@rubytech/create-realagent 1.0.705 → 1.0.707

package/dist/__tests__/apt-resolve.test.js

@@ -0,0 +1,179 @@
+// Task 638 — acceptance grid for apt-resolve.ts.
+//
+// Locks the four resolver branches from Task 637 plus the os-release parser
+// and Candidate-line extractor. Inputs are passed directly so no mocking is
+// needed — every test exercises pure logic with concrete fixtures captured
+// from real devices (Noble `apt-cache policy chromium`, Bookworm ditto,
+// Pop!_OS `/etc/os-release`).
+//
+// Runs via Node's built-in test runner; no vitest dependency. Compiles to
+// dist/__tests__/apt-resolve.test.js alongside the rest of the package so
+// `node --test dist/__tests__/*.test.js` picks it up after build.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { UBUNTU_ALIASES, parseOsRelease, isUbuntuLike, parseAptCacheCandidate, decideAptResolution, } from "../apt-resolve.js";
+// ---------------------------------------------------------------------------
+// Real fixtures — captured from devices the installer actually targets.
+// ---------------------------------------------------------------------------
+const UBUNTU_NOBLE_OS_RELEASE = `PRETTY_NAME="Ubuntu 24.04 LTS"
+NAME="Ubuntu"
+VERSION_ID="24.04"
+VERSION="24.04 LTS (Noble Numbat)"
+VERSION_CODENAME=noble
+ID=ubuntu
+ID_LIKE=debian
+HOME_URL="https://www.ubuntu.com/"
+UBUNTU_CODENAME=noble`;
+const DEBIAN_BOOKWORM_OS_RELEASE = `PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
+NAME="Debian GNU/Linux"
+VERSION_ID="12"
+VERSION="12 (bookworm)"
+VERSION_CODENAME=bookworm
+ID=debian
+HOME_URL="https://www.debian.org/"`;
+const POP_OS_OS_RELEASE = `NAME="Pop!_OS"
+VERSION="22.04 LTS"
+ID=pop
+ID_LIKE="ubuntu debian"
+PRETTY_NAME="Pop!_OS 22.04 LTS"
+VERSION_ID="22.04"
+VERSION_CODENAME=jammy
+UBUNTU_CODENAME=jammy`;
+// `apt-cache policy chromium` on Ubuntu Noble (the alias case Task 637 fixed).
+const NOBLE_CHROMIUM_POLICY = `chromium:
+  Installed: (none)
+  Candidate: (none)
+  Version table:`;
+// `apt-cache policy chromium` on Debian Bookworm (concrete .deb, no alias).
+const BOOKWORM_CHROMIUM_POLICY = `chromium:
+  Installed: (none)
+  Candidate: 120.0.6099.224-1~deb12u1
+  Version table:
+     120.0.6099.224-1~deb12u1 500
+        500 http://deb.debian.org/debian bookworm-security/main arm64 Packages`;
+// ---------------------------------------------------------------------------
+// parseOsRelease — every key/value pair lands, quoted values get unquoted.
+// ---------------------------------------------------------------------------
+test("parseOsRelease unquotes values and captures all keys", () => {
+    const noble = parseOsRelease(UBUNTU_NOBLE_OS_RELEASE);
+    assert.equal(noble.ID, "ubuntu");
+    assert.equal(noble.ID_LIKE, "debian");
+    assert.equal(noble.VERSION_CODENAME, "noble");
+    assert.equal(noble.NAME, "Ubuntu", "double-quoted values must be unquoted");
+    assert.equal(noble.PRETTY_NAME, "Ubuntu 24.04 LTS");
+});
+test("parseOsRelease handles space-separated ID_LIKE (Pop!_OS)", () => {
+    const pop = parseOsRelease(POP_OS_OS_RELEASE);
+    assert.equal(pop.ID, "pop");
+    assert.equal(pop.ID_LIKE, "ubuntu debian", "quoted multi-value must be preserved as a single string");
+});
+// ---------------------------------------------------------------------------
+// isUbuntuLike — Ubuntu, Pop!_OS pick up; Debian does not.
+// ---------------------------------------------------------------------------
+test("isUbuntuLike accepts Ubuntu directly and via ID_LIKE", () => {
+    assert.equal(isUbuntuLike(parseOsRelease(UBUNTU_NOBLE_OS_RELEASE)), true, "Ubuntu Noble: ID=ubuntu");
+    assert.equal(isUbuntuLike(parseOsRelease(POP_OS_OS_RELEASE)), true, "Pop!_OS: ID_LIKE contains ubuntu");
+    assert.equal(isUbuntuLike(parseOsRelease(DEBIAN_BOOKWORM_OS_RELEASE)), false, "Debian Bookworm: not Ubuntu-like");
+    assert.equal(isUbuntuLike({}), false, "empty os-release (read failed): not Ubuntu-like");
+});
+// ---------------------------------------------------------------------------
+// parseAptCacheCandidate — three states: real candidate, "(none)", absent.
+// ---------------------------------------------------------------------------
+test("parseAptCacheCandidate distinguishes real candidate, (none), and missing", () => {
+    assert.equal(parseAptCacheCandidate(BOOKWORM_CHROMIUM_POLICY), "120.0.6099.224-1~deb12u1");
+    assert.equal(parseAptCacheCandidate(NOBLE_CHROMIUM_POLICY), "(none)");
+    assert.equal(parseAptCacheCandidate(""), null, "empty stdout (spawn failed) → null");
+    assert.equal(parseAptCacheCandidate("totally unrelated text"), null, "no Candidate line → null");
+});
+// ---------------------------------------------------------------------------
+// decideAptResolution — the four resolver branches from Task 637.
+// ---------------------------------------------------------------------------
+test("decideAptResolution: dpkg-installed package returns pkg, no log", () => {
+    // Branch (1): dpkg -s exits 0 — name is concrete and installed.
+    const r = decideAptResolution({
+        pkg: "curl",
+        dpkgInstalled: true,
+        aptCandidate: null,
+        ubuntuLike: true,
+        distro: "ubuntu-noble",
+    });
+    assert.equal(r.resolved, "curl");
+    assert.equal(r.log, null);
+});
+test("decideAptResolution: real apt candidate returns pkg, no log (Bookworm chromium)", () => {
+    // Branch (2): apt-cache policy says there IS a real candidate — leave name
+    // alone, the post-check will use the same name.
+    const r = decideAptResolution({
+        pkg: "chromium",
+        dpkgInstalled: false,
+        aptCandidate: "120.0.6099.224-1~deb12u1",
+        ubuntuLike: false,
+        distro: "debian-bookworm",
+    });
+    assert.equal(r.resolved, "chromium");
+    assert.equal(r.log, null);
+});
+test("decideAptResolution: Noble chromium → chromium-browser with log line", () => {
+    // Branch (3): the load-bearing case Task 637 fixed.
+    const r = decideAptResolution({
+        pkg: "chromium",
+        dpkgInstalled: false,
+        aptCandidate: "(none)",
+        ubuntuLike: true,
+        distro: "ubuntu-noble",
+    });
+    assert.equal(r.resolved, "chromium-browser");
+    assert.match(r.log ?? "", /^  apt-resolve chromium → chromium-browser \(reason=candidate-none, distro=ubuntu-noble\)$/);
+});
+test("decideAptResolution: Bookworm + alias-keyed pkg + candidate-none returns pkg unchanged", () => {
+    // Branch (4) variant: not Ubuntu-like, so even an alias-keyed pkg falls
+    // through. Preserves Task 634's loud-failure contract — apt-get install
+    // will fail, post-check throws, operator sees the real diagnostic.
+    const r = decideAptResolution({
+        pkg: "chromium",
+        dpkgInstalled: false,
+        aptCandidate: "(none)",
+        ubuntuLike: false,
+        distro: "debian-bookworm",
+    });
+    assert.equal(r.resolved, "chromium");
+    assert.equal(r.log, null);
+});
+test("decideAptResolution: Ubuntu-like + non-aliased pkg + candidate-none returns pkg unchanged", () => {
+    // Branch (4) variant: Ubuntu-like host but the package isn't in the alias
+    // map. No invented mapping — fall through and let the post-check fail loudly.
+    const r = decideAptResolution({
+        pkg: "some-package-with-no-alias",
+        dpkgInstalled: false,
+        aptCandidate: "(none)",
+        ubuntuLike: true,
+        distro: "ubuntu-noble",
+    });
+    assert.equal(r.resolved, "some-package-with-no-alias");
+    assert.equal(r.log, null);
+});
+test("decideAptResolution: aptCandidate null (policy spawn failed) still allows alias resolution", () => {
+    // Edge case from Task 637: if `apt-cache policy` itself fails, we still want
+    // alias resolution on Ubuntu-like hosts. Treat null-candidate the same as
+    // candidate-none for the alias decision.
+    const r = decideAptResolution({
+        pkg: "chromium",
+        dpkgInstalled: false,
+        aptCandidate: null,
+        ubuntuLike: true,
+        distro: "ubuntu-noble",
+    });
+    assert.equal(r.resolved, "chromium-browser");
+    assert.match(r.log ?? "", /apt-resolve chromium → chromium-browser/);
+});
+// ---------------------------------------------------------------------------
+// UBUNTU_ALIASES — the alias map is the authoritative source. Locking its
+// shape so adding a new alias is a deliberate one-line PR, not a surprise.
+// ---------------------------------------------------------------------------
+test("UBUNTU_ALIASES contains chromium → chromium-browser and is the only entry", () => {
+    assert.equal(UBUNTU_ALIASES.chromium, "chromium-browser");
+    // If a future change adds another alias, this test fails loudly — the
+    // intent is "every new alias gets a deliberate test grid case", not silent
+    // expansion. Bump the count and add cases when adding a new alias.
+    assert.equal(Object.keys(UBUNTU_ALIASES).length, 1);
+});

package/dist/apt-resolve.js

@@ -0,0 +1,73 @@
+// Task 638 — pure apt-name resolution, extracted from index.ts so a unit
+// test can exercise every branch without spawning real apt/dpkg or reading
+// /etc/os-release. Mirrors the port-resolution.ts pattern from Task 666:
+// inputs in, decision out, no I/O. The installer wraps this with the actual
+// spawnSync calls and side-effecting logFile.
+//
+// The original logic landed in Task 637 (chromium-noble alias). This file
+// preserves that semantics verbatim — every branch maps 1:1.
+// Virtual-package aliases applied when `apt-cache policy <pkg>` returns
+// `Candidate: (none)`. Keyed by apt-level alias, valued by the real .deb
+// name dpkg records post-install. Scoped per distro family by the caller's
+// `ubuntuLike` input. Add entries here if a new alias class surfaces.
+export const UBUNTU_ALIASES = {
+    // Noble ships `chromium` as a virtual package that resolves to
+    // `chromium-browser`, which is itself a transitional stub delegating to
+    // the snap. The runtime binary at /usr/bin/chromium is a snap symlink;
+    // dpkg records `chromium-browser` post-install, never `chromium`.
+    chromium: "chromium-browser",
+};
+/** Parse `/etc/os-release` content into a key→value map. */
+export function parseOsRelease(raw) {
+    const out = {};
+    for (const line of raw.split("\n")) {
+        const m = line.match(/^([A-Z_]+)=(.*)$/);
+        if (m)
+            out[m[1]] = m[2].replace(/^"|"$/g, "");
+    }
+    return out;
+}
+/** True when the host is Ubuntu or Ubuntu-derivative (Pop!_OS, Mint, etc.). */
+export function isUbuntuLike(os) {
+    if (os.ID === "ubuntu")
+        return true;
+    const likes = (os.ID_LIKE ?? "").split(/\s+/);
+    return likes.includes("ubuntu");
+}
+/**
+ * Extract the Candidate field from `apt-cache policy <pkg>` stdout. Returns
+ * the literal string after `Candidate:` (so `(none)` stays as `(none)` —
+ * meaningful to the resolver, not a magic value). Returns null when no
+ * Candidate line is present (spawn failure, malformed output, etc.).
+ */
+export function parseAptCacheCandidate(stdout) {
+    const m = stdout.match(/Candidate:\s*(\S+)/);
+    return m ? m[1] : null;
+}
+/**
+ * Pure decision: given the dpkg/apt/os-release facts, decide which package
+ * name to use. Resolution order matches Task 637:
+ *   1. dpkg -s pkg succeeded → name is concrete and installed; return pkg.
+ *   2. apt-cache policy reports a real Candidate (not `(none)`) → return pkg.
+ *   3. Host is Ubuntu-like AND pkg is in UBUNTU_ALIASES → return the alias
+ *      and emit the log line.
+ *   4. Otherwise return pkg unchanged — caller's post-check will throw,
+ *      preserving Task 634's fail-loud contract for genuinely missing
+ *      packages.
+ */
+export function decideAptResolution(input) {
+    const { pkg, dpkgInstalled, aptCandidate, ubuntuLike, distro } = input;
+    if (dpkgInstalled)
+        return { resolved: pkg, log: null };
+    if (aptCandidate && aptCandidate !== "(none)") {
+        return { resolved: pkg, log: null };
+    }
+    if (ubuntuLike && Object.prototype.hasOwnProperty.call(UBUNTU_ALIASES, pkg)) {
+        const alias = UBUNTU_ALIASES[pkg];
+        return {
+            resolved: alias,
+            log: `  apt-resolve ${pkg} → ${alias} (reason=candidate-none, distro=${distro})`,
+        };
+    }
+    return { resolved: pkg, log: null };
+}

package/dist/index.js

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, rea
 import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { resolveInstallPortFromFs, buildMaxyUnitFile } from "./port-resolution.js";
+import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
 // Brand manifest — read from payload to derive all brand-specific installation values.
 // The bundler stamps brand.json into the payload at build time.
@@ -25,6 +26,14 @@ catch (err) {
 const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
 const LOG_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir, "logs");
 const LOG_FILE = join(LOG_DIR, `install-${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
+/** Known brand hostnames in the Maxy ecosystem. Each brand ships a main unit
+ *  (`<hostname>.service`) and a per-brand edge unit (`<hostname>-edge.service`,
+ *  Task 662). Peer-brand detection matches only these filenames — stale units,
+ *  gnome-keyring disable markers, and unrelated user services are not peer
+ *  evidence. When a third brand is added under `brands/`, append its hostname
+ *  here AND in the matching constant in `uninstall.ts` (intentional duplication
+ *  per `uninstall.ts:` "Shell helpers (duplicated from index.ts ...)" policy). */
+const KNOWN_BRAND_HOSTNAMES = ["maxy", "realagent"];
 // The device's actual hostname — may differ from BRAND.hostname if the user customized it.
 // Updated by installSystemDeps() after hostname setup; used for user-facing URLs.
 let DEVICE_HOSTNAME = BRAND.hostname;
@@ -210,50 +219,28 @@ function canSudo() {
 // Task 637 — resolve package-name aliases before probing dpkg, so the
 // post-install check no longer false-negatives when apt resolves a virtual
 // name (e.g. Noble's `chromium` → `chromium-browser`).
-// Virtual-package aliases applied when `apt-cache policy <pkg>` returns
-// `Candidate: (none)`. Keyed by apt-level alias, valued by the real .deb
-// name actually recorded in dpkg after install. Scoped per distro family
-// by the caller in `resolveAptName`. Add entries here if a new alias class
-// surfaces — no code surgery needed.
-const UBUNTU_ALIASES = {
-    // Noble ships `chromium` as a virtual package that resolves to
-    // `chromium-browser`, which is itself a transitional stub delegating to
-    // the snap. The runtime binary at /usr/bin/chromium is a snap symlink;
-    // dpkg records `chromium-browser` post-install, never `chromium`.
-    chromium: "chromium-browser",
-};
+// UBUNTU_ALIASES, parseOsRelease, isUbuntuLike, and decideAptResolution moved
+// to ./apt-resolve.ts (Task 638). The pure logic lives there so a unit test
+// can hit every branch without spawning real apt/dpkg or reading
+// /etc/os-release. The thin wrappers below feed real spawn + fs results into
+// that pure decision.
 function readOsRelease() {
     try {
-        const raw = readFileSync("/etc/os-release", "utf-8");
-        const out = {};
-        for (const line of raw.split("\n")) {
-            const m = line.match(/^([A-Z_]+)=(.*)$/);
-            if (m)
-                out[m[1]] = m[2].replace(/^"|"$/g, "");
-        }
-        return out;
+        return parseOsRelease(readFileSync("/etc/os-release", "utf-8"));
     }
     catch {
         return {};
     }
 }
-function isUbuntuLike() {
-    const os = readOsRelease();
-    if (os.ID === "ubuntu")
-        return true;
-    const likes = (os.ID_LIKE ?? "").split(/\s+/);
-    return likes.includes("ubuntu");
-}
 /** Summarise `apt-cache policy` output for diagnostics — one token per package. */
 function aptCachePolicySummary(pkg) {
     const r = spawnSync("apt-cache", ["policy", pkg], { stdio: "pipe", encoding: "utf-8", timeout: 5_000 });
     if (r.status !== 0)
         return "policy-spawn-failed";
-    const out = r.stdout ?? "";
-    const cand = out.match(/Candidate:\s*(\S+)/);
-    if (!cand)
+    const cand = parseAptCacheCandidate(r.stdout ?? "");
+    if (cand === null)
         return "no-candidate-line";
-    return cand[1] === "(none)" ? "candidate-none" : `candidate=${cand[1]}`;
+    return cand === "(none)" ? "candidate-none" : `candidate=${cand}`;
 }
 /**
  * Task 637 — map an apt-level package name to the concrete name dpkg will
@@ -269,24 +256,30 @@ function aptCachePolicySummary(pkg) {
  */
 function resolveAptName(pkg) {
     const dpkg = spawnSync("dpkg", ["-s", pkg], { stdio: "pipe", timeout: 5_000 });
-    if (dpkg.status === 0)
+    const dpkgInstalled = dpkg.status === 0;
+    // Short-circuit: when dpkg already records the name as installed, skip the
+    // apt-cache + os-release work — `decideAptResolution` returns pkg unchanged
+    // anyway and the extra spawn would burn ~10 ms per already-installed
+    // package across every `pkgsMissing` pass.
+    if (dpkgInstalled)
         return pkg;
     const policy = spawnSync("apt-cache", ["policy", pkg], {
         stdio: "pipe", encoding: "utf-8", timeout: 5_000,
     });
-    if (policy.status === 0) {
-        const cand = (policy.stdout ?? "").match(/Candidate:\s*(\S+)/);
-        if (cand && cand[1] !== "(none)")
-            return pkg;
-    }
-    if (isUbuntuLike() && Object.prototype.hasOwnProperty.call(UBUNTU_ALIASES, pkg)) {
-        const alias = UBUNTU_ALIASES[pkg];
-        const os = readOsRelease();
-        const distro = `${os.ID ?? "unknown"}-${os.VERSION_CODENAME ?? "unknown"}`;
-        logFile(`  apt-resolve ${pkg} → ${alias} (reason=candidate-none, distro=${distro})`);
-        return alias;
-    }
-    return pkg;
+    const aptCandidate = policy.status === 0
+        ? parseAptCacheCandidate(policy.stdout ?? "")
+        : null;
+    const os = readOsRelease();
+    const decision = decideAptResolution({
+        pkg,
+        dpkgInstalled,
+        aptCandidate,
+        ubuntuLike: isUbuntuLikePure(os),
+        distro: `${os.ID ?? "unknown"}-${os.VERSION_CODENAME ?? "unknown"}`,
+    });
+    if (decision.log)
+        logFile(decision.log);
+    return decision.resolved;
 }
 /** Probe runtime binary presence on PATH (independent of dpkg-recorded state). */
 function commandVPath(pkg) {
@@ -432,10 +425,19 @@ function installSystemDeps() {
         // set by the user or the first installer — subsequent brands must not overwrite it.
         const systemdUserDir = resolve(process.env.HOME ?? "/root", ".config/systemd/user");
         const serviceExists = existsSync(join(systemdUserDir, BRAND.serviceName));
+        // Task 690: narrow peer detection to KNOWN_BRAND_HOSTNAMES. The previous
+        // predicate ("any *.service that isn't ours") matched stray user units
+        // such as a `gnome-keyring-daemon.service -> /dev/null` disable marker,
+        // silently flipping single-brand fresh installs into the "preserve hostname"
+        // branch. Mirrors Task 683's `peerBrandPresent` allowlist in `uninstall.ts`.
         let otherBrandService = false;
         if (!serviceExists) {
+            const peerUnits = KNOWN_BRAND_HOSTNAMES
+                .filter((h) => h !== BRAND.hostname)
+                .flatMap((h) => [`${h}.service`, `${h}-edge.service`]);
             try {
-                otherBrandService = readdirSync(systemdUserDir).some(f => f.endsWith(".service") && f !== BRAND.serviceName);
+                const files = new Set(readdirSync(systemdUserDir));
+                otherBrandService = peerUnits.some((unit) => files.has(unit));
             }
             catch { /* directory may not exist on a fresh device — not an error */ }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.705",
+  "version": "1.0.707",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"
@@ -9,8 +9,8 @@
   "scripts": {
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
-    "test": "npm run build && node --test dist/__tests__/port-canonicalisation.test.js",
-    "prepublishOnly": "node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
+    "prepublishOnly": "node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-cypher-parser.test.d.ts.map

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-cypher-parser.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/schema-cypher-parser.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.js

@@ -0,0 +1,89 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const schema_cypher_parser_js_1 = require("../schema-cypher-parser.js");
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: extracts labels from constraint and index forms", () => {
+    const text = `
+CREATE CONSTRAINT person_email IF NOT EXISTS
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+
+CREATE CONSTRAINT business_account IF NOT EXISTS
+FOR (b:LocalBusiness) REQUIRE b.accountId IS UNIQUE;
+
+CREATE INDEX admin_user_account IF NOT EXISTS
+FOR (au:AdminUser) ON (au.accountId);
+
+CREATE INDEX knowledge_doc IF NOT EXISTS
+FOR (k:KnowledgeDocument) ON (k.embedding) OPTIONS { ... };
+`;
+    const labels = (0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text);
+    strict_1.default.deepEqual(labels, [
+        "AdminUser",
+        "KnowledgeDocument",
+        "LocalBusiness",
+        "Person",
+    ]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: deduplicates labels declared multiple times", () => {
+    const text = `
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+FOR (p:Person) REQUIRE p.telephone IS UNIQUE;
+FOR (p:Person) ON (p.status);
+`;
+    strict_1.default.deepEqual((0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text), ["Person"]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: returns sorted output", () => {
+    const text = `FOR (z:Zebra) ON (z.x); FOR (a:Aardvark) ON (a.x); FOR (m:Mongoose) ON (m.x);`;
+    strict_1.default.deepEqual((0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text), [
+        "Aardvark",
+        "Mongoose",
+        "Zebra",
+    ]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: ignores non-constraint cypher", () => {
+    const text = `
+MATCH (n:Person) RETURN n;
+CREATE (b:Business { name: 'X' });
+FOR (p:Person) REQUIRE p.email IS UNIQUE;
+`;
+    // MATCH/CREATE patterns don't include FOR, so they're ignored.
+    strict_1.default.deepEqual((0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(text), ["Person"]);
+});
+(0, node_test_1.default)("parseLabelsFromSchemaCypher: empty input returns empty array", () => {
+    strict_1.default.deepEqual((0, schema_cypher_parser_js_1.parseLabelsFromSchemaCypher)(""), []);
+});
+(0, node_test_1.default)("levenshtein: identical strings", () => {
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("Person", "Person"), 0);
+});
+(0, node_test_1.default)("levenshtein: substitution distance", () => {
+    // LocaIBusiness vs LocalBusiness — capital-I-as-l typo from the incident.
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("LocaIBusiness", "LocalBusiness"), 1);
+});
+(0, node_test_1.default)("levenshtein: insertion + deletion", () => {
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("Person", "Persons"), 1);
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("Persons", "Person"), 1);
+});
+(0, node_test_1.default)("levenshtein: handles empty strings", () => {
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("", "abc"), 3);
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("abc", ""), 3);
+    strict_1.default.equal((0, schema_cypher_parser_js_1.levenshtein)("", ""), 0);
+});
+(0, node_test_1.default)("nearestLabel: finds the closest match", () => {
+    const candidates = ["Person", "LocalBusiness", "AdminUser"];
+    strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("LocaIBusiness", candidates), "LocalBusiness");
+    strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("AdminUsr", candidates), "AdminUser");
+});
+(0, node_test_1.default)("nearestLabel: returns null when no match within maxDistance", () => {
+    const candidates = ["Person", "LocalBusiness"];
+    strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("Quokka", candidates), null);
+    // Default maxDistance is 3; "abcde" is too far from any candidate.
+    strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("abcde", candidates, 1), null);
+});
+(0, node_test_1.default)("nearestLabel: empty candidates returns null", () => {
+    strict_1.default.equal((0, schema_cypher_parser_js_1.nearestLabel)("Person", []), null);
+});
+//# sourceMappingURL=schema-cypher-parser.test.js.map

package/payload/platform/lib/graph-mcp/dist/__tests__/schema-cypher-parser.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-cypher-parser.test.js","sourceRoot":"","sources":["../../src/__tests__/schema-cypher-parser.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,wEAIoC;AAEpC,IAAA,mBAAI,EAAC,8EAA8E,EAAE,GAAG,EAAE;IACxF,MAAM,IAAI,GAAG;;;;;;;;;;;;CAYd,CAAC;IACA,MAAM,MAAM,GAAG,IAAA,qDAA2B,EAAC,IAAI,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,WAAW;QACX,mBAAmB;QACnB,eAAe;QACf,QAAQ;KACT,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,+EAA+E,CAAC;IAC7F,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE;QAClD,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG;;;;CAId,CAAC;IACA,+DAA+D;IAC/D,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAA2B,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,0EAA0E;IAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mCAAmC,EAAE,GAAG,EAAE;IAC7C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAW,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5D,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,eAAe,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,UAAU,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,mEAAmE;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,gBAAM,CAAC,KAAK,CAAC,IAAA,sCAAY,EAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC"}

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared parser for `platform/neo4j/schema.cypher`.
+ *
+ * Two consumers today:
+ *   1. The admin SCHEMA prompt block (`platform/ui/app/lib/admin-schema-block.ts`,
+ *      Task 703) renders labels declared in schema.cypher into the agent's
+ *      system prompt.
+ *   2. The memory-plugin schema validator (Task 736) treats schema.cypher
+ *      declarations as the "promise" half of the recognised-label set —
+ *      labels that exist as constraints/indexes but may not yet have a node
+ *      in the graph (fresh-install bootstrap).
+ *
+ * The previous home was admin-schema-block.ts; that owner was wrong as
+ * soon as a second consumer arrived. Lifting here keeps a single source of
+ * truth and removes the cross-package shape coupling.
+ *
+ * Also exports a compact `levenshtein` for "did you mean?" suggestions on
+ * unknown labels — used by the memory-plugin validator. The graph-mcp
+ * cypher validator has its own copy in schema-cache.ts (private to the
+ * stale-miss heuristic); the duplication is intentional, since this
+ * exported one targets human-readable error UX, not refresh debouncing.
+ */
+/**
+ * Extract every Neo4j label declared in a `schema.cypher` file by scanning
+ * `FOR (alias:Label)` constraint and index forms. Returns a sorted, de-duped
+ * list. Pure function — no I/O.
+ */
+export declare function parseLabelsFromSchemaCypher(schemaCypher: string): string[];
+/**
+ * Standard iterative-DP Levenshtein. Used to suggest a near-match when an
+ * agent submits an unknown label — small alphabets, short strings, runs in
+ * microseconds. Identical algorithm to the private copy in schema-cache.ts;
+ * exported here so callers outside graph-mcp don't have to roll their own.
+ */
+export declare function levenshtein(a: string, b: string): number;
+/**
+ * Find the closest label in `candidates` to `unknown` by edit distance.
+ * Returns null when the closest match is further than `maxDistance` (default
+ * 3) — beyond that a suggestion is more confusing than helpful.
+ */
+export declare function nearestLabel(unknown: string, candidates: Iterable<string>, maxDistance?: number): string | null;
+//# sourceMappingURL=schema-cypher-parser.d.ts.map

package/payload/platform/lib/graph-mcp/dist/schema-cypher-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-cypher-parser.d.ts","sourceRoot":"","sources":["../src/schema-cypher-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAM1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBxD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC5B,WAAW,SAAI,GACd,MAAM,GAAG,IAAI,CAYf"}