@superblocksteam/vite-plugin-file-sync 2.0.149 → 2.0.150-next.0

package/dist/ai-service/agent/prompts/api-prompts.js

@@ -325,7 +325,7 @@ When using integrations in SDK APIs:
 1. **Use integration IDs** (UUIDs), not display names - IDs are stable identifiers that won't break if integrations are renamed
 2. **Get the ID from the integrations panel** - each integration has a unique ID visible in its settings
 3. **Store IDs in constants** with descriptive names at the top of the API file for clarity
-4. **Choose a descriptive \`integrations\` map key** — a valid JS identifier derived from the integration's display name / Native DB \`logicalName\` (lowercase snake_case). Normalize: lowercase → replace non-alphanumeric with \`_\` → collapse \`_\` → if empty/starts with a digit/reserved word, prefix \`db_\`. Examples: \`pokemon_tracker\` → \`pokemon_tracker\`; \`Orders DB\` → \`orders_db\`; \`2024-orders\` → \`db_2024_orders\`. If two integrations would share a key, disambiguate (e.g. \`orders_db\` / \`orders_db_2\`). Do **not** use a generic placeholder like \`db\` when the integration already has a meaningful name — that key is what appears in generated code and TraceView. SDK README examples that use \`db\` are placeholders only.
+4. **Choose a descriptive \`integrations\` map key** — a valid JS identifier derived from the integration's display name / App Database \`logicalName\` (lowercase snake_case). Normalize: lowercase → replace non-alphanumeric with \`_\` → collapse \`_\` → if empty/starts with a digit/reserved word, prefix \`db_\`. Examples: \`pokemon_tracker\` → \`pokemon_tracker\`; \`Orders DB\` → \`orders_db\`; \`2024-orders\` → \`db_2024_orders\`. If two integrations would share a key, disambiguate (e.g. \`orders_db\` / \`orders_db_2\`). Do **not** use a generic placeholder like \`db\` when the integration already has a meaningful name — that key is what appears in generated code and TraceView. SDK README examples that use \`db\` are placeholders only.
 
 Example:
 \`\`\`typescript

package/dist/ai-service/agent/prompts/build-base-system-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-base-system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-base-system-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAOpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAStD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,wBAAwB,EAAE,OAAO,CAAC;IAClC,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,aAAa,CAAC;CAC1D;AAED,eAAO,MAAM,qBAAqB,GAChC,QAAQ,eAAe,EACvB,OAAO,MAAM,EACb,eAAe,MAAM,EACrB,sBAAsB,MAAM,EAC5B,yBAAyB,MAAM,EAC/B,iBAAiB,cAAc,EAC/B,mCAAiC,WAyVlC,CAAC"}
+{"version":3,"file":"build-base-system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-base-system-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAQpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAStD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,wBAAwB,EAAE,OAAO,CAAC;IAClC,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,aAAa,CAAC;CAC1D;AAED,eAAO,MAAM,qBAAqB,GAChC,QAAQ,eAAe,EACvB,OAAO,MAAM,EACb,eAAe,MAAM,EACrB,sBAAsB,MAAM,EAC5B,yBAAyB,MAAM,EAC/B,iBAAiB,cAAc,EAC/B,mCAAiC,WA4WlC,CAAC"}

package/dist/ai-service/agent/prompts/build-base-system-prompt.js

@@ -1,11 +1,13 @@
 import { PROTECTED_CORE_PACKAGES } from "@superblocksteam/library-shared/types";
 import { SUPERBLOCKS_LIVE_GIT_BRANCH } from "@superblocksteam/shared";
 import { getErrorMeta, getPrefixedLogger } from "../../../util/logger.js";
+import { isManagedNativeDbAvailableForClark } from "../../managed-native-db-availability.js";
 import { buildSystemSkillExclusions } from "../../migration-prompt-gating.js";
 import { generateSkillsXml } from "../../skills/index.js";
 import { buildYamlApiSection, buildSdkApiSection, buildApiToolGuidance, } from "./api-prompts.js";
 const logger = getPrefixedLogger("[build-base-system-prompt]");
 export const buildBaseSystemPrompt = (config, mode, factsSection, appKnowledgeSection, onDemandKnowledgeIndex, registryPolicy, v2ToV3MigrationInProgress = false) => {
+    const managedNativeDbAvailable = isManagedNativeDbAvailableForClark(config);
     const superblocksDocsGuidance = config.features.superblocksDocsMcpEnabled
         ? "For Superblocks product documentation, use the `search_superblocks_docs` tool first for setup, integration, and platform behavior questions. If the docs MCP result is missing or incomplete, then use `web_fetch` against `https://docs.superblocks.com` and, if needed, discover pages via `https://docs.superblocks.com/sitemap.xml`.\nWhen referring to Superblocks pages in your response, always include relative links: [Integrations](/integrations) for the integrations page, or [Integration Name](/integrations/{slug}) for a specific integration (e.g., [Salesforce](/integrations/salesforce), [PostgreSQL](/integrations/postgres))."
         : "For Superblocks product documentation, prefer `https://docs.superblocks.com` as the primary source. If you need to discover the right page first, use the sitemap at `https://docs.superblocks.com/sitemap.xml`, then fetch the specific docs page you need.";
@@ -21,7 +23,7 @@ The current mode and plan approval status will be given to you in the <current_m
 In 'Plan' mode, your goal is to help the user understand and interact with their application, and the data and integrations available to them.
 
 **Plan Mode Behavior:**
-- **Without approved plan**: You can use read-only tools freely, plus a small set of product-scoped tools — notably ${config.features.clarkAttachmentDownloadEnabled ? "`listAttachments` and `downloadAttachments` (which materialize uploaded attachments into a private scratch directory), " : ""}\`exitPlanMode\` (to propose a plan for approval)${config.features.managedNativeDbEnabled ? ", and the read-only Native DB background-task companions `checkTask` and `waitForTask` (so you can observe progress of any tasks the user started before entering Plan mode)" : ""}, and debug/interactive tools the UI may expose. You cannot otherwise make changes to the user's application files or production data${config.features.managedNativeDbEnabled ? " — including provisioning a dev database or applying SQL migrations, which require an approved plan" : ""}. Answer questions, provide suggestions, inspect attachments, and when appropriate, present plans using the exitPlanMode tool.
+- **Without approved plan**: You can use read-only tools freely, plus a small set of product-scoped tools — notably ${config.features.clarkAttachmentDownloadEnabled ? "`listAttachments` and `downloadAttachments` (which materialize uploaded attachments into a private scratch directory), " : ""}\`exitPlanMode\` (to propose a plan for approval)${managedNativeDbAvailable ? ", and the read-only App Database background-task companions `checkTask` and `waitForTask` (so you can observe progress of any tasks the user started before entering Plan mode)" : ""}, and debug/interactive tools the UI may expose. You cannot otherwise make changes to the user's application files or production data${managedNativeDbAvailable ? " — including provisioning a dev database or applying SQL migrations, which require an approved plan" : ""}. Answer questions, provide suggestions, inspect attachments, and when appropriate, present plans using the exitPlanMode tool.
 - **With approved plan**: When the user accepts one of your plans, you gain access to all tools and can execute the plan by making the necessary changes. You remain in Plan mode throughout execution.
 
 **Integrations:**
@@ -52,12 +54,15 @@ Edits to unread files will be rejected.
 **Remembering Application Knowledge:**
 If the user says "/remember", "remember this", "always use X", "make sure you never Y", or otherwise asks you to save a persistent preference or rule about this application, first check existing knowledge entries via available read tools (\`build_readFile\` over \`skills/app/*\` and relevant on-demand knowledge files) and avoid drafting duplicates. Then call \`rememberKnowledge\` to draft entries for approval only when net-new or revised knowledge is needed.
 
-${config.features.managedNativeDbEnabled
+${managedNativeDbAvailable
             ? `**Dev Database Lifecycle:**
 You can provision and manage lifecycle-controlled dev databases for the application in Build mode (or in Plan mode with an approved plan). Side-effecting kickoff tools are off-limits in unapproved Plan mode, so when you are in Plan mode and the user needs a database, propose a plan that includes these steps.
-- \`provisionDatabase\` — Create or reuse a lifecycle-managed dev database binding on Amazon RDS. Returns a taskId IMMEDIATELY while RDS provisioning runs in the background.
+You cannot delete App Database bindings. Explain that deletion is not supported here and direct the user to the Superblocks admin console or support; use the database lifecycle tools only to provision, migrate, or check a binding's status.
+- \`provisionDatabase\` — Create or reuse a dev App Database binding on Amazon RDS. Returns a taskId IMMEDIATELY while RDS provisioning runs in the background.
 - \`startApplyDevDatabaseMigrations\` — Run the binding's SQL migrations. Required after \`provisionDatabase\` if any application tables need to exist; provisioning only creates an empty RDS database.
 - \`checkTask\` (read-only, instant) and \`waitForTask\` (read-only, blocking) — Observe progress. PREFER \`checkTask\` and keep working on unrelated steps while a task runs; only fall back to \`waitForTask\` when \`checkTask\` still reports \`state='running'\` AND you literally have no other useful work to do.
+- After \`checkTask\` or \`waitForTask\` reports the provisioning task completed, use only the \`integrationId\` from that task result for this App Database.
+- If \`provisionDatabase\` itself reports failure, or \`checkTask\` or \`waitForTask\` reports the provisioning task failed, report the error and stop all database-dependent work. This failure policy overrides the general integration guidance above: do not call \`searchIntegrations\` or \`openIntegrationSetup\`, and do not substitute an existing Postgres integration. Only if the user explicitly asks to use a different datasource may you use those tools or an existing integration to select or configure that requested alternative.
 
 **SQL migration contents:**
 - Migration \`.sql\` files (e.g. under \`db/migrations/\`) apply in **edit/preview and deployed** environments.
@@ -212,7 +217,7 @@ ${superblocksDocsGuidance}
 
 **Before installing any package, check it with \`build_lookupNpmPackage\`** to verify it exists in the configured registry and that you are using a recent version.
 
-${buildRegistryPolicyParagraph(registryPolicy)}
+${buildRegistryPolicyParagraph(registryPolicy, config.features.packageInstallGateEnabled === true)}
 <safety_guidance>
 ${safetyGuidance}
 </safety_guidance>
@@ -237,7 +242,13 @@ ALWAYS read components using tools like \`grep\` and \`glob\` when you do not ha
    - Leaving orphaned files is unprofessional and creates technical debt
    - If unsure whether a file is used, check with grep/glob first, then delete if unused
    - Always provide clear context in deletion requests (what's being deleted and why)
-   - Note: The tool will automatically prompt users for API and page deletions (except Page1), so be confident in your deletions
+   - Note: The tool will automatically prompt users for API and page deletions, so be confident in your deletions
+
+**Page names must DESCRIBE the page:**
+   - A new app starts with one empty page at \`pages/Home\` wired as the \`/\` index route — build the app's landing content there and keep it named \`Home\` unless the user asks for something else
+   - In a multi-page app, every page you add beyond that one gets a descriptive PascalCase name for what it shows (e.g. \`Dashboard\`, \`Inventory\`, \`TopBuilders\`) — page names are user-visible in the editor's page switcher, so name them the way you'd label a nav item
+   - Rename the starter page only if the app's landing route is really something other than a home page (e.g. \`Overview\`): \`build_renameFile\` every file under \`pages/Home/\` into the new directory, rename the page component to match, and update the import in \`router.tsx\`, keeping it as the \`/\` index route
+   - NEVER name a page \`Page1\` (or \`Page2\`, \`Page3\`, ...)
 
 **Seeking user input is CRITICAL:**
    - When dealing with a persistent error, before deciding to change approach (eg switch to mock data, simplify UI, etc), ALWAYS check in with the user first
@@ -288,7 +299,11 @@ Use \`build_manageChecklist\` to give the user real-time visibility into your pr
 
 **How to manage checklist items:**
 - Break complex tasks into specific, actionable items — not vague descriptions
-- Mark an item \`in_progress\` BEFORE starting work on it; only have one \`in_progress\` at a time
+- Mark an item \`in_progress\` BEFORE starting work on it
+- Keep one hands-on item \`in_progress\` at a time${managedNativeDbAvailable
+            ? `
+- An item waiting on a background task (e.g. \`provisionDatabase\`) is the exception: leave it \`in_progress\` while the task runs and mark the next hands-on item \`in_progress\` too, so the user sees both moving at once`
+            : ""}
 - Mark items \`completed\` immediately after finishing — do not batch completions
 - Only add items you intend to complete — unfinished items block \`build_finalize\`
 - If a task cannot be completed, mark it \`failed\` with a \`failureReason\` — never leave items stuck as \`pending\` or \`in_progress\`
@@ -683,6 +698,7 @@ ${sdkApiEnabled ? "" : buildYamlApiSection()}
 You **must** use \`react-router@7\` in data mode for routing. The framework and declarative modes are **not** supported.
 Standard patterns apply: \`useNavigate()\`, \`useParams()\`, \`useSearchParams()\`.
 If you add new pages or rename page files or export names, you **must** update the router.
+The starter \`pages/Home\` page is bound to the \`/\` index route; keep an index route wired to whichever page is the app's landing page.
 </navigation>
 
 <component_usage_guidance>
@@ -930,9 +946,21 @@ You should always attempt to use an existing component before creating a new one
 </design_system_guidance>
 `;
 }
-function buildRegistryPolicyParagraph(registryPolicy) {
+function buildVulnerablePackageGuidance() {
+    return `If \`build_installPackages\` succeeds, treat its security decision as final. Do not volunteer vulnerability claims from your own knowledge; only communicate security findings explicitly returned by the tool.
+If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`vulnerable_package\`:
+- Malware findings: never retry or override — choose a different reputable package.
+- CVE findings: the tool may already have triaged exploitability. If install is still blocked, try at most a couple of different reputable replacements that serve the same purpose (prefer packages/versions older than 7 days), install each via \`build_installPackages\` (they are re-checked), and briefly mention any replacement you used in normal narration — do not over-explain security.
+- If a replacement works and you still complete the user's request, do not surface the blocked package to the builder when they did not name it.
+- If no replacement works and the builder did not name the package, explain only the capability that could not ship — no proceed option.
+- If \`userRequested\` is true on the tool result (the package name appears in the user's triggering message), warn the builder, ask for a short reason if they still want it, then call \`build_installPackages\` again with the same packages and \`proceedWithReason\` set to that reason (this shows a confirmation prompt). Never invent a proceed reason.`;
+}
+function buildRegistryPolicyParagraph(registryPolicy, packageInstallGateEnabled) {
     if (!registryPolicy)
         return "";
+    const vulnerablePackageGuidance = packageInstallGateEnabled
+        ? buildVulnerablePackageGuidance()
+        : "";
     // Degraded branch: the registry-config service was unreachable when this
     // turn started, so we genuinely do not know whether the org has a private
     // registry. Tell Clark to avoid `npm install` if possible and to frame any
@@ -940,7 +968,7 @@ function buildRegistryPolicyParagraph(registryPolicy) {
     // public-npm advice path, which would be wrong for a previously-configured
     // org during a config-service outage.
     if (registryPolicy.source === "unreachable") {
-        return `Your organization's npm registry configuration is temporarily unavailable. Avoid running \`npm install\` if possible; if the user insists, advise that installs may fail and the failure may be transient — do not retry aggressively, and do not tell the user the package is missing from a public or private registry on the basis of a single failure.
+        return `Your organization's npm registry configuration is temporarily unavailable. Avoid running \`npm install\` if possible; if the user insists, advise that installs may fail and the failure may be transient — do not retry aggressively, and do not tell the user the package is missing from a public or private registry on the basis of a single failure. ${vulnerablePackageGuidance}
 
 `;
     }
@@ -949,11 +977,11 @@ function buildRegistryPolicyParagraph(registryPolicy) {
         // constant so the prompt can never drift from what the tool layer and
         // the DevServerErrorOverlay enforce.
         const protectedPackagesPhrase = PROTECTED_CORE_PACKAGES.map((name) => `\`${name}\``).join(", ");
-        return `Your organization uses a private npm registry. Only packages available in that registry can be installed. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`not_in_registry\`, do not retry — explain to the user that the package isn't available and suggest they ask their org admin to add it. Never suggest uninstalling, replacing, or refactoring the app away from core dependencies — any \`@superblocksteam/*\` package, plus ${protectedPackagesPhrase}. If a core dependency is unavailable in the registry, the only fix is for an org admin to make it available there.
+        return `Your organization uses a private npm registry. Only packages available in that registry can be installed. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`not_in_registry\`, do not retry — explain to the user that the package isn't available and suggest they ask their org admin to add it. Never suggest uninstalling, replacing, or refactoring the app away from core dependencies — any \`@superblocksteam/*\` package, plus ${protectedPackagesPhrase}. If a core dependency is unavailable in the registry, the only fix is for an org admin to make it available there. ${vulnerablePackageGuidance}
 
 `;
     }
-    return `Packages are installed from the public npm registry. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`registry_unreachable\`, do not retry — explain that npm is unreachable.
+    return `Packages are installed from the public npm registry. If \`build_installPackages\` returns \`NpmInstallBlocked\` with reason \`registry_unreachable\`, do not retry — explain that npm is unreachable. ${vulnerablePackageGuidance}
 
 `;
 }

package/dist/ai-service/agent/prompts/build-base-system-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-base-system-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-base-system-prompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;AAkB/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAuB,EACvB,IAAa,EACb,YAAqB,EACrB,mBAA4B,EAC5B,sBAA+B,EAC/B,cAA+B,EAC/B,yBAAyB,GAAG,KAAK,EACjC,EAAE;IACF,MAAM,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,yBAAyB;QACvE,CAAC,CAAC,snBAAsnB;QACxnB,CAAC,CAAC,8PAA8P,CAAC;IAEnQ,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,GAAG;;;;;;;;;;sHAUuG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,yHAAyH,CAAC,CAAC,CAAC,EAAE,oDAAoD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,8KAA8K,CAAC,CAAC,CAAC,EAAE,wIAAwI,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE;;;;;;;;EAS90B,MAAM,CAAC,QAAQ,CAAC,uBAAuB;YACrC,CAAC,CAAC;;;;;;;;;;;qLAW+K;YACjL,CAAC,CAAC,EACN;;;;;;;;;;EAWE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;YACpC,CAAC,CAAC;;;;;;;;;;CAUL;YACG,CAAC,CAAC,EACN,GACM,MAAM,CAAC,QAAQ,CAAC,gBAAgB;YAC9B,CAAC,CAAC;;;;;;;sCAQE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,6BACN;uEAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,uGAAuG;gBACzG,CAAC,CAAC,kFACN;2CAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,uDACN;0lBAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OACtD;;;EAIR,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC;;;yFAGmF,2BAA2B;qEAC/C,2BAA2B;iJACiD,2BAA2B;;;wGAGpE,2BAA2B;;CAElI;gBACG,CAAC,CAAC;0PACoP,2BAA2B,sDAAsD,2BAA2B;CAEtW;CACC;YACO,CAAC,CAAC;;CAGN;;CAEH,CAAC;IACA,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IAElE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC;IAC7D,MAAM,uBAAuB,GAC3B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,KAAK,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAElD,8EAA8E;IAC9E,MAAM,cAAc,GAAG,SAAS;QAC9B,CAAC,CAAC,yBAAyB,CACvB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,CAC1B;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,cAAc,KAAK,IAAI,CAAC;IAE7C,oFAAoF;IACpF,MAAM,gBAAgB,GAAG,YAAY;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;QAC5D,oBAAoB,EAAE,CAAC,CAAC,YAAY;QACpC,uBAAuB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;QAClD,oBAAoB,EAAE,CAAC,CAAC,sBAAsB;QAC9C,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,IAAI,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CACL,QAAQ;QACR,MAAM,CAAC;;WAEA,WAAW;;;;;;;;;;;;EAYpB,mBAAmB,CAAC,YAAY,EAAE,mBAAmB,CAAC;;;;;;EAOtD,MAAM,CAAC,QAAQ,CAAC,8BAA8B;YAC5C,CAAC,CAAC;;;;;;;;;;;;;;;;6JAiBE,uBAAuB;gBACrB,CAAC,CAAC;sUAC0T;gBAC5T,CAAC,CAAC,EACN;gIAC0H;YAC5H,CAAC,CAAC;;2FAGN;;;EAGE,cAAc,IAAI,EAAE;EACpB,sBAAsB,CAAC,CAAC,CAAC,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BpF,uBAAuB;;;;EAIvB,4BAA4B,CAAC,cAAc,CAAC;;EAE5C,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsFd,gBAAgB;EAChB,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;;;;;;EAMtE,oBAAoB,CAAC,aAAa,CAAC;;CAEpC,CACE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,YAAqB,EACrB,mBAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,CAAC,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,mBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CACT,kCAAkC,KAAK,CAAC,MAAM,OAAO,uBAAuB,aAAa,CAC1F,CAAC;QACF,MAAM,iBAAiB,GACrB,kGAAkG;YAClG,iGAAiG;YACjG,0GAA0G,CAAC;QAC7G,KAAK;YACH,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;gBAClE,iBAAiB,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,aAAsB,EACtB,uBAAgC,EAChC,yBAAkC;IAElC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;YAC/C,aAAa;YACb,uBAAuB;YACvB,yBAAyB;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,iBAAiB,CACjC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;QAEF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,oEAAoE,CACrE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAEjD,MAAM,gBAAgB,GAAG,aAAa;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC;;;;;;;;;CASd,CAAC;QAEE,OAAO,MAAM,CAAC;;;;;;;EAOhB,SAAS;;;EAGT,gBAAgB;;;;;;;;;;;;;;;;CAgBjB,CAAC;IACA,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,0EAA0E,EAC1E,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,cAAsB;IAC5D,OAAO,MAAM,CAAC;;;;;;;;;EASd,cAAc;;;;;;;;CAQf,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CAAC,aAAsB;IAC3D,OAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2Od,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2P3C,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,cAA+B;IACnE,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAC;IAE/B,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO;;CAEV,CAAC;IACA,CAAC;IAED,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;QAC5C,yEAAyE;QACzE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,GAAG,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,kcAAkc,uBAAuB;;CAEne,CAAC;IACA,CAAC;IAED,OAAO;;CAER,CAAC;AACF,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAC;;;;;;;;CAQtC,CAAC"}
+{"version":3,"file":"build-base-system-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-base-system-prompt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;AAkB/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,MAAuB,EACvB,IAAa,EACb,YAAqB,EACrB,mBAA4B,EAC5B,sBAA+B,EAC/B,cAA+B,EAC/B,yBAAyB,GAAG,KAAK,EACjC,EAAE;IACF,MAAM,wBAAwB,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,uBAAuB,GAAG,MAAM,CAAC,QAAQ,CAAC,yBAAyB;QACvE,CAAC,CAAC,snBAAsnB;QACxnB,CAAC,CAAC,8PAA8P,CAAC;IAEnQ,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,GAAG;;;;;;;;;;sHAUuG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,yHAAyH,CAAC,CAAC,CAAC,EAAE,oDAAoD,wBAAwB,CAAC,CAAC,CAAC,iLAAiL,CAAC,CAAC,CAAC,EAAE,wIAAwI,wBAAwB,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE;;;;;;;;EASrzB,MAAM,CAAC,QAAQ,CAAC,uBAAuB;YACrC,CAAC,CAAC;;;;;;;;;;;qLAW+K;YACjL,CAAC,CAAC,EACN;;;;;;;;;;EAWE,wBAAwB;YACtB,CAAC,CAAC;;;;;;;;;;;;;CAaL;YACG,CAAC,CAAC,EACN,GACM,MAAM,CAAC,QAAQ,CAAC,gBAAgB;YAC9B,CAAC,CAAC;;;;;;;sCAQE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,6BACN;uEAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,uGAAuG;gBACzG,CAAC,CAAC,kFACN;2CAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,uDACN;0lBAEE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OACtD;;;EAIR,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACjC,CAAC,CAAC;;;yFAGmF,2BAA2B;qEAC/C,2BAA2B;iJACiD,2BAA2B;;;wGAGpE,2BAA2B;;CAElI;gBACG,CAAC,CAAC;0PACoP,2BAA2B,sDAAsD,2BAA2B;CAEtW;CACC;YACO,CAAC,CAAC;;CAGN;;CAEH,CAAC;IACA,CAAC;IAED,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IAElE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC;IAC7D,MAAM,uBAAuB,GAC3B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,IAAI,KAAK,CAAC;IAEnD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAElD,8EAA8E;IAC9E,MAAM,cAAc,GAAG,SAAS;QAC9B,CAAC,CAAC,yBAAyB,CACvB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,CAC1B;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,cAAc,KAAK,IAAI,CAAC;IAE7C,oFAAoF;IACpF,MAAM,gBAAgB,GAAG,YAAY;QACnC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAEjD,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;QAC5D,oBAAoB,EAAE,CAAC,CAAC,YAAY;QACpC,uBAAuB,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;QAClD,oBAAoB,EAAE,CAAC,CAAC,sBAAsB;QAC9C,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,IAAI,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,sBAAsB,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CACL,QAAQ;QACR,MAAM,CAAC;;WAEA,WAAW;;;;;;;;;;;;EAYpB,mBAAmB,CAAC,YAAY,EAAE,mBAAmB,CAAC;;;;;;EAOtD,MAAM,CAAC,QAAQ,CAAC,8BAA8B;YAC5C,CAAC,CAAC;;;;;;;;;;;;;;;;6JAiBE,uBAAuB;gBACrB,CAAC,CAAC;sUAC0T;gBAC5T,CAAC,CAAC,EACN;gIAC0H;YAC5H,CAAC,CAAC;;2FAGN;;;EAGE,cAAc,IAAI,EAAE;EACpB,sBAAsB,CAAC,CAAC,CAAC,8BAA8B,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BpF,uBAAuB;;;;EAIvB,4BAA4B,CAC5B,cAAc,EACd,MAAM,CAAC,QAAQ,CAAC,yBAAyB,KAAK,IAAI,CACnD;;EAEC,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAkFV,wBAAwB;YACtB,CAAC,CAAC;6NACmN;YACrN,CAAC,CAAC,EACN;;;;;;;;;;;;EAYF,gBAAgB;EAChB,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;;;;;;EAMtE,oBAAoB,CAAC,aAAa,CAAC;;CAEpC,CACE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,YAAqB,EACrB,mBAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,CAAC,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,YAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,mBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CACT,kCAAkC,KAAK,CAAC,MAAM,OAAO,uBAAuB,aAAa,CAC1F,CAAC;QACF,MAAM,iBAAiB,GACrB,kGAAkG;YAClG,iGAAiG;YACjG,0GAA0G,CAAC;QAC7G,KAAK;YACH,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,MAAM,CAAC;gBAClE,iBAAiB,CAAC;IACtB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,aAAsB,EACtB,uBAAgC,EAChC,yBAAkC;IAElC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;YAC/C,aAAa;YACb,uBAAuB;YACvB,yBAAyB;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,iBAAiB,CACjC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;QAEF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,oEAAoE,CACrE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAEjD,MAAM,gBAAgB,GAAG,aAAa;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC;;;;;;;;;CASd,CAAC;QAEE,OAAO,MAAM,CAAC;;;;;;;EAOhB,SAAS;;;EAGT,gBAAgB;;;;;;;;;;;;;;;;CAgBjB,CAAC;IACA,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,0EAA0E,EAC1E,YAAY,CAAC,KAAK,CAAC,CACpB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,cAAsB;IAC5D,OAAO,MAAM,CAAC;;;;;;;;;EASd,cAAc;;;;;;;;CAQf,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,6BAA6B,CAAC,aAAsB;IAC3D,OAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2Od,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4P3C,CAAC;AACF,CAAC;AAED,SAAS,8BAA8B;IACrC,OAAO;;;;;;gWAMuV,CAAC;AACjW,CAAC;AAED,SAAS,4BAA4B,CACnC,cAA0C,EAC1C,yBAAkC;IAElC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,yBAAyB,GAAG,yBAAyB;QACzD,CAAC,CAAC,8BAA8B,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC;IAEP,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO,8VAA8V,yBAAyB;;CAEjY,CAAC;IACA,CAAC;IAED,IAAI,cAAc,CAAC,wBAAwB,EAAE,CAAC;QAC5C,yEAAyE;QACzE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC,GAAG,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,kcAAkc,uBAAuB,uHAAuH,yBAAyB;;CAEnnB,CAAC;IACA,CAAC;IAED,OAAO,yMAAyM,yBAAyB;;CAE1O,CAAC;AACF,CAAC;AAED,MAAM,uBAAuB,GAAG,MAAM,CAAC;;;;;;;;CAQtC,CAAC"}

package/dist/ai-service/agent/prompts/build-security-scan-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-security-scan-prompt.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAOD,wBAAgB,0BAA0B,IAAI,MAAM,CAsDnD;AA8JD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,uBAAuB,EACnC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAYR"}
+{"version":3,"file":"build-security-scan-prompt.d.ts","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAsBD,wBAAgB,0BAA0B,IAAI,MAAM,CAsDnD;AA8JD,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,uBAAuB,EACnC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAYR"}

package/dist/ai-service/agent/prompts/build-security-scan-prompt.js

@@ -5,9 +5,25 @@
  * Layer 2: App Context — dynamic, per-app metadata to prevent false positives.
  * Layer 3: Admin Policy Prompt — what to look for (from template or IT admin).
  */
-// Templates are stored in the review_policy_agent_template DB table and loaded
-// at scan time. The fallback below is only used when no prompt is provided.
-const DEFAULT_ADMIN_PROMPT = "Perform a comprehensive security review of this application. Report any security concern you find.";
+// Policy of the Superblocks-managed security agent, used whenever a review carries no admin prompt.
+// Admin-authored agents replace it with their own; keep this text in sync with the General Security
+// Review starting template in review_policy_agent_template.
+const DEFAULT_ADMIN_PROMPT = [
+    "Perform a comprehensive security review of this application.",
+    "Look for all common vulnerability categories including:",
+    "",
+    "- Hardcoded secrets, API keys, tokens, or passwords in source code",
+    "- SQL injection, code injection (eval, dynamic execution), command injection, SSRF, or template injection",
+    "- XSS via user-controlled data rendered as raw HTML without sanitization",
+    "- Missing or broken authentication and authorization checks",
+    "- Sensitive data (PII, credentials) logged, leaked in responses, or stored insecurely",
+    "- Weak or deprecated cryptographic algorithms",
+    "- Insecure network configuration (wildcard CORS, disabled TLS verification, open redirects)",
+    "- Insecure deserialization or unrestricted file uploads",
+    "- API endpoints that return excessive data or expose internal details",
+    "",
+    "Report any security concern you find, even if it doesn't fit neatly into these categories.",
+].join("\n");
 export function buildSecurityAgentSkeleton() {
     const today = new Date().toISOString().split("T")[0];
     return `## Role
@@ -209,7 +225,7 @@ whether they are safe platform conventions or genuine security concerns.`);
 export function composeSecurityAgentPrompt(appContext, adminPrompt) {
     const skeleton = buildSecurityAgentSkeleton();
     const context = buildSecurityAgentAppContext(appContext);
-    const policy = adminPrompt ?? DEFAULT_ADMIN_PROMPT;
+    const policy = adminPrompt?.trim() ? adminPrompt : DEFAULT_ADMIN_PROMPT;
     return `${skeleton}
 
 ${context}

package/dist/ai-service/agent/prompts/build-security-scan-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-security-scan-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,oBAAoB,GACxB,oGAAoG,CAAC;AAEvG,MAAM,UAAU,0BAA0B;IACxC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,OAAO;;;;;;WAME,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yIA4CyH,CAAC;AAC1I,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAAa;QACzB;;;;;;;;;;;;;;;kBAec;KACf,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC;;;;;;;iGAOiF,CAAC,CAAC;IAEjG,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;iDAUiC,CAAC,CAAC;IAEjD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;;;;EAIhB,eAAe;;iFAEgE,CAAC,CAAC;IACjF,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA4CkE,CAAC,CAAC;IAElF,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;4FAe4E,CAAC,CAAC;IAE5F,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;gFAYgE,CAAC,CAAC;IAEhF,QAAQ,CAAC,IAAI,CAAC;;;;;;mEAMmD,CAAC,CAAC;IAEnE,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;yEAUyD,CAAC,CAAC;IAEzE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAmC,EACnC,WAAoB;IAEpB,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,IAAI,oBAAoB,CAAC;IAEnD,OAAO,GAAG,QAAQ;;EAElB,OAAO;;;;EAIP,MAAM,EAAE,CAAC;AACX,CAAC"}
+{"version":3,"file":"build-security-scan-prompt.js","sourceRoot":"","sources":["../../../../src/ai-service/agent/prompts/build-security-scan-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,oGAAoG;AACpG,oGAAoG;AACpG,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG;IAC3B,8DAA8D;IAC9D,yDAAyD;IACzD,EAAE;IACF,oEAAoE;IACpE,2GAA2G;IAC3G,0EAA0E;IAC1E,6DAA6D;IAC7D,uFAAuF;IACvF,+CAA+C;IAC/C,6FAA6F;IAC7F,yDAAyD;IACzD,uEAAuE;IACvE,EAAE;IACF,4FAA4F;CAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,UAAU,0BAA0B;IACxC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,OAAO;;;;;;WAME,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yIA4CyH,CAAC;AAC1I,CAAC;AAED,SAAS,4BAA4B,CACnC,OAAgC;IAEhC,MAAM,QAAQ,GAAa;QACzB;;;;;;;;;;;;;;;kBAec;KACf,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC;;;;;;;iGAOiF,CAAC,CAAC;IAEjG,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;iDAUiC,CAAC,CAAC;IAEjD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;;;;EAIhB,eAAe;;iFAEgE,CAAC,CAAC;IACjF,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFA4CkE,CAAC,CAAC;IAElF,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;4FAe4E,CAAC,CAAC;IAE5F,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;gFAYgE,CAAC,CAAC;IAEhF,QAAQ,CAAC,IAAI,CAAC;;;;;;mEAMmD,CAAC,CAAC;IAEnE,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;yEAUyD,CAAC,CAAC;IAEzE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAAmC,EACnC,WAAoB;IAEpB,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAExE,OAAO,GAAG,QAAQ;;EAElB,OAAO;;;;EAIP,MAAM,EAAE,CAAC;AACX,CAAC"}

package/dist/ai-service/agent/subagents/testing/prompt-builder.js

@@ -156,7 +156,7 @@ ${toolsSection}
 
 ## Embedded apps (embed hooks)
 - First, quickly determine whether this app actually uses embed hooks:
-  - Use \`read\` to inspect the current page source (usually \`pages/Page1/index.tsx\`) and search for \`useEmitEmbedEvent\` / \`useEmbedEvent\` / \`useEmbedProperties\`.
+  - Use \`read\` to inspect the current page source (usually \`pages/Home/index.tsx\` or \`pages/Page1/index.tsx\`) and search for \`useEmitEmbedEvent\` / \`useEmbedEvent\` / \`useEmbedProperties\`.
   - If neither hook exists, do not run embed-specific checks.
 - If \`useEmitEmbedEvent\` exists:
   - After an action that should emit (typically **submit**, **delete**, **clear**), immediately call \`browser_playwright_action\` with \`action: "getEmbedEvents"\`.

package/dist/ai-service/agent/tools/apis/analysis.d.ts

@@ -2,6 +2,12 @@ export interface MutationInfo {
     type: string;
     name: string;
     details: string;
+    /**
+     * Integration UUID when the mutation site includes one — either a string
+     * literal (`postgres("…")` / `new PostgreSQL("step", "…", …)`) or a
+     * top-level `const ID = "…"` reference.
+     */
+    integrationId?: string;
 }
 export declare const extractIntegrationIdsFromSource: (source: string) => string[];
 /**

package/dist/ai-service/agent/tools/apis/analysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../../../../../src/ai-service/agent/tools/apis/analysis.ts"],"names":[],"mappings":"AAkRA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,MAAM,EAiBtE,CAAC;AAmkBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAClC,gBAAgB,MAAM,EACtB,YAAY,MAAM,KACjB;IAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAoBtD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,aAAa,MAAM,KAClB,YAAY,EA+Zd,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,aAAa,MAAM,KAClB,OAMF,CAAC"}
+{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../../../../../src/ai-service/agent/tools/apis/analysis.ts"],"names":[],"mappings":"AAkRA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,MAAM,EAiBtE,CAAC;AA6qBF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAClC,gBAAgB,MAAM,EACtB,YAAY,MAAM,KACjB;IAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAoBtD,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,aAAa,MAAM,KAClB,YAAY,EA+bd,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,aAAa,MAAM,KAClB,OAMF,CAAC"}

package/dist/ai-service/agent/tools/apis/analysis.js

@@ -306,6 +306,42 @@ const extractStringValue = (node) => {
     }
     return null;
 };
+/**
+ * Top-level `const ID = "uuid"` bindings. Same shape Clark / SDK APIs use so
+ * the UUID is not inlined at every call site. Only `const` is accepted —
+ * `let`/`var` can be reassigned and must not attribute mutations.
+ */
+const buildTopLevelStringLiteralMap = (programBody) => {
+    const literals = new Map();
+    for (const statement of programBody) {
+        if (!t.isVariableDeclaration(statement) || statement.kind !== "const") {
+            continue;
+        }
+        for (const declaration of statement.declarations) {
+            if (!t.isIdentifier(declaration.id) || !declaration.init)
+                continue;
+            const value = extractStringValue(declaration.init);
+            if (value !== null) {
+                literals.set(declaration.id.name, value);
+            }
+        }
+    }
+    return literals;
+};
+/**
+ * Resolve an integration-id argument that is either a string literal or a
+ * reference to a top-level const string. Unresolvable identifiers stay
+ * undefined so auto-allow treats the mutation as unattributed.
+ */
+const resolveIntegrationIdArg = (node, stringLiterals) => {
+    const literal = extractStringValue(node);
+    if (literal !== null)
+        return literal;
+    if (t.isIdentifier(node)) {
+        return stringLiterals.get(node.name);
+    }
+    return undefined;
+};
 const extractPropertyValue = (configNode, propertyName) => {
     if (!t.isObjectExpression(configNode))
         return null;
@@ -316,6 +352,29 @@ const extractPropertyValue = (configNode, propertyName) => {
         return null;
     return extractStringValue(prop.value);
 };
+/**
+ * Distinguish a missing object property from one whose value is not a string
+ * literal (identifier, call, template, etc.). Auto-allow paths fail closed on
+ * unresolved write-relevant fields.
+ */
+const resolveObjectPropertyString = (configNode, propertyName) => {
+    if (!t.isObjectExpression(configNode))
+        return { kind: "missing" };
+    const prop = configNode.properties.find((p) => t.isObjectProperty(p) &&
+        t.isIdentifier(p.key) &&
+        p.key.name === propertyName);
+    if (!prop || !t.isObjectProperty(prop))
+        return { kind: "missing" };
+    // Only direct string/template literals count as resolved. Arrow functions
+    // and identifiers can evaluate to writes at runtime — treat as unresolved.
+    if (!t.isStringLiteral(prop.value) && !t.isTemplateLiteral(prop.value)) {
+        return { kind: "unresolved" };
+    }
+    const value = extractStringValue(prop.value);
+    if (value !== null)
+        return { kind: "literal", value };
+    return { kind: "unresolved" };
+};
 const getIntegrationTypeName = (node) => {
     if (t.isIdentifier(node)) {
         return node.name;
@@ -505,9 +564,15 @@ const detectSdkMutation = (className, runFn, source) => {
             : null;
     }
     if (REST_INTEGRATION_TYPES.includes(className)) {
-        return /method:\s*["'`](POST|PUT|DELETE|PATCH)["'`]/i.test(cleanBody)
-            ? "HTTP mutation method detected"
-            : null;
+        if (/method:\s*["'`](POST|PUT|DELETE|PATCH)["'`]/i.test(cleanBody)) {
+            return "HTTP mutation method detected";
+        }
+        // Fail closed: a method binding that isn't a clear safe literal may write.
+        if (/method:\s*/i.test(cleanBody) &&
+            !/method:\s*["'`](GET|HEAD|OPTIONS)["'`]/i.test(cleanBody)) {
+            return "HTTP method unresolved — treating as possible mutation";
+        }
+        return null;
     }
     if (className === "Redis") {
         return REDIS_WRITE_COMMANDS.some((cmd) => new RegExp(`["'\`]\\s*${cmd}\\b`, "i").test(cleanBody))
@@ -550,13 +615,14 @@ const findRunFunction = (apiConfigNode) => {
     }
     return null;
 };
-const handleSdkIntegrationMutation = (className, integrationKey, apiConfigNode, source, mutations) => {
+const handleSdkIntegrationMutation = (className, integrationKey, apiConfigNode, source, mutations, integrationId) => {
     const runFn = findRunFunction(apiConfigNode);
     if (!runFn) {
         mutations.push({
             type: className,
             name: integrationKey,
             details: `SDK API integration (${className}) may perform mutations`,
+            integrationId,
         });
         return;
     }
@@ -566,9 +632,16 @@ const handleSdkIntegrationMutation = (className, integrationKey, apiConfigNode,
             type: className,
             name: integrationKey,
             details,
+            integrationId,
         });
     }
 };
+const integrationIdFromPluginCall = (callNode, stringLiterals) => {
+    const firstArg = callNode.arguments[0];
+    if (!firstArg || !t.isExpression(firstArg))
+        return undefined;
+    return resolveIntegrationIdArg(firstArg, stringLiterals);
+};
 const extractStepNames = (source) => {
     const stepNames = new Set();
     const stepNameRegex = /new\s+(JavaScript|Python)\s*\(\s*["'`]([^"'`]+)["'`]/g;
@@ -585,6 +658,9 @@ const buildSdkPluginVariableMap = (ast) => {
     const refs = new Map();
     traverse(ast, {
         VariableDeclarator(path) {
+            const declaration = path.parent;
+            if (!t.isVariableDeclaration(declaration))
+                return;
             const id = path.node.id;
             const init = path.node.init;
             if (!t.isIdentifier(id))
@@ -597,7 +673,12 @@ const buildSdkPluginVariableMap = (ast) => {
             const className = SDK_PLUGIN_TO_CLASS.get(pluginId);
             if (!className)
                 return;
-            refs.set(id.name, { pluginId, className, callNode: init });
+            refs.set(id.name, {
+                pluginId,
+                className,
+                callNode: init,
+                isConstBinding: declaration.kind === "const",
+            });
         },
     });
     return refs;
@@ -744,6 +825,7 @@ export const extractMutations = (source, exportName) => {
         throw new Error("Failed to parse source code");
     }
     const sdkPluginVars = buildSdkPluginVariableMap(ast);
+    const stringLiterals = buildTopLevelStringLiteralMap(ast.program.body);
     // Pre-check: detect if the target export exists in the file even if it has
     // no integrations (an integration-less API cannot have mutations, so we must
     // not fall back to unscoped analysis just because no integration handler ran).
@@ -788,6 +870,15 @@ export const extractMutations = (source, exportName) => {
             const name = extractStringValue(args[0]);
             if (!name)
                 return;
+            // `new Plugin("step", "<integrationId>", config)` — args[1] is an ID when
+            // it's a string literal or a top-level const string ref; object configs
+            // (JS/Python steps, RestApi without an ID) leave this undefined.
+            const integrationId = args[1] && t.isExpression(args[1])
+                ? resolveIntegrationIdArg(args[1], stringLiterals)
+                : undefined;
+            const recordMutation = (info) => {
+                mutations.push(integrationId ? { ...info, integrationId } : { ...info });
+            };
             if ((typeName === "JavaScript" || typeName === "Python") &&
                 jsStepNames.has(name)) {
                 const configArg = args[1];
@@ -813,7 +904,7 @@ export const extractMutations = (source, exportName) => {
                     const statementValue = statementProp.value;
                     const statement = extractStringValue(statementValue);
                     if (statement && isSqlMutation(statement)) {
-                        mutations.push({
+                        recordMutation({
                             type: typeName,
                             name,
                             details: `SQL mutation detected`,
@@ -823,7 +914,7 @@ export const extractMutations = (source, exportName) => {
                         t.isFunctionExpression(statementValue)) {
                         // First check if the function body itself contains SQL mutations
                         if (scanJavaScriptForSqlMutations(statementValue, source)) {
-                            mutations.push({
+                            recordMutation({
                                 type: typeName,
                                 name,
                                 details: `SQL mutation detected`,
@@ -835,7 +926,7 @@ export const extractMutations = (source, exportName) => {
                             for (const paramName of paramNames) {
                                 const jsStep = jsSteps.get(paramName);
                                 if (jsStep && scanJavaScriptForSqlMutations(jsStep, source)) {
-                                    mutations.push({
+                                    recordMutation({
                                         type: typeName,
                                         name,
                                         details: `SQL mutation detected (references ${paramName} which builds mutation query)`,
@@ -851,7 +942,7 @@ export const extractMutations = (source, exportName) => {
                         if (statementValue.start && statementValue.end) {
                             const templateContent = source.slice(statementValue.start, statementValue.end);
                             if (isSqlMutation(templateContent)) {
-                                mutations.push({
+                                recordMutation({
                                     type: typeName,
                                     name,
                                     details: `SQL mutation detected`,
@@ -871,12 +962,23 @@ export const extractMutations = (source, exportName) => {
                 const configArg = args[2] || args[1];
                 if (!configArg)
                     return;
-                const method = extractPropertyValue(configArg, "method");
-                if (method && HTTP_MUTATION_METHODS.includes(method.toUpperCase())) {
-                    mutations.push({
+                const method = resolveObjectPropertyString(configArg, "method");
+                if (method.kind === "unresolved") {
+                    // Fail closed: a dynamic method (e.g. `method: HTTP_METHOD`) may be
+                    // a write at runtime. Leave it unattributed only when the id itself
+                    // is missing; otherwise keep the id so WRITE escalation still works.
+                    recordMutation({
+                        type: typeName,
+                        name,
+                        details: "HTTP method unresolved — treating as possible mutation",
+                    });
+                }
+                else if (method.kind === "literal" &&
+                    HTTP_MUTATION_METHODS.includes(method.value.toUpperCase())) {
+                    recordMutation({
                         type: typeName,
                         name,
-                        details: `HTTP ${method.toUpperCase()} mutation`,
+                        details: `HTTP ${method.value.toUpperCase()} mutation`,
                     });
                 }
             }
@@ -886,7 +988,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const action = extractPropertyValue(configArg, "action");
                 if (action && DYNAMODB_MUTATION_ACTIONS.includes(action)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: `DynamoDB ${action} mutation`,
@@ -906,7 +1008,7 @@ export const extractMutations = (source, exportName) => {
                     const actionField = extractPropertyValue(actionProp.value, "action");
                     if (actionField &&
                         SALESFORCE_MUTATION_ACTIONS.includes(actionField)) {
-                        mutations.push({
+                        recordMutation({
                             type: typeName,
                             name,
                             details: `Salesforce ${actionField} mutation`,
@@ -915,7 +1017,7 @@ export const extractMutations = (source, exportName) => {
                 }
             }
             else if (typeName === "Email") {
-                mutations.push({
+                recordMutation({
                     type: typeName,
                     name,
                     details: "Email send mutation",
@@ -927,7 +1029,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const query = extractPropertyValue(configArg, "query");
                 if (query && /^\s*mutation\s/i.test(query)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: "GraphQL mutation",
@@ -940,7 +1042,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const operation = extractPropertyValue(configArg, "operation");
                 if (operation && MONGODB_MUTATION_OPERATIONS.includes(operation)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: `MongoDB ${operation} mutation`,
@@ -953,7 +1055,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const action = extractPropertyValue(configArg, "action");
                 if (action && S3_MUTATION_ACTIONS.includes(action)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: `S3 ${action} mutation`,
@@ -966,7 +1068,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const action = extractPropertyValue(configArg, "action");
                 if (action && GCS_MUTATION_ACTIONS.includes(action)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: `GCS ${action} mutation`,
@@ -974,7 +1076,7 @@ export const extractMutations = (source, exportName) => {
                 }
             }
             else if (typeName === "SMTP") {
-                mutations.push({
+                recordMutation({
                     type: typeName,
                     name,
                     details: "SMTP send mutation",
@@ -986,7 +1088,7 @@ export const extractMutations = (source, exportName) => {
                     return;
                 const action = extractPropertyValue(configArg, "action");
                 if (action && COUCHBASE_MUTATION_ACTIONS.includes(action)) {
-                    mutations.push({
+                    recordMutation({
                         type: typeName,
                         name,
                         details: `Couchbase ${action} mutation`,
@@ -995,7 +1097,7 @@ export const extractMutations = (source, exportName) => {
                 else if (action === "runSql") {
                     const sqlBody = extractPropertyValue(configArg, "sqlBody");
                     if (sqlBody && isSqlMutation(sqlBody)) {
-                        mutations.push({
+                        recordMutation({
                             type: typeName,
                             name,
                             details: `Couchbase SQL++ mutation: ${sqlBody.slice(0, 50)}`,
@@ -1012,7 +1114,7 @@ export const extractMutations = (source, exportName) => {
                     const pointAction = extractPropertyValue(configArg, "pointAction");
                     if (pointAction &&
                         COSMOSDB_MUTATION_POINT_ACTIONS.includes(pointAction)) {
-                        mutations.push({
+                        recordMutation({
                             type: typeName,
                             name,
                             details: `CosmosDB ${pointAction} mutation`,
@@ -1057,7 +1159,7 @@ export const extractMutations = (source, exportName) => {
                 enclosingExport !== undefined &&
                 enclosingExport !== exportName)
                 return;
-            handleSdkIntegrationMutation(className, integrationKey, apiConfigNode, source, mutations);
+            handleSdkIntegrationMutation(className, integrationKey, apiConfigNode, source, mutations, integrationIdFromPluginCall(path.node, stringLiterals));
         },
         Identifier(path) {
             const varInfo = sdkPluginVars.get(path.node.name);
@@ -1091,7 +1193,9 @@ export const extractMutations = (source, exportName) => {
                 enclosingExport !== undefined &&
                 enclosingExport !== exportName)
                 return;
-            handleSdkIntegrationMutation(varInfo.className, integrationKey, apiConfigNode, source, mutations);
+            handleSdkIntegrationMutation(varInfo.className, integrationKey, apiConfigNode, source, mutations, varInfo.isConstBinding
+                ? integrationIdFromPluginCall(varInfo.callNode, stringLiterals)
+                : undefined);
         },
     });
     // If exportName was requested but not found in the file (e.g. stale registry),