIG;AACH,SAAgB,2BAA2B,CAAC,YAAoB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,UAA4B,EAC5B,WAAW,GAAG,CAAC;IAEf,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,CAAC;YACb,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"schema-cypher-parser.js","sourceRoot":"","sources":["../src/schema-cypher-parser.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAqBH,kEASC;AAQD,kCAgBC;AAOD,oCAgBC;AA3ED,kCAAkC;AAClC,uEAAuE;AACvE,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,+CAA+C;AAC/C,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,qCAAqC;AACrC,MAAM,aAAa,GAAG,iDAAiD,CAAC;AAExE;;;;GAIG;AACH,SAAgB,2BAA2B,CAAC,YAAoB;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,OAAe,EACf,UAA4B,EAC5B,WAAW,GAAG,CAAC;IAEf,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,CAAC;YACb,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/payload/platform/lib/graph-mcp/src/__tests__/schema-cypher-parser.test.ts

@@ -97,3 +97,58 @@ test("nearestLabel: returns null when no match within maxDistance", () => {
 test("nearestLabel: empty candidates returns null", () => {
   assert.equal(nearestLabel("Person", []), null);
 });
+
+test("parseLabelsFromSchemaCypher: extracts labels from a multi-label union", () => {
+  const text = `
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Person|Organization|KnowledgeDocument)
+ON EACH [n.name, n.body];
+`;
+  const labels = parseLabelsFromSchemaCypher(text);
+  assert.deepEqual(labels, ["KnowledgeDocument", "Organization", "Person"]);
+});
+
+test("parseLabelsFromSchemaCypher: extracts a union spanning several lines", () => {
+  const text = `
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Person|UserProfile
+    |FAQPage|EmailAccount
+    |AssistantMessage)
+ON EACH [n.name];
+`;
+  const labels = parseLabelsFromSchemaCypher(text);
+  assert.deepEqual(labels, [
+    "AssistantMessage",
+    "EmailAccount",
+    "FAQPage",
+    "Person",
+    "UserProfile",
+  ]);
+});
+
+test("parseLabelsFromSchemaCypher: single and union forms coexist", () => {
+  const text = `
+CREATE CONSTRAINT person_email_unique IF NOT EXISTS
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+
+CREATE FULLTEXT INDEX entity_search_admin IF NOT EXISTS
+FOR (n:Task|Project)
+ON EACH [n.name];
+`;
+  const labels = parseLabelsFromSchemaCypher(text);
+  assert.deepEqual(labels, ["Person", "Project", "Task"]);
+});
+
+test("parseLabelsFromSchemaCypher: strips backticks from a reserved-word label", () => {
+  // Cypher escapes a label colliding with a reserved word in backticks. The
+  // backticks are quoting, not part of the label name.
+  const text = `
+CREATE INDEX order_account IF NOT EXISTS
+FOR (n:\`Order\`) ON (n.accountId);
+
+CREATE INDEX case_account IF NOT EXISTS
+FOR (n:\`Case\`) ON (n.accountId);
+`;
+  const labels = parseLabelsFromSchemaCypher(text);
+  assert.deepEqual(labels, ["Case", "Order"]);
+});

package/payload/platform/lib/graph-mcp/src/schema-cypher-parser.ts

@@ -21,17 +21,32 @@
  * exported one targets human-readable error UX, not refresh debouncing.
  */
 
-const LABEL_PATTERN = /FOR\s*\(\s*\w+\s*:\s*(\w+)\s*\)/g;
+// Matches both declaration forms:
+//   FOR (p:Person)                     single-label constraint / index
+//   FOR (n:Person|Organization|...)    the entity_search_admin fulltext union,
+//                                      which may wrap across several lines
+// Before Task 1893 only the single form was matched, so seven labels declared
+// solely in the union (AdminConversation, AssistantMessage, EmailAccount,
+// FAQPage, OpeningHoursSpecification, PublicConversation, UserMessage) read as
+// undeclared to every consumer of this parser.
+// Backticks are allowed in the label run because Cypher escapes a label whose
+// name collides with a reserved word that way — `:`Order`` and `:`Case`` are
+// declared escaped in schema.cypher. The backticks are quoting, not part of the
+// label, so they are stripped below.
+const LABEL_PATTERN = /FOR\s*\(\s*\w+\s*:\s*([A-Za-z0-9_|\s`]+?)\s*\)/g;
 
 /**
  * Extract every Neo4j label declared in a `schema.cypher` file by scanning
- * `FOR (alias:Label)` constraint and index forms. Returns a sorted, de-duped
- * list. Pure function — no I/O.
+ * `FOR (alias:Label)` and `FOR (alias:A|B|C)` constraint and index forms.
+ * Returns a sorted, de-duped list. Pure function — no I/O.
  */
 export function parseLabelsFromSchemaCypher(schemaCypher: string): string[] {
   const found = new Set<string>();
   for (const match of schemaCypher.matchAll(LABEL_PATTERN)) {
-    found.add(match[1]);
+    for (const part of match[1].split("|")) {
+      const label = part.replace(/`/g, "").trim();
+      if (label) found.add(label);
+    }
   }
   return [...found].sort();
 }

package/payload/platform/lib/graph-style/dist/index.d.ts

@@ -24,6 +24,30 @@
  */
 export declare const GRAPH_LABEL_COLOURS: Record<string, string>;
 export declare const FALLBACK_LABEL_COLOUR = "#94A3B8";
+/**
+ * Labels that are an additional label stacked on a base node rather than a
+ * standalone graph node. Each surfaces as its base node's chip and colour, so
+ * none carries a `GRAPH_LABEL_COLOURS` hue of its own.
+ *
+ * Single declaration, two consumers (Task 1893):
+ *   - `platform/ui/server/lib/top-level-labels.ts` drops these from the
+ *     `/graph` chip allowlist, so a vertical granting one a
+ *     `## Top-level node types` row (which the account file-schema projection
+ *     needs for its bucket) does not silently add a fallback-grey chip.
+ *   - The memory plugin's schema-cypher drift guard exempts these from needing
+ *     a `CREATE CONSTRAINT` / `CREATE INDEX` line, because no standalone node
+ *     of the label ever exists.
+ *
+ * Membership is read from what the schema docs already state, not decided here:
+ *   - `Applicant` on `:Person` (schema-estate-agent.md)
+ *   - `Engineer` on `:Person` (schema-construction.md)
+ *   - `Supplier` on `:Organization` (schema-construction.md)
+ *   - `GuestProfile` on `:Person` (schema-hospitality.md)
+ *
+ * Adding a fifth member is an ontology decision: state it in the vertical's
+ * schema prose first, then add it here.
+ */
+export declare const ADDITIONAL_BASE_LABELS: ReadonlySet<string>;
 export declare const ALL_GRAPH_LABELS: readonly string[];
 /**
  * Select the sublabel whose colour should drive the node hue. Walks the

package/payload/platform/lib/graph-style/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqItD,CAAA;AAED,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAE7C,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAiBD,eAAO,MAAM,qBAAqB,sFAQxB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,eAAO,MAAM,oBAAoB,EAAE,cAAsB,CAAA;AAUzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAE3D;AA8ED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAU/E;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqH1D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAoF3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqItD,CAAA;AAED,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAE/B,CAAA;AAExB,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAE7C,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAiBD,eAAO,MAAM,qBAAqB,sFAQxB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,eAAO,MAAM,oBAAoB,EAAE,cAAsB,CAAA;AAUzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAE3D;AA8ED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAU/E;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqH1D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAoF3D"}

package/payload/platform/lib/graph-style/dist/index.js

@@ -19,7 +19,7 @@
  *     (resolved at runtime; this module supplies the schema-default fallback)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FALLBACK_LABEL_SHAPE = exports.EXTERNAL_LABEL_SHAPES = exports.ALL_GRAPH_LABELS = exports.FALLBACK_LABEL_COLOUR = exports.GRAPH_LABEL_COLOURS = void 0;
+exports.FALLBACK_LABEL_SHAPE = exports.EXTERNAL_LABEL_SHAPES = exports.ALL_GRAPH_LABELS = exports.ADDITIONAL_BASE_LABELS = exports.FALLBACK_LABEL_COLOUR = exports.GRAPH_LABEL_COLOURS = void 0;
 exports.pickDisplayLabel = pickDisplayLabel;
 exports.colourForLabel = colourForLabel;
 exports.shapeForLabel = shapeForLabel;
@@ -157,6 +157,30 @@ exports.GRAPH_LABEL_COLOURS = {
     CashEntry: '#7D5A2B',
 };
 exports.FALLBACK_LABEL_COLOUR = '#94A3B8';
+/**
+ * Labels that are an additional label stacked on a base node rather than a
+ * standalone graph node. Each surfaces as its base node's chip and colour, so
+ * none carries a `GRAPH_LABEL_COLOURS` hue of its own.
+ *
+ * Single declaration, two consumers (Task 1893):
+ *   - `platform/ui/server/lib/top-level-labels.ts` drops these from the
+ *     `/graph` chip allowlist, so a vertical granting one a
+ *     `## Top-level node types` row (which the account file-schema projection
+ *     needs for its bucket) does not silently add a fallback-grey chip.
+ *   - The memory plugin's schema-cypher drift guard exempts these from needing
+ *     a `CREATE CONSTRAINT` / `CREATE INDEX` line, because no standalone node
+ *     of the label ever exists.
+ *
+ * Membership is read from what the schema docs already state, not decided here:
+ *   - `Applicant` on `:Person` (schema-estate-agent.md)
+ *   - `Engineer` on `:Person` (schema-construction.md)
+ *   - `Supplier` on `:Organization` (schema-construction.md)
+ *   - `GuestProfile` on `:Person` (schema-hospitality.md)
+ *
+ * Adding a fifth member is an ontology decision: state it in the vertical's
+ * schema prose first, then add it here.
+ */
+exports.ADDITIONAL_BASE_LABELS = Object.freeze(new Set(['Applicant', 'Engineer', 'GuestProfile', 'Supplier']));
 exports.ALL_GRAPH_LABELS = Object.freeze(Object.keys(exports.GRAPH_LABEL_COLOURS));
 /**
  * Select the sublabel whose colour should drive the node hue. Walks the