sf-intelligence 0.1.20 → 0.1.21

package/dist/index.js

@@ -1978,7 +1978,7 @@ var init_resolve_index = __esm({
 });
 
 // ../graph/dist/src/resolve.js
-var DEFAULT_LIMIT, MAX_LIMIT, MIN_BASE, MATCHED_FLOOR, NONE_THRESHOLD, EXACT_THRESHOLD, EXACT_COVERAGE, PREFIX_EXACT_RATIO, CONTENDER_RATIO, LENGTH_RATIO_FLOOR, SYNONYM_SCORE, POP_K, COVERAGE_EXP, STRONG_ANCHOR, INTERNAL_RESOLVE_TYPES, queryNamesComponentType, TYPE_WEIGHT, typeWeight, isPureShortSubstringOfCompound, scoreToken, rollupKind, buildEvidence, resolveComponents;
+var DEFAULT_LIMIT, MAX_LIMIT, MIN_BASE, MATCHED_FLOOR, NONE_THRESHOLD, EXACT_THRESHOLD, EXACT_COVERAGE, PREFIX_EXACT_RATIO, CONTENDER_RATIO, LENGTH_RATIO_FLOOR, SYNONYM_SCORE, POP_K, COVERAGE_EXP, STRONG_ANCHOR, INTERNAL_RESOLVE_TYPES, queryNamesComponentType, TYPE_HINT_SINGLE_NOUNS, TYPE_HINT_NOUN_PAIRS, stripTypeHintNouns, TYPE_WEIGHT, typeWeight, isPureShortSubstringOfCompound, scoreToken, rollupKind, buildEvidence, resolveComponents;
 var init_resolve = __esm({
   "../graph/dist/src/resolve.js"() {
     "use strict";
@@ -2012,8 +2012,69 @@ var init_resolve = __esm({
         return "ApexClass";
       if (/\btriggers?\b/.test(lower))
         return "ApexTrigger";
+      if (/\bpermission\s+sets?\b/.test(lower))
+        return "PermissionSet";
+      if (/\brecord\s+types?\b/.test(lower))
+        return "RecordType";
+      if (/\bprofiles?\b/.test(lower))
+        return "Profile";
       return null;
     };
+    TYPE_HINT_SINGLE_NOUNS = /* @__PURE__ */ new Set([
+      "trigger",
+      "triggers",
+      "profile",
+      "profiles",
+      "field",
+      "fields",
+      "object",
+      "objects",
+      "flow",
+      "flows",
+      "component",
+      "components"
+    ]);
+    TYPE_HINT_NOUN_PAIRS = [
+      ["permission", "set"],
+      ["permission", "sets"],
+      ["record", "type"],
+      ["record", "types"]
+    ];
+    stripTypeHintNouns = (raw) => {
+      const words = raw.trim().split(/\s+/);
+      const norm = (w2) => w2.toLowerCase().replace(/[^a-z0-9]/g, "");
+      let start = 0;
+      let end = words.length;
+      const isPairAt = (i2) => i2 >= 0 && i2 + 1 < end && TYPE_HINT_NOUN_PAIRS.some(([a2, b2]) => norm(words[i2]) === a2 && norm(words[i2 + 1]) === b2);
+      for (; ; ) {
+        if (start < end && /^(?:the|a|an)$/i.test(norm(words[start]))) {
+          start += 1;
+          continue;
+        }
+        if (isPairAt(start) && start + 2 < end) {
+          start += 2;
+          continue;
+        }
+        if (start < end - 1 && TYPE_HINT_SINGLE_NOUNS.has(norm(words[start]))) {
+          start += 1;
+          continue;
+        }
+        break;
+      }
+      for (; ; ) {
+        if (isPairAt(end - 2) && end - 2 > start) {
+          end -= 2;
+          continue;
+        }
+        if (end - 1 > start && TYPE_HINT_SINGLE_NOUNS.has(norm(words[end - 1]))) {
+          end -= 1;
+          continue;
+        }
+        break;
+      }
+      const kept = words.slice(start, end).join(" ");
+      return kept.length > 0 ? kept : raw;
+    };
     TYPE_WEIGHT = {
       CustomObject: 1,
       CustomField: 0.95,
@@ -2083,8 +2144,21 @@ var init_resolve = __esm({
     resolveComponents = async (store, query, options) => {
       const limit = Math.min(options?.limit ?? DEFAULT_LIMIT, MAX_LIMIT);
       const minBase = options?.minScore ?? MIN_BASE;
-      const queryTokens = tokenizeText(query, { expandPhrases: true });
+      const strippedQuery = stripTypeHintNouns(query);
+      const queryTokens = tokenizeText(strippedQuery, { expandPhrases: true });
       const normQuery = normalizeName(query);
+      const normStrippedQuery = strippedQuery.length < query.trim().length ? normalizeName(strippedQuery) : normQuery;
+      const queryTrimmed = query.trim();
+      const normAfterTypePrefix = (() => {
+        if (!queryTrimmed.includes(":") || /\s/.test(queryTrimmed))
+          return normQuery;
+        const colonIdx = queryTrimmed.indexOf(":");
+        const afterColon = queryTrimmed.slice(colonIdx + 1);
+        if (afterColon.includes(":") || afterColon.includes("."))
+          return normQuery;
+        const n2 = normalizeName(afterColon);
+        return n2.length >= 2 ? n2 : normQuery;
+      })();
       const querySpaceWords = new Set(query.trim().split(/\s+/).map(normalizeName).filter((w2) => w2.length > 0));
       let dottedObjectNorm = null;
       let dottedFieldNorm = null;
@@ -2110,7 +2184,20 @@ var init_resolve = __esm({
           message: `resolveComponents: ${e2.message}`
         });
       }
-      const candidateIdx = gatherCandidates(index, queryTokens, normQuery);
+      const candidateIdxSet = new Set(gatherCandidates(index, queryTokens, normQuery));
+      if (normStrippedQuery !== normQuery) {
+        const extra = index.byNormName.get(normStrippedQuery);
+        if (extra !== void 0)
+          for (const i2 of extra)
+            candidateIdxSet.add(i2);
+      }
+      if (normAfterTypePrefix !== normQuery && normAfterTypePrefix !== normStrippedQuery) {
+        const extra = index.byNormName.get(normAfterTypePrefix);
+        if (extra !== void 0)
+          for (const i2 of extra)
+            candidateIdxSet.add(i2);
+      }
+      const candidateIdx = [...candidateIdxSet];
       const objectNormNames = /* @__PURE__ */ new Set();
       for (const n2 of index.nodes) {
         if (n2.type === "CustomObject")
@@ -2161,7 +2248,8 @@ var init_resolve = __esm({
         }
         const crossObjectFieldDecoy = node.type === "CustomField" && namedObjectWords.size > 0 && (node.parentApiName === null || !namedObjectWords.has(normalizeName(node.parentApiName)));
         const dottedExact = dottedObjectNorm !== null && dottedFieldNorm !== null && node.parentApiName !== null && normalizeName(node.parentApiName) === dottedObjectNorm && normalizeName(node.apiName) === dottedFieldNorm;
-        const wholeExact = dottedExact || normQuery.length >= 2 && node.normName === normQuery && query.includes(".") === node.apiName.includes(".") && !crossObjectFieldDecoy;
+        const wholeExactNormMatch = normQuery.length >= 2 && node.normName === normQuery || normStrippedQuery !== normQuery && normStrippedQuery.length >= 2 && node.normName === normStrippedQuery || normAfterTypePrefix !== normQuery && normAfterTypePrefix.length >= 2 && node.normName === normAfterTypePrefix;
+        const wholeExact = dottedExact || wholeExactNormMatch && query.includes(".") === node.apiName.includes(".") && !crossObjectFieldDecoy;
         pass1.push({ node, perToken, wholeExact, parentMatched });
       }
       const anchorIdx = [];
@@ -2255,12 +2343,6 @@ var init_resolve = __esm({
         return 1;
       };
       scored.sort((a2, b2) => {
-        if (namedTypeForSort !== null) {
-          const ttA = typeIntentTier(a2.type);
-          const ttB = typeIntentTier(b2.type);
-          if (ttA !== ttB)
-            return ttA - ttB;
-        }
         const weA = wholeExactIds.has(a2.id) ? 0 : 1;
         const weB = wholeExactIds.has(b2.id) ? 0 : 1;
         if (weA !== weB)
@@ -2269,6 +2351,12 @@ var init_resolve = __esm({
         const tierB = b2.base >= EXACT_THRESHOLD ? 0 : 1;
         if (tierA !== tierB)
           return tierA - tierB;
+        if (namedTypeForSort !== null) {
+          const ttA = typeIntentTier(a2.type);
+          const ttB = typeIntentTier(b2.type);
+          if (ttA !== ttB)
+            return ttA - ttB;
+        }
         const pmA = parentMatchedIds.has(a2.id) ? 0 : 1;
         const pmB = parentMatchedIds.has(b2.id) ? 0 : 1;
         if (pmA !== pmB)
@@ -24094,7 +24182,7 @@ ${renderTrustFooter(trust)}`;
 import { appendFile as appendFile3, mkdir as mkdir8 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname18, join as join13 } from "node:path";
-var riskForIntent, routeFromRule, routeForSelectedIntent, normalize, deriveSaveEvent, deriveKnowledgeTopic, deriveListType, FIELD_PARENT_OBJECTS, deriveFieldListParent, deriveMetadataParentId, deriveObjectApiFromQuestion, deriveImpactHops, FIELD_MAP_OBJECT, deriveFieldMappingArgs, deriveLayoutForUserArgs, derivePiiInventoryArgs, deriveMetadataCountArgs, deriveOmniType, routeText, RULES, alternativeFromIntent, semanticAlternatives, intentLabel, classifyQuestion, gapLogPath, logGapIfAny;
+var riskForIntent, routeFromRule, routeForSelectedIntent, normalize, NAMED_COMPONENT_ID, NAMED_FIELD_ID, deriveSaveEvent, deriveKnowledgeTopic, deriveListType, FIELD_PARENT_OBJECTS, deriveFieldListParent, deriveMetadataParentId, NON_OBJECT_CAPTURES, deriveObjectApiFromQuestion, deriveImpactHops, FIELD_MAP_OBJECT, deriveFieldMappingArgs, deriveLayoutForUserArgs, derivePiiInventoryArgs, deriveMetadataCountArgs, deriveOmniType, routeText, RULES, alternativeFromIntent, semanticAlternatives, intentLabel, classifyQuestion, gapLogPath, logGapIfAny;
 var init_intent_router = __esm({
   "../mcp/dist/src/intent-router.js"() {
     "use strict";
@@ -24149,6 +24237,8 @@ var init_intent_router = __esm({
       };
     };
     normalize = (q2) => q2.trim().toLowerCase().replace(/[‘’ʼ]/g, "'").replace(/\s+/g, " ");
+    NAMED_COMPONENT_ID = "(?!\\w*__)[a-z][a-z0-9]*_[a-z0-9]+_[a-z0-9_]*[a-z0-9]";
+    NAMED_FIELD_ID = "(?:[a-z][a-z0-9_]*\\.[a-z][a-z0-9_]*|[a-z][a-z0-9_]*__c)";
     deriveSaveEvent = (q2) => {
       if (/\b(undelet|restor)/.test(q2))
         return "undelete";
@@ -24183,6 +24273,8 @@ var init_intent_router = __esm({
         return "apex-testing";
       if (/\bstandard\s+profiles?\b.*\b(ship|new\s+org)\b/.test(q2))
         return "profiles-vs-permission-sets";
+      if (/\bwhat\s+is\s+an?\s+(?:profile|permission\s+set)\b/.test(q2))
+        return "profiles-vs-permission-sets";
       if (/\b(person\s+accounts?)\b/.test(q2))
         return "standard-vs-custom-objects";
       if (/\b(ci\/cd|source\s+control|deployment\s+(and\s+)?release)\b/.test(q2))
@@ -24276,14 +24368,41 @@ var init_intent_router = __esm({
         return `CustomObject:${onObject[1]}`;
       return void 0;
     };
+    NON_OBJECT_CAPTURES = /* @__PURE__ */ new Set([
+      "save",
+      "saves",
+      "saving",
+      "insert",
+      "update",
+      "delete",
+      "undelete",
+      "create",
+      "creation",
+      "edit",
+      "record",
+      "records",
+      "object",
+      "objects",
+      "it",
+      "this",
+      "that",
+      "them",
+      "each",
+      "every",
+      "all"
+    ]);
     deriveObjectApiFromQuestion = (q2, question) => {
       const source = question ?? q2;
       const toolObject = source.match(/\b(?:automation_build_advisor|order_of_execution|apex_build_advisor)\b\s+(?:on\s+)?([A-Za-z][A-Za-z0-9_]*(?:__c|__mdt|__e)?)\b/i);
       if (toolObject?.[1] !== void 0)
         return toolObject[1];
-      const onObject = source.match(/\b(?:on|for|to|access\s+to)\s+(?:the\s+|an\s+|a\s+)?([A-Za-z][A-Za-z0-9_]*(?:__c|__mdt|__e)?)\b/i);
-      if (onObject?.[1] !== void 0)
-        return onObject[1];
+      const onObjectRe = /\b(?:on|for|to|access\s+to)\s+(?:the\s+|an\s+|a\s+)?([A-Za-z][A-Za-z0-9_]*(?:__c|__mdt|__e)?)\b/gi;
+      for (const match of source.matchAll(onObjectRe)) {
+        const capture = match[1];
+        if (capture !== void 0 && !NON_OBJECT_CAPTURES.has(capture.toLowerCase())) {
+          return capture;
+        }
+      }
       const dmlObject = source.match(/\b(?:update|insert|delete|save|create|edit)\s+(?:a\s+|an\s+|the\s+)?([A-Za-z][A-Za-z0-9_]*(?:__c|__mdt|__e)?)\b/);
       if (dmlObject?.[1] !== void 0)
         return dmlObject[1];
@@ -24621,7 +24740,13 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: true,
         reason: "Explicit downstream_effects invocation.",
-        patterns: [/\bdownstream_effects\b/]
+        patterns: [
+          /\bdownstream_effects\b/,
+          // "downstream effects of changing X" — the natural phrasing. Previously
+          // caught only by pii-flow's bare \bdownstream\b catch-all (eval family E
+          // demoted that), so the dedicated tool now owns its own noun phrase.
+          /\b(?:downstream|ripple)\s+effects?\b/
+        ]
       },
       {
         intent: "package-impact",
@@ -24679,7 +24804,17 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: true,
         reason: "Explicit async_chain_depth invocation.",
-        patterns: [/\basync_chain_depth\b/]
+        patterns: [
+          /\basync_chain_depth\b/,
+          // NL async-chain shapes (flow-family REACH). High precision: an explicit
+          // async-chain-depth / async-Apex-limit concern (queueable→queueable /
+          // future/batch chaining against the 5-deep / async-Apex governor limit).
+          /\basync\s+chain\b/,
+          /\basync[-\s]?apex[-\s]?limit\b/,
+          /\basync[-\s]apex[-\s]limit\b/,
+          /\bhow\s+deep\b[^.?!]{0,40}\basync\b/,
+          /\b(queueable|future|batch)\b[^.?!]{0,40}\bchain\w*\b[^.?!]{0,40}\b(depth|deep|limit)\b/
+        ]
       },
       {
         intent: "compliance",
@@ -24940,6 +25075,32 @@ var init_intent_router = __esm({
           /\bhow\s+many\s+users?\b.*\bon\b.*\bprofiles?\b/
         ]
       },
+      {
+        // "list everyone with the X profile" is a USER ROSTER ask: user-to-profile
+        // assignment is runtime User-record state, not vault metadata — the schema
+        // list rule used to claim it via "list ... profiles" and answer with the
+        // Profile METADATA catalog (eval family D). live_group_count genuinely
+        // answers the count side (Users grouped by ProfileId) and
+        // live_inactive_users the login-activity side; the name-by-name roster
+        // itself is disclosed as a partial answer, never papered over.
+        intent: "profile-user-roster",
+        plane: "live",
+        tools: ["sfi.live_group_count", "sfi.live_inactive_users"],
+        liveRequired: true,
+        needsResolve: false,
+        reason: "Which users hold a profile is runtime User-record state: count them live grouped by ProfileId (live_group_count); login-activity detail comes from live_inactive_users.",
+        gap: {
+          category: "profile-user-roster",
+          note: "Partial answer: live_group_count returns user COUNTS per profile and live_inactive_users lists dormant users, but a full name-by-name user roster per profile is not a built capability yet."
+        },
+        suggestArgs: () => ({ objectApiName: "User", groupByField: "ProfileId" }),
+        patterns: [
+          /\b(list|show|who\s+are)\b[^.?!]{0,20}\b(everyone|everybody|all\s+(the\s+)?users?|the\s+users?|people)\b[^.?!]{0,40}\b(with|on|assigned|holding|having)\b[^.?!]{0,40}\bprofile\b/,
+          /\b(which|what)\s+users?\b[^.?!]{0,40}\b(have|hold|are\s+on|with|assigned)\b[^.?!]{0,40}\bprofile\b/,
+          /\bwho\s+(has|holds|is\s+assigned)\b[^.?!]{0,40}\bprofile\b/,
+          /\beveryone\b[^.?!]{0,30}\b(with|on|assigned)\b[^.?!]{0,40}\bprofile\b/
+        ]
+      },
       {
         intent: "stale-metadata",
         plane: "vault",
@@ -24969,10 +25130,25 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "License provisioning/usage and reclaimable seats are live org state (UserLicense / PermissionSetLicense + login activity).",
         patterns: [
-          /\b(licen[sc]e|seat)s?\b.*\b(usage|used|unused|utili[sz]ation|utilized|reclaim|reclaimable|available|free|provision|assigned|wasted|cost|optimi[sz])/,
-          /\b(usage|utili[sz]ation|utilized|reclaim|reclaimable|unused|provision|assigned|wasted)\b.*\b(licen[sc]e|seat)s?\b/,
+          // Guarded (eval family C — qualifier hijack): "seats"/"license" as a
+          // TRAILING modifier must not drag a permission-set ASSIGNMENT question
+          // ("who is assigned the X permission set — are we wasting seats?") onto
+          // the live license counter. When the question mentions a permission set
+          // that is NOT the literal "permission set license" (PSL) noun, the
+          // perm-set rules below own it; genuine PSL asks keep the third pattern.
+          /^(?!.*\bpermission\s+sets?\b(?!\s+licen[sc]e)).*\b(licen[sc]e|seat)s?\b.*\b(usage|used|unused|utili[sz]ation|utilized|reclaim|reclaimable|available|free|provision|assigned|wasted|cost|optimi[sz])/,
+          /^(?!.*\bpermission\s+sets?\b(?!\s+licen[sc]e)).*\b(usage|utili[sz]ation|utilized|reclaim|reclaimable|unused|provision|assigned|wasted)\b.*\b(licen[sc]e|seat)s?\b/,
           /\bpermission\s+set\s+licen[sc]e/,
-          /\bhow\s+many\s+(licen[sc]e|seat)s?\b/
+          /\bhow\s+many\s+(licen[sc]e|seat)s?\b/,
+          // DISCOVERY/META REACH: "how many <LicenseType> and <LicenseType>
+          // licenses are we actually USING vs what we're PAYING for" — the
+          // provisioning-vs-consumption ask. The base patterns above keyed on
+          // `used`/`usage` (not the gerund "using") and on "how many licenses"
+          // adjacent, so "how many Salesforce and Community licenses … using"
+          // fell through. Anchor on "how many … licenses … using/paying" (the
+          // provisioned-vs-paid frame), still guarded off a perm-set-assignment
+          // question by the leading negative lookahead style used above.
+          /^(?!.*\bpermission\s+sets?\b(?!\s+licen[sc]e)).*\bhow\s+many\b[^.?!]{0,60}\blicen[sc]es?\b[^.?!]{0,60}\b(?:using|use|paying|pay|provision\w*|actually\s+us\w*)\b/
         ]
       },
       {
@@ -24991,7 +25167,9 @@ var init_intent_router = __esm({
           // count (record-count) or a permission audit (over-permission), not dormancy.
           /\bhow\s+many\b.*\b(inactive|dormant|stale)\b.*\busers?\b/,
           /\bhow\s+many\b.*\busers?\b.*\b(inactive|dormant|stale|haven'?t\s+logged|not\s+logged)\b/,
-          /\b(license|seat)s?\b.*\b(reclaim|unused|free|available)\b/
+          // Same permission-set guard as license-usage (eval family C): a seat
+          // modifier on a perm-set-assignment ask must not land on login activity.
+          /^(?!.*\bpermission\s+sets?\b(?!\s+licen[sc]e)).*\b(license|seat)s?\b.*\b(reclaim|unused|free|available)\b/
         ]
       },
       {
@@ -25175,7 +25353,14 @@ var init_intent_router = __esm({
           /\brecord\s+counts?\b.*\b(per|by|across)\b.*\bobjects?\b/,
           /\bstorage\b.*\b(by|per)\b.*\bobject\b/,
           /\bdata\s+volume\b.*\bobject\b/,
-          /\btop\b.*\bobjects?\b.*\b(by|with)\b.*\b(records?|rows?)\b/
+          /\btop\b.*\bobjects?\b.*\b(by|with)\b.*\b(records?|rows?)\b/,
+          // "which custom objects are essentially empty in prod" — whether an
+          // object holds records is the SAME live per-object COUNT read from the
+          // other end (zero/near-zero instead of most); it was unrouted and the
+          // vault cannot answer it at all (eval family D).
+          /\b(which|what)\b[^.?!]{0,40}\bobjects?\b[^.?!]{0,50}\bempty\b/,
+          /\bempty\b[^.?!]{0,20}\b(custom\s+)?objects?\b/,
+          /\bobjects?\b[^.?!]{0,40}\b(no|zero|barely\s+any|hardly\s+any)\s+(records?|rows?|data)\b/
         ]
       },
       {
@@ -25332,7 +25517,11 @@ var init_intent_router = __esm({
         reason: "Report inventory is in the vault; stale/unused needs live LastRunDate.",
         patterns: [
           /\breports?\b.*\b(useless|unused|stale|dead|old|never\s+run|not\s+used|broken)\b/,
-          /\b(reports?|dashboards?)\b.*\b(cover|covers|about|for)\b(?!.*\breport\s+types?\b)/,
+          // Guarded (eval family C): "compliance report … who touches the X field"
+          // uses "report" as the requested DELIVERABLE, not the subject — the
+          // head question is field access, so a compliance/who-touches frame must
+          // not land on live report run-history.
+          /^(?!.*\b(?:compliance|who\s+touch)\w*\b).*\b(reports?|dashboards?)\b.*\b(cover|covers|about|for)\b(?!.*\breport\s+types?\b)/,
           /\b(useless|unused|stale|dead)\b.*\breports?\b/,
           /\b(dashboards?)\b.*\b(unused|stale|broken|refresh)\b/,
           /\breports?\b.*\b(not\s+run|haven'?t\s+been\s+run)\b/,
@@ -25402,7 +25591,14 @@ var init_intent_router = __esm({
           /\b(which|what)\s+profiles?\b.*\bcan\b.*\brun\b.*\breports?\b/,
           // API-enabled login profiles.
           /\b(which|what)\s+profiles?\b.*\b(api|log\s+in|login)\b/,
-          /\bprofiles?\b.*\b(log\s+in|login)\b.*\bapi\b/
+          /\bprofiles?\b.*\b(log\s+in|login)\b.*\bapi\b/,
+          // REACH (permissions/access cluster) — FORWARD run-access: "which screen
+          // flows are exposed / available / visible / assigned to the <Named>
+          // profile / perm set". This is the granter's OWN runnableFlows list
+          // (user_ability), not the reverse who_can_run (which starts from a flow).
+          // "exposed to <profile>" is the natural phrasing the existing
+          // "what flows can X run" templates missed.
+          /\bwhich\s+(?:screen\s+)?flows?\b[^.?!]{0,40}\b(?:exposed|available|visible|assigned)\s+to\b[^.?!]{0,30}\b(?:profile|perm\s*sets?|permission\s+sets?|user)\b/
         ]
       },
       {
@@ -25415,7 +25611,20 @@ var init_intent_router = __esm({
         patterns: [
           /\bwho\s+can\s+run\b.*\bflow/,
           /\b(which|what)\s+(profiles?|permission\s+sets?|permsets?)\b.*\brun\b.*\bflow/,
-          /\bwho\s+(can|is\s+able\s+to)\s+run\b.*\bflow/
+          /\bwho\s+(can|is\s+able\s+to)\s+run\b.*\bflow/,
+          // REACH (permissions/access cluster): the existing templates broke on
+          // (1) an adverb between who/can and run ("who EXACTLY can run …",
+          // "who ACTUALLY can run …") and (2) a Flow named by its API id with a
+          // `_flow` / `_screen_flow` suffix but no separate bare word "flow"
+          // ("run Some_Named_Screen_Flow"). `FLOWREF` matches the bare word
+          // "flow(s)", the `_flow` suffix (no leading `\b`, so it fires inside a
+          // multi-underscore API name), or "screen flow(s)". Two shapes:
+          //   (a) who [adverb] can run … <flow>
+          //   (b) can the <profile/perm set/user> run … <flow>
+          // Both require the RUN verb + a flow reference, so they never steal a
+          // record/object/field access ask (no "run … flow" there).
+          /\bwho\b[^.?!]{0,20}\bcan\b[^.?!]{0,15}\brun\b[^.?!]{0,60}(?:\bflows?\b|_flow\b|screen\s+flows?\b)/,
+          /\bcan\b[^.?!]{0,40}\b(?:profile|perm\s*sets?|permission\s+sets?|user)\b[^.?!]{0,20}\brun\b[^.?!]{0,60}(?:\bflows?\b|_flow\b|screen\s+flows?\b)/
         ]
       },
       {
@@ -25497,7 +25706,15 @@ var init_intent_router = __esm({
           // — the recordtype→profile grammar the forward templates above missed. Same
           // recordTypeVisibilities modeling, answered from the profile side.
           /\bwhich\s+record\s+types?\b.*\b(available|access|assigned)\s+to\b.*\bprofiles?\b/,
-          /\b(available|access|assigned)\s+to\b.*\bprofiles?\b.*\brecord\s+types?\b/
+          /\b(available|access|assigned)\s+to\b.*\bprofiles?\b.*\brecord\s+types?\b/,
+          // REACH (permissions/access cluster) — "why can't / won't <user> create /
+          // pick / select the <X> RECORD TYPE" is a recordTypeVisibilities gap: the
+          // container simply doesn't have that record type visible-for-create. The
+          // literal "record type" / "recordtypeid" noun keeps this off why-cant-see
+          // (record SHARING) and off object-access (object CRUD) — both of which
+          // lack the record-type noun.
+          /\bwhy\s+(?:can'?t|won'?t|cannot)\b[^.?!]{0,60}\b(?:create|pick|select|use|choose|see|open)\b[^.?!]{0,40}\brecord\s+type\b/,
+          /\brecord\s?type\s?id\b[^.?!]{0,60}\b(?:pick|select|choose|create|use)\b/
         ]
       },
       {
@@ -25515,7 +25732,32 @@ var init_intent_router = __esm({
           /\bwhat\s+permissions?\s+(does|do)\b.*\b(profiles?|permission\s+sets?|users?)\b/,
           // Permission sets assigned to a named user (baseline-300 gap).
           /\bpermission\s+sets?\b.*\bassigned\b.*\buser\b/,
-          /\bwhat\s+permission\s+sets?\b.*\bassigned\b/
+          /\bwhat\s+permission\s+sets?\b.*\bassigned\b/,
+          // REACH (permissions/access cluster): "does/can the <Named> profile /
+          // <Named> perm set have|give|grant|read|edit|create|delete|access|see|
+          // change <object>". These name a SPECIFIC granter (a profile/permission
+          // set) and ask what access it confers — the exact effective_permissions
+          // ask, which no earlier rule caught (the existing templates required the
+          // literal "effective/combined access" or the generic word "permissions").
+          // Anchored on the interrogative verb `does|can` PLUS the granter noun
+          // (profile|perm set) PLUS an access verb, all clause-bounded (`[^.?!]`) so
+          // one sentence's verb can't reach across into the next. The `(?<!\bwhy\s)`
+          // lookbehind keeps "why can't the X profile see the record" on
+          // why-cant-see; "who can …" field asks (no does/can-led granter) stay on
+          // field-access; enumerative "which permission sets grant …" stays on
+          // object-access (no does/can lead). recordtype-availability and
+          // profile-security sit EARLIER, so a record-type / session-security
+          // phrasing still wins by first-match. The leading `^(?!.*\blayouts?\b)`
+          // yields any "which layout does the X profile SEE" question to
+          // layout-access (a later rule) — "layout" anywhere disqualifies this
+          // permission route.
+          /^(?!.*\blayouts?\b).*?(?<!\bwhy\s)\b(?:does|can)\b[^.?!]{0,60}\b(?:profile|perm\s*sets?|permission\s+sets?)\b[^.?!]{0,60}\b(?:have|give|gives?|grant|grants?|read|edit|create|delete|access|see|change)\b/,
+          // "which perm sets are stacked on top of / assigned on top of the <Named>
+          // profile" — a union-of-containers ask (what the stack effectively grants).
+          /\bwhich\s+perm\s*sets?\b[^.?!]{0,40}\b(?:stacked|stack|on\s+top\s+of|added\s+to|layered)\b/,
+          // "for <PermSetA>, <PermSetB>, <PermSetC> perm sets, what does each
+          // contribute" — the division-of-access breakdown across a bundle.
+          /\bperm\s*sets?\b[^.?!]{0,20},[^.?!]{0,80}\bwhat\s+does\s+each\s+(?:contribute|grant|add|allow)\b/
         ]
       },
       {
@@ -25578,7 +25820,16 @@ var init_intent_router = __esm({
         reason: "What happens when {Object}.{field} becomes {value} \u2014 the automation coupled to a value/stage transition, from the vault (lifecycle_process).",
         patterns: [
           /\bwhat\s+happens\s+when\b.*\b(becomes?|turns?|changes?\s+to|is\s+set\s+to|reaches?)\b/,
-          /\bwhat\s+(?:happens|runs|fires)\s+when\b.*\b(closed\s+won|closed\s+lost|converted|approved|activated)\b/,
+          // Up to three optional adverb words between the verb and "when" — "what
+          // runs AUTOMATICALLY when a Lead is converted" / "what fires IN THE
+          // BACKGROUND when …" were unrouted (eval lifecycle family). The DML-event
+          // save-order rule stays disjoint: its verb list has no transition verbs
+          // (converted / closed won / approved), so nothing is stolen either way.
+          /\bwhat\s+(?:happens|runs|fires)\b(?:\s+\w+){0,3}\s+when\b.*\b(closed\s+won|closed\s+lost|converted|approved|activated)\b/,
+          // Nominalized transition — "what runs ON Lead CONVERSION?" / "what fires
+          // upon Case escalation to closed" has no "when …is converted" clause at
+          // all; the nominal "on/upon <Entity> conversion" form routes the same.
+          /\bwhat\s+(?:happens|runs|fires|occurs|triggers)\b[^.?!]{0,40}\b(?:on|upon|during|after)\s+(?:an?\s+|the\s+)?\w+\s+conversion\b/,
           // P1e — generic state-transition verbs beyond the Opportunity/Lead
           // hardcoded list: "submitted", "disqualified", "completed", "enrolled" are
           // common transitions on other objects (Applications, Enrollments,
@@ -25607,7 +25858,21 @@ var init_intent_router = __esm({
           /\bwho\s+can\s+(see|access|view|edit|read)\b.*\b(all|every)\b.*\brecords?\b/,
           /\b(which|what)\s+(profiles?|permission\s+sets?|roles?|groups?)\b.*\b(see|access|edit)\b.*\brecords?\b/,
           // Object-level access without the word "records" — must beat field-access.
-          /\bwho\s+can\s+access\b(?!.*\bfield\b)/
+          /\bwho\s+can\s+access\b(?!.*\bfield\b)/,
+          // Enumerative SINGULAR phrasings — "list every profile with delete
+          // permission on Contact", "show me every profile that can access Case".
+          // The bare noun "profile" is an intent signal here, not a named entity;
+          // these fell through to the generic schema list rule (eval family A).
+          /\b(?:list|show)\b.*\bevery\s+profiles?\b.*\b(?:permission|access)/,
+          /\bevery\s+profiles?\s+(?:that|who|with)\b.*\b(?:access|see|view|edit|read|delete|create)\b/,
+          /\b(?:which|what)\s+profiles?\b.*\b(?:create|read|edit|delete|view)\s+permission\b/,
+          // REACH (permissions/access cluster): "is <Object__c> visible / accessible
+          // to the <Named> profile / perm set / role" — the forward object-record
+          // access ask, which who_can_access_object answers (the agent reads whether
+          // that container is among the granters). `__c`-anchored + "visible/…
+          // to <container>" so it never grabs a layout ("is Account.Name visible on
+          // the layout") or a schema ("is Payment__c an object") question.
+          /\bis\b[^.?!]{0,20}\b\w+__c\b[^.?!]{0,20}\b(?:visible|accessible|available|readable|editable)\b[^.?!]{0,20}\bto\b[^.?!]{0,30}\b(?:profile|perm\s*sets?|permission\s+sets?|role|user)\b/
         ]
       },
       {
@@ -25620,7 +25885,20 @@ var init_intent_router = __esm({
         patterns: [
           /\bwhy\s+(can'?t|cannot|can\s+not)\b.*\b(see|view|access)\b.*\b(record|account|case|contact|lead|opportunity)\b/,
           /\bcan'?t\s+(see|view|access)\b.*\b(record|account|case|opportunity|contact|lead)\b/,
-          /\bwhy\s+(can'?t|cannot|can\s+not)\b.*\b(see|view|access)\b.*\b(an?\s+)?(account|case|contact|lead|opportunity)\b/
+          /\bwhy\s+(can'?t|cannot|can\s+not)\b.*\b(see|view|access)\b.*\b(an?\s+)?(account|case|contact|lead|opportunity)\b/,
+          // REACH (permissions/access cluster): the existing templates used a
+          // SINGULAR `\brecord\b` and only see/view/access, so a plural "records"
+          // ask ("why can't the Manager ROLE see Enrollment RECORDS", "why can't a
+          // user EDIT Order__c RECORDS") fell through. Add plural
+          // `records?` + the `edit|read` verbs — this is still the record-sharing
+          // cascade (OWD → sharing → role hierarchy), the honest tool for a
+          // "why can't X see/edit these RECORDS" question. The literal "records"
+          // keeps it OFF field-access (a named FIELD, no "records").
+          /\bwhy\s+(?:can'?t|won'?t|cannot|can\s+not)\b[^.?!]{0,60}\b(?:see|view|access|edit|read)\b[^.?!]{0,60}\brecords?\b/,
+          // Negative-contrast visibility — "why can a <user> see A records BUT NOT
+          // B" — the same sharing-cascade question phrased as a see-one-not-the-other
+          // puzzle. The "but not" tail distinguishes it from a plain who-can-see.
+          /\bwhy\s+can\b[^.?!]{0,60}\b(?:see|view|access)\b[^.?!]{0,60}\brecords?\b[^.?!]{0,40}\bbut\s+not\b/
         ]
       },
       {
@@ -25743,7 +26021,41 @@ var init_intent_router = __esm({
           // "field access audit for Email" / "field access for X" — "field access"
           // with the field named after (the (field|object)-after-access patterns
           // missed it). Battery gap.
-          /\bfield[-\s]access\b/
+          /\bfield[-\s]access\b/,
+          // Eval family C — qualifier hijack. "which fields are only ever written
+          // BY an integration user" is a field WRITE-access audit (who can edit),
+          // not integration topology: the "integration" qualifier was dragging it
+          // onto integration_map.
+          /\b(?:which|what)\s+fields?\b[^.?!]{0,80}\b(?:written|edited|updated|writable)\b[^.?!]{0,40}\bby\b/,
+          // "compliance report … who touches the <X> field" — who-touches-a-field
+          // is FLS edit access, not report run-history (the "report" qualifier was
+          // dragging it onto reports-usage).
+          /\bwho\s+touch(?:es)?\b[^.?!]{0,60}\b(?:fields?\b|__c\b)/,
+          // REACH (permissions/access cluster) — FLS on a NAMED field:
+          // (a) "who [adverb] can see/read/view/edit/access <Field__c or
+          //     Object.field>" — the existing who-can-see template broke on an
+          //     adverb ("who can ACTUALLY see Some_Field__c"). Field-anchored
+          //     (dotted or `__c`) and clause-guarded against "records" so a
+          //     who-can-see-RECORDS ask stays on who-can-access-object.
+          /\bwho\s+can\b(?![^.?!]*\brecords?\b)[^.?!]{0,25}\b(?:see|read|view|edit|access)\b[^.?!]{0,40}(?:\b\w+\.\w+\b|\b\w+__c\b)/,
+          // (b) "can/does <someone> edit/see <Object.field>" — FLS on a DOTTED
+          //     field ref ("Can Analytics edit Opportunity.Amount"). Restricted to a
+          //     dotted ref (or a bare `__c` accompanied by the word "field") so a
+          //     bare `__c` OBJECT ("can a user see Payment__c?") is NOT mistaken for
+          //     a field; the `(?<!\bwhy\s)` and no-"records" guards keep why-cant /
+          //     record asks off this rule, and effective-permissions (earlier) still
+          //     wins any granter-worded "does the X profile …" phrasing.
+          /(?<!\bwhy\s)\b(?:can|does)\b(?![^.?!]*\brecords?\b)[^.?!]{0,40}\b(?:see|read|view|edit|access)\b[^.?!]{0,30}(?:\b\w+\.\w+\b|\b\w+__c\b[^.?!]{0,25}\bfields?\b|\bfields?\b[^.?!]{0,25}\b\w+__c\b)/,
+          // (c) "why can't <someone> edit/see <Object.field or Field__c>" — an FLS
+          //     gap on a named FIELD (no "records"), which why_cant_user_see_record
+          //     (record sharing) does not answer; field_access_audit shows who holds
+          //     read/edit on the field. The no-"records" guard routes the RECORD
+          //     variant ("why can't X see <Object> records") to why-cant-see instead.
+          //     "access" is deliberately EXCLUDED from the verb list here — the noun
+          //     phrase "<managed-package> access" (in a "why can't they run the
+          //     managed-package action" question) would otherwise be misread as an
+          //     FLS verb.
+          /\bwhy\s+can'?t\b(?![^.?!]*\brecords?\b)[^.?!]{0,40}\b(?:see|read|view|edit)\b[^.?!]{0,40}(?:\b\w+\.\w+\b|\b\w+__c\b)/
         ]
       },
       {
@@ -25763,6 +26075,27 @@ var init_intent_router = __esm({
           /\bdoes\b.*\bapex\b.*\b(enforce|CRUD|FLS)\b/
         ]
       },
+      {
+        // Deactivate-a-permission-set what-if (RESIDUAL 2). There is NO dedicated
+        // what_if_* simulator for permission sets in the vault tier, so this is an
+        // HONEST route to permission_risk_report (+ its impact edges via get_impact
+        // once the set is resolved): the report surfaces what access the set grants
+        // and who depends on it — the closest truthful answer to "does anything
+        // break if we deactivate it". needsResolve so the named permission set is
+        // resolved first. Sits before over-permission so a deactivation ask beats
+        // the generic god-mode phrasing; requires the deactivate/turn-off verb + a
+        // permission-set noun, so it never steals a plain over-privilege question.
+        intent: "permission-set-deactivation-impact",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.permission_risk_report", "sfi.get_impact"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "No what_if simulator exists for permission sets, so this routes honestly to permission_risk_report (what the set grants + who depends on it) with get_impact for the dependency surface \u2014 the truthful stand-in for a deactivation blast radius, not a fabricated simulation.",
+        patterns: [
+          /\b(?:deactivat\w+|disabl\w+|turn(?:ed|ing)?\s+off|remov\w+|delet\w+)\b[^.?!]{0,60}\bpermission\s+sets?\b/,
+          /\bpermission\s+sets?\b[^.?!]{0,60}\b(?:is|are|was|were|gets?|being)\s+(?:deactivated|disabled|turned\s+off|removed|deleted)\b/
+        ]
+      },
       {
         intent: "over-permission",
         plane: "vault",
@@ -25788,6 +26121,36 @@ var init_intent_router = __esm({
           /\bpermission\s+sets?\b.*\binstead\s+of\b.*\bprofiles?\b/
         ]
       },
+      {
+        // Profile login/session security — IP ranges ("IP relaxation"), login
+        // hours, session settings (sfi.profile_security). Eval family C: the
+        // "integration users" qualifier in "do any profiles have IP relaxation
+        // that would block integration users" dragged this onto integration_map;
+        // the head noun is the PROFILE security posture. Enumerative asks list
+        // Profiles then drill per profile (profile_security requires a profileId).
+        intent: "profile-security",
+        plane: "vault",
+        tools: ["sfi.list_components", "sfi.profile_security"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Profile login/session security (login IP ranges \u2014 'IP relaxation' \u2014 login hours, org session settings) is declared Profile metadata: list_components(type Profile) enumerates, then profile_security per profile reads the posture.",
+        suggestArgs: () => ({ type: "Profile" }),
+        patterns: [
+          /\bip\s+(?:relaxation|relaxed|ranges?|restrictions?|whitelists?|allowlists?)\b/,
+          /\blogin\s+(?:ip|hours?)\b/,
+          /\bprofiles?\b[^.?!]{0,50}\b(?:session\s+(?:timeout|settings?)|login\s+restrictions?)\b/,
+          // REACH (permissions/access cluster): MFA / password-policy / session
+          // security compared ACROSS profiles ("which profiles have MFA or session
+          // security settings weaker than the rest", "what password policies and
+          // session timeout are set per profile"). Both word orders (profile→setting
+          // and setting→profile). These are Profile login/session posture — the
+          // profile_security surface — which the IP/login-hours templates above did
+          // not cover. The `\bprofiles?\b` co-anchor keeps a generic "what is MFA"
+          // knowledge question on guidance.
+          /\bprofiles?\b[^.?!]{0,60}\b(?:mfa|multi[-\s]?factor|password\s+polic\w*|session\s+(?:security|timeout|settings?))\b/,
+          /\b(?:mfa|multi[-\s]?factor|password\s+polic\w*|session\s+(?:security|timeout|settings?))\b[^.?!]{0,60}\bprofiles?\b/
+        ]
+      },
       {
         // EARLY PRECISION RULE (P14-ROUTER-safe-delete-misroute): a long
         // compound delete-verdict question enumerates nouns ("every layout,
@@ -25808,7 +26171,13 @@ var init_intent_router = __esm({
         patterns: [
           /\bsafe(?:[\s_-]+to[\s_-]+delete|_to_delete_field)\b/,
           /\b(block|prevent)\w*\b[^.?!]{0,30}\bdeletion\b/,
-          /\bbefore\s+deleting\b/
+          /\bbefore\s+deleting\b/,
+          // "can I SAFELY delete X, Y, Z or are they referenced somewhere" — the
+          // adverb "safely" sits between "can i" and "delete", so the later
+          // `can\s+i\s+delete` pattern misses it. The safe/safely + delete/remove
+          // frame is the honest safe_to_delete_field ask (FIELD-FORENSICS REACH).
+          /\bcan\s+i\s+safely\s+(delete|remove)\b/,
+          /\bsafely\s+(delete|remove)\b[^.?!]{0,80}\breferenced\b/
         ]
       },
       {
@@ -25856,6 +26225,32 @@ var init_intent_router = __esm({
           /\bpermission\s+set\s+groups?\b[^.?!]{0,40}\b(no\s+one|nobody|unassigned|unused|assigned\s+to\s+nobody)\b/
         ]
       },
+      {
+        // HONEST GAP (eval family D): "which USERS have permission set X" is a
+        // holder ROSTER — PermissionSetAssignment is runtime assignment data the
+        // vault does not model, and no live tool answers it yet.
+        // effective_permissions / object_access_audit describe what a permission
+        // set GRANTS, not who HOLDS it, so substituting them would be confidently
+        // wrong. Mirrors the unassigned-permset-groups gap above. The reverse
+        // direction ("what permission sets does user X have") stays on
+        // effective-permissions via first-match.
+        intent: "permset-user-roster",
+        plane: "vault",
+        tools: [],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Which users hold a permission set (PermissionSetAssignment) is not modeled \u2014 capability gap.",
+        gap: {
+          category: "permset-user-roster",
+          note: 'PermissionSetAssignment modeling is not built yet, so "which users have permission set X" cannot be answered. Do not substitute effective_permissions or object_access_audit \u2014 they describe what a permission set GRANTS, not who holds it.'
+        },
+        patterns: [
+          /\b(which|what|list)\s+users?\b[^.?!]{0,40}\b(have|hold|with|assigned)\b[^.?!]{0,40}\bpermission\s+sets?\b/,
+          /\bwho\s+(has|holds|is\s+assigned)\b[^.?!]{0,50}\bpermission\s+sets?\b/,
+          /\b(everyone|everybody|all\s+users?)\b[^.?!]{0,30}\bwith\b[^.?!]{0,40}\bpermission\s+sets?\b/,
+          /\busers?\b[^.?!]{0,30}\bassigned\b[^.?!]{0,30}\bpermission\s+sets?\b/
+        ]
+      },
       {
         intent: "empty-queues-groups",
         plane: "vault",
@@ -25868,7 +26263,39 @@ var init_intent_router = __esm({
           /\b(queues?|public\s+groups?)\b.*\b(empty|no\s+members?|unused)\b/,
           /\b(which|what)\s+queues?\b.*\b(set\s+up|for|exist)\b/,
           /\bpublic\s+groups?\b.*\b(exist|who\s+is)\b/,
-          /\bwhat\s+public\s+groups?\b/
+          /\bwhat\s+public\s+groups?\b/,
+          // DISCOVERY/META REACH: routing-trap SYMPTOM questions. When work "isn't
+          // getting picked up" / members "can't see cases routed to them", the
+          // HONEST first check is whether the queue actually HAS members — exactly
+          // what empty_queues_and_groups reports (memberCount / unknownMemberCount).
+          // Every pattern REQUIRES the literal "queue(s)" AND a NEGATIVE/failure
+          // frame (can't / not / isn't picked up / sitting in / exist-challenge),
+          // so a neutral "which queues does X route to and who are the members"
+          // stays a get_component ask (handled by the queue-membership rule below),
+          // and a record-sharing ("why can't X see an Account") question — which
+          // carries no "queue" — never lands here.
+          // "why can (members of) <queue> NOT see … routed to them"
+          new RegExp(`\\bqueues?\\b[^.?!]{0,80}\\b(?:can'?t|cannot|not\\s+(?:see|get|pick|able)|isn'?t|aren'?t)\\b`),
+          // Queue named only by its `_Queue` API-name suffix (no standalone "queue"
+          // word — underscore is a word char so `\bqueue\b` misses "ada_team_queue")
+          // WITH a member/routing symptom. "why can members of <X>_Queue not see …
+          // cases ROUTED to them" — the routing-trap membership check.
+          // Failure-framed only ("NOT see", "can't", "isn't picked up") — a neutral
+          // "which queues does <X>_Queue ROUTE to and who are the members" stays a
+          // get_component ask (route/routed deliberately excluded here).
+          /_queue\b[^.?!]{0,80}\b(?:not\s+(?:see|get|pick|able)|can'?t|cannot|isn'?t\s+(?:getting|picked))\b/,
+          /\bmembers?\s+of\b[^.?!]{0,30}_queue\b[^.?!]{0,80}\b(?:not|can'?t|cannot)\b/,
+          new RegExp(`\\b(?:can'?t|cannot|not\\s+(?:see|get|pick|able)|isn'?t|aren'?t)\\b[^.?!]{0,80}\\bqueues?\\b`),
+          // "why is the Lead SITTING IN <queue> instead of getting PICKED UP —
+          // queue members exist, right?" — the stuck-in-queue symptom.
+          /\bsitting\s+in\b[^.?!]{0,40}\bqueues?\b/,
+          /\bqueues?\b[^.?!]{0,40}\b(?:picked\s+up|getting\s+picked)\b/,
+          /\bqueue\s+members?\b[^.?!]{0,30}\bexist\b/,
+          // "why can't a user REASSIGN a Case to <Named>? They can touch every
+          // other QUEUE" — reassignment-to-a-queue trouble; the membership /
+          // queue-access check is the honest first probe. Requires a can't/cannot
+          // failure frame co-occurring with "reassign" and "queue".
+          new RegExp(`\\b(?:can'?t|cannot)\\b[^.?!]{0,40}\\breassign\\w*\\b.*\\bqueues?\\b`)
         ]
       },
       {
@@ -25921,7 +26348,12 @@ var init_intent_router = __esm({
         reason: "Profile\u2192permission-set migration / merge-split planning from permission metadata.",
         patterns: [
           /\bprofiles?\b.*\b(to|into|vs)\b.*\bpermission\s+sets?\b/,
-          /\b(merge|split|consolidate)\b.*\bprofiles?\b/,
+          // `\bmerge\b` never matched the PAST tense "merged" (no boundary after
+          // "merge"), so "what would break if I MERGED the A and B profiles" fell
+          // through to unrouted. `merg\w*` catches merge/merged/merging; the two
+          // named profiles + the plural "profiles" keep it precise (USAGE/impact
+          // REACH — profiles/access family).
+          /\b(merg\w*|split|splitting|consolidat\w*)\b.*\bprofiles?\b/,
           /\bprofile\s+migration\b/,
           // PASSIVE voice (P1c): "what if two profiles are merged / were consolidated"
           // — the active templates above ("if I merge profiles") missed the passive
@@ -25939,11 +26371,20 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: true,
         reason: "Traces where a field flows (upstream/downstream) across Apex, flows, integrations.",
+        // DEMOTED from catch-all (eval family E): field_lineage was the default
+        // for any field-adjacent question carrying "flow(s)" or a bare
+        // "upstream/downstream". Every pattern now requires an explicit
+        // lineage/provenance/movement frame, so the earlier field-access /
+        // explain-flow / save-order rules keep their heads and only genuine
+        // "where does this data come from / flow to" questions land here.
         patterns: [
           /\b(data\s+flow|lineage)\b/,
-          /\bwhere\s+does\b.*\b(field|data|pii|it)\b.*\b(flow|go)\b/,
-          /\bfield\b.*\bflows?\b/,
-          /\b(upstream|downstream)\b/
+          /\bwhere\s+does\b.*\b(field|data|pii|it)\b.*\b(flow|go|come\s+from)\b/,
+          /\bfield\b[^.?!]{0,50}\bflows?\s+(?:to|into|out|through|downstream|between)\b/,
+          // A change/delete/disable verb marks an IMPACT question, not lineage —
+          // "what breaks downstream if I delete the X field" stays impact-analysis.
+          /^(?!.*\b(?:break|delet|disabl|deactivat|remov|chang)\w*\b).*\b(upstream|downstream)\b[^.?!]{0,40}\b(?:fields?|data)\b/,
+          /^(?!.*\b(?:break|delet|disabl|deactivat|remov|chang)\w*\b).*\b(?:fields?|data)\b[^.?!]{0,40}\b(upstream|downstream)\b/
         ]
       },
       {
@@ -26000,6 +26441,68 @@ var init_intent_router = __esm({
         ]
       },
       // === Automation / order-of-execution (vault) ==============================
+      {
+        // Disable-a-trigger what-if (eval family C): "blast radius if I disable
+        // trigger T" was hijacked by qualifier words — "integration"/vendor-sync
+        // onto integration_map, bare "downstream" onto field_lineage — when the
+        // head question is the dedicated what_if_disable_trigger simulation.
+        // Sits FIRST in the automation cluster so a disable ask beats the generic
+        // trigger-order/automation-on-object phrasings; those carry no
+        // disable/turn-off verb, so nothing is stolen from them.
+        intent: "what-if-disable-trigger",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.what_if_disable_trigger"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "What stops firing / breaks if a named trigger is disabled \u2014 the dedicated what_if_disable_trigger simulation over the vault graph (not integration topology, not generic lineage).",
+        patterns: [
+          /\bdisabl\w+\b[^.?!]{0,40}\btriggers?\b/,
+          /\btriggers?\b[^.?!]{0,40}\b(?:is|was|were|gets?|being)\s+disabled\b/,
+          /\b(?:turn(?:ed|ing)?\s+off|switch(?:ed|ing)?\s+off)\b[^.?!]{0,40}\btriggers?\b/
+        ]
+      },
+      {
+        // Deactivate-a-flow what-if (RESIDUAL 2): "what breaks if I deactivate the
+        // Onboarding flow" / "if I turn off FlowA and FlowB, does anything break".
+        // The dedicated what_if_deactivate_flow simulator owns these — before it,
+        // the deactivate-flow phrasing fell to generic impact-analysis (get_impact,
+        // not the flow-specific simulator) and the "turn off … does anything break"
+        // shape went unrouted entirely. Sits with the disable-trigger rule ahead of
+        // trigger-order/automation-on-object: those carry no deactivate/turn-off
+        // verb, so nothing is stolen from a save-order question. The deactivate/
+        // turn-off verb + FLOW noun is the discriminator; needsResolve so the named
+        // flow (or the first of several) is resolved before the simulation.
+        intent: "what-if-deactivate-flow",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.what_if_deactivate_flow"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "What stops running / breaks if a named flow is deactivated \u2014 the dedicated what_if_deactivate_flow simulation over the vault graph (not a generic get_impact walk).",
+        patterns: [
+          /\b(?:deactivat\w+|disabl\w+|turn(?:ed|ing)?\s+off|switch(?:ed|ing)?\s+off)\b[^.?!]{0,60}\bflows?\b/,
+          /\bflows?\b[^.?!]{0,60}\b(?:is|are|was|were|gets?|being)\s+(?:deactivated|disabled|turned\s+off)\b/,
+          /\bflows?\b[^.?!]{0,60}\b(?:deactivat\w+|turn(?:ed|ing)?\s+off)\b/,
+          // API-name form: "turn off Discount_Flow and Pricing_Flow, does anything
+          // break" — the flow names carry the `_Flow` suffix rather than a standalone
+          // "flow" word, so anchor on a deactivate/turn-off verb next to a *_Flow
+          // component name (the whole-word "flow" alternations above miss this).
+          /\b(?:deactivat\w+|disabl\w+|turn(?:ed|ing)?\s+off|switch(?:ed|ing)?\s+off)\b[^.?!]{0,40}\b[A-Za-z][A-Za-z0-9]*_Flow\b/i,
+          // Flow-family API-name suffixes beyond `_Flow` (flow-family REACH): a
+          // deactivate/turn-off verb next to a `_Process` / `_Orch` / `_Screen_Flow`
+          // component name (e.g. Application_Save_RT_Orch). The SINGULAR flow-family
+          // suffix (`_flow`, not the plural `_flows`) keeps the existing guard that a
+          // plural embedded-Flow name like `ADA_Accom_Flow_Attribute_Flows` stays on
+          // impact-analysis.
+          /\b(?:deactivat\w+|disabl\w+|turn(?:ed|ing)?\s+off|switch(?:ed|ing)?\s+off)\b[^.?!]{0,60}\b[a-z][a-z0-9_]*_(?:process|orch|screen_flow)\b/i,
+          // "what would happen if I deactivated <flow-suffix name>" — the explicit
+          // what-if frame with a flow-family-named component.
+          /\bwhat\s+would\s+happen\s+if\s+i\s+deactivat\w+\b[^.?!]{0,60}\b[a-z][a-z0-9_]*_(?:flow|process|orch|screen_flow)\b/i,
+          // "suppose we deactivated <NamedComponent> versus <NamedComponent>" — the
+          // "suppose … deactivated" lead is absent from the "what if we deactivate"
+          // impact-analysis guard, so a >=2-underscore API name is safe here.
+          new RegExp(`\\bsuppose\\s+we\\s+deactivat\\w+\\b[^.?!]{0,60}\\b${NAMED_COMPONENT_ID}\\b`)
+        ]
+      },
       {
         intent: "trigger-order",
         plane: "vault",
@@ -26016,7 +26519,9 @@ var init_intent_router = __esm({
         },
         patterns: [
           /\b(trigger\s+order|order\s+of\s+execution)\b/,
-          /\bwhat\s+(happens|runs|fires)\b.*\b(on\s+save|when\b.*\b(created|saved|updated|inserted|deleted|undeleted|restored))\b/,
+          // One optional adverb between "what" and the verb — "what ACTUALLY
+          // happens on save" fell through to unrouted (eval OVER-CLARIFY family A).
+          /\bwhat\s+(?:\w+\s+)?(happens|runs|fires)\b.*\b(on\s+save|when\b.*\b(created|saved|updated|inserted|deleted|undeleted|restored))\b/,
           // "what happens when I update Contact" — present-tense DML without "on save"
           /\bwhat\s+(happens|runs|fires)\b.*\bwhen\b.*\b(i\s+)?(update|insert|delete|save|create|edit)\b/,
           // "which/what flows|triggers|VRs|workflows run|fire when ..." — the
@@ -26030,8 +26535,14 @@ var init_intent_router = __esm({
           // "what happens when a Case STATUS CHANGES" — a status/stage change is a
           // save-order event the "(created|updated|...)" verb list missed (B21).
           /\bwhat\s+(happens|runs|fires)\b.*\b(status|stage)\b.*\bchang/,
-          // "What runs on Account insert?" — DML event without "on save" / "when" (B21).
-          /\bwhat\s+runs\b.*\b(insert|update|delete|undelete)\b/,
+          // "What runs on Account insert?" — DML event without "on save" / "when"
+          // (B21). Verb-symmetric "fires"/"happens" too: "what FIRES on X insert
+          // during the integration load — what runs bulk" is a save-order head
+          // question; the bulk/load/integration qualifiers must not drag it onto
+          // governor_limit_risks or integration_map (eval family C).
+          // ("what happens IF I delete…" is an impact/what-if frame, not a DML
+          // save-order ask — the immediate "if" is excluded so it falls through.)
+          /\bwhat\s+(?:runs|fires|happens)\b(?!\s+if\b).*\b(insert|update|delete|undelete)\b/,
           // "what happens when I SAVE an Evaluation" — present-tense "save"/"saves"/
           // "saving" (the verb list above only had past-tense "saved"). Question-
           // battery gap.
@@ -26040,7 +26551,50 @@ var init_intent_router = __esm({
           /\bwhen\b.*\b(is\s+)?(inserted|updated|deleted|created)\b.*\b(trigger|fire)\b/,
           /\bdo\b[^.?!]{0,120}\b(trigger|triggers)\b[^.?!]{0,80}\bfire\b/,
           /\b(trigger|triggers)\b.*\b(both|and)\b.*\bfire\b/,
-          /\b(same\s+transaction|rollup)\b.*\b(after[-\s]?insert|DLRS|dlrs)/i
+          /\b(same\s+transaction|rollup)\b.*\b(after[-\s]?insert|DLRS|dlrs)/i,
+          // FULL SAVE-ORDER / whole-transaction reconstruction (flow-family REACH).
+          // "walk me through everything that fires in order", "list every/all
+          // automation that fires when …", "full save order on X", "before-vs-after
+          // -save breakdown of every automation" — the whole-order ask, distinct
+          // from lifecycle-process (transition-value coupled) which owns the
+          // "…becomes/is set to <value>" shapes above it.
+          /\b(everything|every\s+automation|all\s+(?:the\s+)?automation)\b[^.?!]{0,60}\b(fires?|runs?|happens?)\b/,
+          /\b(fires?|runs?|happens?)\b[^.?!]{0,40}\bin\s+order\b/,
+          /\b(list|give\s+me)\b[^.?!]{0,40}\b(?:every|all)\b[^.?!]{0,20}\bautomation\b[^.?!]{0,50}\b(fires?|runs?|when)\b/,
+          /\bfull\s+save\s+order\b/,
+          /\bsave\s+order\b[^.?!]{0,40}\b(?:on|for)\b/,
+          /\bbefore[-\s]?(?:vs[-\s]?)?after[-\s]?save\b[^.?!]{0,40}\b(breakdown|every\s+automation|automation)\b/,
+          // "what order do validation rules and record-triggered flows evaluate" —
+          // an explicit ordering question over multiple automation families.
+          /\bwhat\s+order\b[^.?!]{0,90}\b(evaluate|run|fire|execute)\b/,
+          // "run order between <FlowA> and <flow>" — the pairwise ordering ask.
+          /\brun\s+order\s+between\b/,
+          // "which apex classes are triggered when a X is inserted/created" — the
+          // "apex classes" phrasing the "(apex|code|class)" pattern above missed
+          // because it requires the singular "runs" verb, not "are triggered".
+          /\b(?:which|what)\s+apex\s+classes?\b[^.?!]{0,40}\b(triggered|fire|run)\b[^.?!]{0,40}\b(insert|update|delete|save|creat)/,
+          // "does anything run on X update that would collide with <Flow>" — an
+          // impact-on-save question framed as "does anything run … on <dml>".
+          /\bdoes\s+anything\s+(run|fire|happen)\b[^.?!]{0,40}\b(update|insert|save|edit|creat)/,
+          // "what else fires on the same X save transaction" — co-firing on the same
+          // transaction as a named automation.
+          /\bwhat\s+else\s+(fires?|runs?|happens?)\b[^.?!]{0,60}\bsave\s+transaction\b/,
+          // "assignment rules … run before or after the record-triggered flows" — the
+          // classic order-of-execution question about where assignment rules sit.
+          /\bassignment\s+rules?\b[^.?!]{0,60}\b(before|after)\b[^.?!]{0,40}\b(?:record[-\s]?triggered\s+)?flows?\b/,
+          // "will it fight/collide/conflict with HEDA" when ADDING an after-save flow
+          // — the build-planning ask whose answer is the existing save-order.
+          /\b(?:after[-\s]?save|before[-\s]?save)\s+flow\b[^.?!]{0,80}\b(fight|collide|conflict|clash)\b/,
+          // ORDER-OF-EXECUTION: "which TDTM/handler/trigger classes fire on X insert
+          // and in what order" — the ordered trigger-handler question (HEDA TDTM
+          // handlers register per DML event). "in what order" is the discriminator.
+          /\b(?:which|what)\b[^.?!]{0,60}\b(?:tdtm|handler|trigger)\s+classes?\b[^.?!]{0,50}\bfire\b[^.?!]{0,50}\b(?:in\s+what\s+order|what\s+order|order)\b/,
+          // "does <NamedFlow> run before or after <the> lead conversion" — a pairwise
+          // ordering ask relative to a conversion; order_of_execution reconstructs it.
+          // (lifecycle-process owns "what runs WHEN a Lead is converted"; this "run
+          // before/after conversion" shape carries no such "what happens when" head,
+          // so the two stay disjoint.)
+          /\bruns?\s+(?:before|after)\b[^.?!]{0,60}\b(?:lead\s+conversion|converts?\s+the\s+lead|conversion)\b/
         ]
       },
       {
@@ -26174,7 +26728,42 @@ var init_intent_router = __esm({
           /\bwhen\s+does\s+it\s+run\b/,
           /\bdoes\b.*\bflow\b.*\b(system\s+mode|without\s+sharing|with\s+sharing)\b/,
           /\b(system\s+mode|without\s+sharing|sharing\s+bypass)\b.*\bflow\b/,
-          /\b(run|runs|running)\b.*\b(system\s+mode|without\s+sharing)\b.*\bflow\b/
+          /\b(run|runs|running)\b.*\b(system\s+mode|without\s+sharing)\b.*\bflow\b/,
+          // NAMED-FLOW narration (flow-family REACH). A question that NAMES a
+          // component by its API name (NAMED_COMPONENT_ID — a >=2-underscore token,
+          // never English prose) AND asks to narrate/summarize/walk-through it is an
+          // explain_flow ask. Each pattern REQUIRES the named id so a generic
+          // "explain the sharing model" never lands here. resolve binds the entity
+          // and the type-guard keeps explain_flow on a real Flow.
+          // A COMPARE frame ("explain the difference between A and B", "compare …")
+          // is NOT single-flow narration — explain_flow narrates ONE flow, so a
+          // two-flow comparison must fall through (it stays a compare/unrouted gap
+          // rather than a forced bad route). The `(?!…difference/compare/versus…)`
+          // lookahead on the narration patterns below enforces that.
+          new RegExp(`^(?!.*\\b(?:difference|differences|compare|comparison|versus|vs\\.?)\\b).*\\b(explain|summariz(?:e|ing)|walk\\s+me\\s+through|walkthrough|plain[-\\s]english\\s+walkthrough|purpose\\s+of)\\b[^.?!]{0,60}\\b${NAMED_COMPONENT_ID}\\b`),
+          new RegExp(`\\b${NAMED_COMPONENT_ID}\\b[^.?!]{0,60}\\b(in\\s+plain\\s+(?:terms|english)|end\\s+to\\s+end|step\\s+by\\s+step)\\b`),
+          // Narration verbs where the named id sits BEFORE the verb clause — e.g.
+          // "Summarize <Name> and what it's calculating", "Explain <Name> and what
+          // a 'flag' means", "What does <Name> copy from …". Same compare-frame
+          // guard so "explain the difference between <A> and <B>" is not stolen.
+          new RegExp(`^(?!.*\\b(?:difference|differences|compare|comparison|versus|vs\\.?)\\b).*\\b(?:explain|summarize|walk\\s+me\\s+through)\\b[^.?!]{0,20}\\b${NAMED_COMPONENT_ID}\\b`),
+          new RegExp(`\\bwhat\\s+does\\b[^.?!]{0,20}\\b${NAMED_COMPONENT_ID}\\b[^.?!]{0,40}\\b(do|does|copy|copies|write|writes|calculat\\w*)\\b`),
+          // "Does <Name> fire/run/write/have/send …" — a behavior question about a
+          // NAMED flow (does it fire on insert+update, run every time, write to X,
+          // have fault connectors, send texts). The named id as grammatical subject
+          // of a flow-behavior verb keeps it precise.
+          new RegExp(`\\bdoes\\s+(?:the\\s+)?${NAMED_COMPONENT_ID}\\b[^.?!]{0,80}\\b(fire|fires|run|runs|write|writes|have|has|send|sends|execute|re-?trigger)\\b`),
+          // "Is <Name> a before-save/after-save/fast-field/scheduled/screen flow …" —
+          // a flow-shape classification question about a named flow.
+          new RegExp(`\\bis\\s+(?:the\\s+)?${NAMED_COMPONENT_ID}\\b[^.?!]{0,60}\\b(before[-\\s]?save|after[-\\s]?save|fast[-\\s]?field|scheduled\\s+path|screen\\s+flow|record[-\\s]?triggered)\\b`),
+          // "What entry condition(s)/entry criteria gate/on <Name>" and "why would
+          // <Name> skip a record" — entry-gate and skip-behavior narration.
+          /\bentry\s+conditions?\b[^.?!]{0,20}\b(gate|on)\b/,
+          /\bwhat(?:'s| is)?\s+the\s+entry\s+condition\b/,
+          new RegExp(`\\bwhy\\s+would\\s+${NAMED_COMPONENT_ID}\\b[^.?!]{0,60}\\bskip\\b`),
+          // "Does <Name> have any active version" / "why is it named like that" — the
+          // active-version + naming question about a named flow.
+          new RegExp(`\\bdoes\\s+${NAMED_COMPONENT_ID}\\b[^.?!]{0,40}\\b(active\\s+version|any\\s+active)\\b`)
         ]
       },
       {
@@ -26292,7 +26881,12 @@ var init_intent_router = __esm({
           /\b(which|what)\s+tests?\b.*\b(run|chang|modif|deploy|impact|diff|edit)/,
           /\btests?\b.*\bfor\s+(my|this|the|these)\s+(change|changes|diff|deploy|branch|pr|edit|edits)\b/,
           /\b(test\s+impact|impacted\s+tests?|test\s+selection|minimal\s+(set\s+of\s+)?tests?|test\s+subset)\b/,
-          /\bwhat\s+(do\s+i|should\s+i|to)\s+(run|test)\b.*\b(chang|deploy|diff)/
+          /\bwhat\s+(do\s+i|should\s+i|to)\s+(run|test)\b.*\b(chang|deploy|diff)/,
+          // "which/what test class COVERS <X> (and does it test the bulk case)" —
+          // which tests exercise a named class is the tests_for_change call-graph
+          // walk; the trailing "bulk" qualifier must not drag it onto
+          // governor_limit_risks (eval family C).
+          /\b(?:which|what)\s+test\s+class(?:es)?\b[^.?!]{0,20}\bcovers?\b/
         ]
       },
       {
@@ -26313,8 +26907,19 @@ var init_intent_router = __esm({
           /\b(fake|meaningless|empty|no\s+(real\s+)?)\s*assert/,
           /\btests?\b.*\bno\s+(real\s+)?assert/,
           /\bassertion\s+(quality|coverage)\b/,
+          // "meaningful test audit on <X>" — the tool's own name as a natural-language
+          // ask (USAGE/test-forensics REACH). Plus the classic no-op assertion tell
+          // `System.assert(true)` / `assert(true)` that flags a rubber-stamp test.
+          /\bmeaningful\s+test\s+audit\b/,
+          /\bassert\w*\s*\(\s*true\s*\)/,
           /\b(less\s+than|below|under)\b.*\b\d+\s*%\b.*\bcoverage\b/,
           /\b(coverage|percent)\b.*\b(less\s+than|below|under)\b/,
+          // "list apex classes below 75% coverage" — the `%\b` above never matches
+          // "75% coverage" (%→space is not a word boundary), so the phrasing fell
+          // through to the schema list rule and answered with get_component instead
+          // of the coverage tools (eval family D).
+          /\b(below|under|less\s+than)\s+\d+\s*(?:%|percent)?\s*(?:code\s+|test\s+)?coverage\b/,
+          /\bcoverage\b[^.?!]{0,25}\b(below|under|less\s+than)\s+\d+/,
           /\bwhich\s+apex\s+classes\b.*\bcoverage\b/,
           /\bseealldata\s*=\s*true\b/i,
           /\bsee\s+all\s+data\b/i,
@@ -26360,7 +26965,12 @@ var init_intent_router = __esm({
           // "show performance risks in apex" — performance/scale risk phrasing the
           // governor-limit recognizer answers. Battery gap.
           /\bperformance\s+(risk|issue|problem|concern|bottleneck)s?\b/,
-          /\b(bulk|bulkif|unbounded)\b/,
+          // "bulk" is a MODIFIER, not a head noun (eval family C): when the head
+          // question is save-order ("what fires/runs/happens on X insert … what
+          // runs bulk") or test coverage ("which test class covers Y … the bulk
+          // case"), those earlier rules win by order — this guard keeps the bare
+          // word from firing even when their patterns miss a phrasing.
+          /^(?!.*\b(?:what\s+(?:fires|runs|happens)|test\s+class)\b).*\b(bulk|bulkif|unbounded)\b/,
           /\bcpu\s+time\b/,
           /\bheap\s+size\b/,
           /\bmost\s+dml\b/,
@@ -26406,7 +27016,14 @@ var init_intent_router = __esm({
           // extend the X package" — your customizations grafted onto a managed
           // package's objects (the package_impact extensionCount surface).
           /\b(what|which)\s+(of\s+(my|our)\s+)?(components?|metadata|customizations?|objects?|fields?)\b.*\bextends?\b/,
-          /\bextends?\b.*\b(package|namespace|managed)\b/
+          /\bextends?\b.*\b(package|namespace|managed)\b/,
+          // "what custom fields did <Package> INJECT across <objects>? Inventory for
+          // UNINSTALL" — a managed-package boundary/uninstall inventory named by the
+          // package rather than the literal word "package". The uninstall/inventory
+          // frame + the inject/add-across verb keep it on package_impact and off the
+          // generic field-usage tools (USAGE/IMPACT REACH — package boundary).
+          /\b(inject\w*|add\w*|install\w*)\b[^.?!]{0,40}\bacross\b[^.?!]{0,60}\b(objects?|lead|contact|account|case|opportunity)\b[^]*\b(uninstall|inventory)\b/,
+          /\binventory\s+for\s+uninstall\b/
         ]
       },
       {
@@ -26535,7 +27152,16 @@ var init_intent_router = __esm({
           /\brelease\s+readiness\b/,
           /\b(ready|readiness)\b.*\b(release|deploy|go[-\s]?live|cutover|production)\b/,
           /\bpre[-\s]?release\b.*\b(check|review|audit)\b/,
-          /\bgo[-\s]?live\b.*\b(risk|readiness|checklist)\b/
+          /\bgo[-\s]?live\b.*\b(risk|readiness|checklist)\b/,
+          // DISCOVERY/META REACH: "is this org release-ready for the summer push,
+          // or are there blockers" — the hyphenated "release-ready" adjective and
+          // the "blockers" framing the patterns above missed (they keyed on
+          // "release readiness"/"ready … [to] release"). Co-anchored on
+          // release/deploy/ship so a generic "are we ready for the demo" (no
+          // release verb) does not match.
+          /\brelease[-\s]?ready\b/,
+          /\b(?:blockers?|showstoppers?)\b[^.?!]{0,40}\b(?:release|deploy|ship|go[-\s]?live|production|cutover)\b/,
+          /\b(?:release|deploy|ship|go[-\s]?live|production|cutover)\b[^.?!]{0,40}\b(?:blockers?|showstoppers?)\b/
         ]
       },
       // === Vault health / freshness / coverage (vault) ==========================
@@ -26628,6 +27254,27 @@ var init_intent_router = __esm({
           /\bmetadata\b.*\b(documented|documentation)\b/
         ]
       },
+      {
+        // API-version hygiene ("any apex still on API version below 50?") was
+        // unrouted — the schema rule only covers the single-component "what is the
+        // api version of X" lookup (eval family D). tech_debt_score carries the
+        // roll-up (apexBelowApiVersion30/40/50Count) and list_components(type:
+        // ApexClass) enumerates the classes with each node's apiVersion.
+        intent: "api-version-audit",
+        plane: "vault",
+        tools: ["sfi.tech_debt_score", "sfi.list_components"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Old-API-version inventory: tech_debt_score counts Apex below API version 30/40/50, and list_components(type: ApexClass) carries each class apiVersion.",
+        suggestArgs: () => ({ type: "ApexClass" }),
+        patterns: [
+          /\bapi\s+versions?\b[^.?!]{0,25}\b(below|under|older|before|less\s+than)\b/,
+          /\b(old|outdated|legacy|ancient)\b[^.?!]{0,15}\bapi\s+versions?\b/,
+          /\b(apex|class(es)?|components?|metadata|flows?|triggers?)\b[^.?!]{0,40}\b(still\s+on|stuck\s+on|running\s+on)\b[^.?!]{0,15}\bapi\s+version/,
+          /\b(upgrad|updat|bump)\w*\b[^.?!]{0,25}\bapi\s+versions?\b/,
+          /\bapi\s+versions?\b[^.?!]{0,25}\b(upgrad|updat|bump)/
+        ]
+      },
       {
         // "Which classes implement <interface>" (Batchable, Schedulable, Queueable,
         // RestResource, ...) — grep Apex source for the implements clause. The
@@ -26657,7 +27304,32 @@ var init_intent_router = __esm({
         patterns: [
           /\bfind\b.*\b(class|apex|code)\b.*\b(mentions?|references?|uses?|calls?|reads?|writes?|with)\b/,
           /\b(which|what)\s+(classes?|apex)\b.*\b(mentions?|references?|uses?|touch(es)?|reads?|writes?|calls?|invokes?)\b/,
-          /\bsearch\b.*\b(apex|code)\b/
+          /\bsearch\b.*\b(apex|code)\b/,
+          // "which classes make HTTP callouts and what endpoints do they hit" —
+          // HTTP callouts live in Apex SOURCE, so the answer is a source grep,
+          // not the outbound endpoint catalog and never field lineage (eval
+          // family C). "What endpoints do we call out to?" (no "callout" noun,
+          // no HTTP) stays on the outbound endpoints catalog below.
+          /\bhttp\s+callouts?\b/,
+          /\bcallouts?\b[^.?!]{0,50}\bendpoints?\b/
+        ]
+      },
+      {
+        // "Does <the named class/job> run async — in its own transaction?" is a
+        // question about ONE component's actual implementation (its @future /
+        // Queueable / Batchable shape, read from its source via get_component),
+        // not a best-practice lecture — the "async" qualifier was dragging it
+        // onto the generic knowledge-plane guidance rule (eval family C).
+        intent: "async-transaction-context",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Whether a named component runs async in its own transaction is read from its OWN source/metadata (resolve it, then get_component shows the @future/Queueable/Batchable shape) \u2014 not generic async guidance.",
+        patterns: [
+          /\basync\w*\b[^.?!]{0,80}\bown\s+transaction\b/,
+          /\bown\s+transaction\b[^.?!]{0,80}\basync\w*/,
+          /\bin\s+its\s+own\s+transaction\b/
         ]
       },
       // === Integration (vault) ==================================================
@@ -26689,9 +27361,15 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: false,
         reason: "Topology of the org's integration surfaces (named creds, connected apps, remote sites, external services).",
+        // Guarded (eval family C — qualifier hijack): "integration"/vendor-sync
+        // words are MODIFIERS when the head question is a what-if simulation
+        // ("if the field type changed, what integrations blow up"), a blast
+        // radius ("blast radius if I disable trigger T"), a field-write audit,
+        // or profile IP security — those heads route earlier / later on their
+        // own rules, so the bare noun must not force the topology catalog.
         patterns: [
-          /\b(integrations?|named\s+credentials?|connected\s+apps?|remote\s+sites?|external\s+services?|auth\s+providers?)\b/,
-          /\bwhat\b.*\bintegrat/,
+          /^(?!.*\b(?:what\s+if|blast\s+radius|what\s+breaks|blows?\s+up|field\s+type|data\s+type|written\s+(?:only\s+)?by|only\s+ever\s+written|ip\s+relax\w*|disabl\w+)\b).*\b(integrations?|named\s+credentials?|connected\s+apps?|remote\s+sites?|external\s+services?|auth\s+providers?)\b/,
+          /^(?!.*\b(?:what\s+if|blast\s+radius|what\s+breaks|blows?\s+up|field\s+type|data\s+type|written\s+(?:only\s+)?by|only\s+ever\s+written|ip\s+relax\w*|disabl\w+)\b).*\bwhat\b.*\bintegrat/,
           /\bapi\b.*\b(connections?|surfaces?)\b/
         ]
       },
@@ -26706,7 +27384,17 @@ var init_intent_router = __esm({
           /\b(platform\s+events?|change\s+data\s+capture|cdc)\b.*\b(subscrib|listen|consum)\b/,
           /\bwho\s+(subscribes?|listens?)\b/,
           /\b(subscribers?|subscriptions?)\b.*\bevents?\b/,
-          /\bshow\s+event\s+subscribers?\b/
+          /\bshow\s+event\s+subscribers?\b/,
+          // CDC fan-out / subscriber discovery (flow-family REACH). "what's
+          // SUBSCRIBING TO Change Data Capture" (verb precedes the noun, so the
+          // noun→verb pattern above misses it), "if turning on CDC for X will fan
+          // out", and "CDC or platform-event subscribers feeding Marketo" (hyphenated
+          // "platform-event" the space-only alternation above misses). Anchored to a
+          // CDC/platform-event noun so a generic "who subscribes" is unaffected.
+          /\b(subscrib\w*)\b[^.?!]{0,30}\b(change\s+data\s+capture|cdc|platform[-\s]?events?)\b/,
+          /\b(turn\w*\s+on|enabl\w+)\s+cdc\b/,
+          /\bcdc\b[^.?!]{0,40}\bfan\s+out\b/,
+          /\b(cdc|change\s+data\s+capture|platform[-\s]?events?)\b[^.?!]{0,40}\bsubscribers?\b/
         ]
       },
       {
@@ -26867,7 +27555,15 @@ var init_intent_router = __esm({
           /\bdeactivating\b.*\b(break|would)\b/,
           /\breplacing\b.*\bwith\b.*\b(lwc|aura)\b/,
           /\baffected\b.*\b(removing|remove)\b.*\brecord\s+type/,
-          /\bwhat\s+would\s+break\b.*\b(changed|change)\b/
+          /\bwhat\s+would\s+break\b.*\b(changed|change)\b/,
+          // "what if I REMOVED the <X> record type … which page layouts and flows
+          // assume it exists" — a record-type deletion blast radius (IMPACT REACH).
+          // `\bremove\b` misses the PAST tense "removed", so this fell through to
+          // unrouted. High-precision: the remove/delete verb must co-occur with the
+          // literal "record type" AND a what-if/assume/kept frame, so it never steals
+          // a field-type what-if (those say "field"/"required"/"picklist value").
+          /\b(remov\w*|delet\w*|drop\w*)\b[^.?!]{0,40}\brecord\s+type\b[^]*\b(assume|assumes?|kept|keep|rely|relies|reference|expect)\w*/,
+          /\bwhat\s+if\s+i\s+(remov\w*|delet\w*|drop\w*)\b[^.?!]{0,40}\brecord\s+type\b/
         ]
       },
       {
@@ -26886,7 +27582,32 @@ var init_intent_router = __esm({
           /\b(change|convert)\b.*\bfield\s+type\b/,
           /\b(change|changed)\b.*\bdata\s+type\b/,
           /\bdata\s+type\b.*\bchange/,
-          /\bremove\b.*\bpicklist\s+value\b/
+          // PASSIVE / noun-first form — "if the field type CHANGED, what
+          // integrations blow up": \bchange\b never matches "changed", so the
+          // phrasing fell through and the "integrations" qualifier hijacked it
+          // onto integration_map (eval family C).
+          /\bfield\s+type\b[^.?!]{0,60}\bchang/,
+          /\bremove\b.*\bpicklist\s+value\b/,
+          // FIELD-FORENSICS REACH (what_if_make_field_required / _change_field_type).
+          // The `\bmake\b` and `\bchange\b` verb anchors above miss the PAST tense
+          // ("if we MADE X required", "if I CHANGED X") and the noun form
+          // ("required-field validation"), so these fell to unrouted. Each new
+          // pattern REQUIRES a required/field-type/picklist frame near the verb, so
+          // it stays a schema what-if and never steals a value-change or usage ask.
+          // "if we made <field> required" / "made X required but left Y optional".
+          /\bmade\b[^.?!]{0,40}\brequired\b/,
+          // "adding a required-field validation on <Field>" — making a field
+          // mandatory expressed as a validation-rule ask; the required frame keeps
+          // it on what_if_make_field_required.
+          /\brequired[-\s]field\b/,
+          /\b(add\w*|making|makes)\b[^.?!]{0,30}\brequired\b/,
+          // "what happens if I change <field> FROM a picklist TO a text field" — a
+          // field-TYPE conversion named by the from/to types (picklist→text) rather
+          // than the literal "field type". The from-X-to-Y frame around a field-type
+          // noun (picklist/text/number/checkbox/formula/lookup/date/currency) is
+          // unambiguously a type change.
+          new RegExp(`\\b(chang\\w*|convert\\w*)\\b[^.?!]{0,60}\\bfrom\\b[^.?!]{0,40}\\bto\\b[^.?!]{0,40}\\b(picklist|text|number|checkbox|formula|lookup|date|currency|multi[-\\s]?select)\\b`),
+          new RegExp(`\\bfrom\\s+a\\s+picklist\\s+to\\s+a\\s+(?:text|number|formula|lookup|date|currency)\\b`)
         ]
       },
       {
@@ -27102,11 +27823,22 @@ var init_intent_router = __esm({
         tools: ["sfi.compare_vaults", "sfi.compare_object_across_vaults", "sfi.compare_profile_across_vaults"],
         liveRequired: false,
         needsResolve: false,
-        reason: "Differences between two registered orgs (UAT vs prod) from the vault registry.",
+        reason: "Differences between two registered orgs (UAT vs prod) from the vault registry. Requires BOTH orgs to be registered vaults \u2014 the compare_* tools diff two offline snapshots, never the live org.",
+        // DISCLOSURE, not a block (eval family D): on a single-vault install the
+        // compare tools fail with vault-not-found — say the second-registered-vault
+        // prerequisite up front instead of routing confident-clean into it.
+        gap: {
+          category: "cross-vault-registry",
+          note: "Cross-vault comparison needs a SECOND registered vault (a multi-vault registry). If only this vault is registered, the compare_* call will return vault-not-found \u2014 register the other org first (sfi vault register) or name the two vault aliases to compare."
+        },
         patterns: [
           /\b(uat|sandbox|staging)\b.*\b(vs|versus|compared?\s+to|and)\b.*\b(prod|production)\b/,
           /\bwhat('?s| is)\s+different\b.*\b(between|across)\b.*\borgs?\b/,
-          /\bcompare\b.*\borgs?\b/
+          /\bcompare\b.*\borgs?\b/,
+          // "compare the Account object across our sandboxes" — the cross-vault
+          // ask phrased with "across" + an environment noun (eval family D).
+          /\bcompare\b[^.?!]{0,60}\bacross\b[^.?!]{0,30}\b(orgs?|sandbox(es)?|environments?|vaults?|instances?)\b/,
+          /\b(differs?|difference|different)\b[^.?!]{0,50}\b(between|across)\b[^.?!]{0,40}\b(sandbox(es)?|environments?|instances?|vaults?)\b/
         ]
       },
       {
@@ -27229,7 +27961,115 @@ var init_intent_router = __esm({
           /\b(ci\/cd|source\s+control|deployment\s+(and\s+)?release)\b/,
           /\bsandboxes?\b.*\b(refresh|managed)\b/,
           /\benvironment\s+and\s+release\s+strategy\b/,
-          /\b(is\s+there\s+a\s+)?ci\/cd\b/
+          /\b(is\s+there\s+a\s+)?ci\/cd\b/,
+          // Concept ask about an access primitive — "What is a Profile" / "what is
+          // a permission set". The indefinite article marks a GENERIC type word,
+          // never a named component, so this must not fall through to unrouted (or
+          // worse, a Profile-record disambiguation menu). Comparisons ("difference
+          // between a profile and a permission set") stay on compare-profiles.
+          /\bwhat\s+is\s+an?\s+(?:profile|permission\s+set)\s*\??\s*$/
+        ]
+      },
+      // === FIELD-FORENSICS REACH block (USAGE / IMPACT / FIELD-FORENSICS cluster) =
+      // These sit BEFORE the generic component-usage dispatcher so a question that
+      // NAMES a specific field (NAMED_FIELD_ID — a dotted `Object.field` or a bare
+      // `__c` api name) and asks a field-forensics question lands on the dedicated
+      // field tool instead of the generic usage tool. Every pattern REQUIRES the
+      // named field, so a bare-English question (no dot, no `__c`) never fires here
+      // and keeps its existing route. The order within the block encodes the eval's
+      // distinction: "reads OR writes" → find_field_anywhere; "what writes … is it a
+      // flow" (writers only) → field_provenance; a lineage/trace frame →
+      // field_lineage; "field 360" → field_360; a semantic "do we have a field for
+      // X" → find_semantic_field. USAGE ("which flows write X", "is X triggered by
+      // Y", "connected to Marketo") stays on the component-usage dispatcher below.
+      {
+        // "do we already have a field for <concept>" / "where do we store <concept>
+        // data across the org" — semantic field discovery. High-precision on the
+        // store/have-a-field frame + a cross-org scope; must sit before the field-id
+        // rules because it is about a CONCEPT, not a specific named field (the named
+        // field it cites, e.g. "X is one, what ELSE", is an example, not the target).
+        intent: "find-semantic-field",
+        plane: "vault",
+        tools: ["sfi.find_semantic_field"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: 'Semantic field discovery \u2014 "do we already have a field for X" ranks CustomFields by token overlap with a natural-language concept (heuristic recommendation).',
+        patterns: [
+          /\bwhere\s+do\s+we\s+store\b[^.?!]{0,60}\b(across|anywhere|in\s+(?:the\s+)?org)\b/,
+          /\bdo\s+we\s+(?:already\s+)?have\s+a\s+field\s+for\b/,
+          /\b(is|are)\s+there\s+(?:already\s+)?an?\s+(?:existing\s+)?field\s+for\b/,
+          // "X is one, what else" — the caller names one example field and asks for
+          // the rest of the concept family (the semantic-discovery signature).
+          /\bis\s+one,?\s+what\s+else\b/
+        ]
+      },
+      {
+        // "trace where <field> goes after conversion / where does <field> data come
+        // from / where does <field> flow" — data lineage for a NAMED field. Sits
+        // before find_field_anywhere/provenance so an explicit trace/lineage frame
+        // wins over a bare reads/writes ask. The named-field id + a movement verb
+        // (trace/goes/lands/flows/come from) keep it precise; the pii-flow rule
+        // earlier already owns the "field data flow/lineage" phrasings without a
+        // named id, so this only adds the NAMED-field trace shape it missed.
+        intent: "field-lineage",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.field_lineage"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Trace where a NAMED field's value comes from and what it feeds \u2014 the provenance + downstream-effects walker, requested by an explicit trace/lineage frame on a named field.",
+        patterns: [
+          new RegExp(`\\btrace\\b[^.?!]{0,40}\\b${NAMED_FIELD_ID}\\b[^.?!]{0,60}\\b(goes?|lands?|flows?|end\\s+up|get\\s+dropped|come\\s+from|after\\s+conversion)\\b`),
+          new RegExp(`\\bwhere\\s+does\\b[^.?!]{0,30}\\b${NAMED_FIELD_ID}\\b[^.?!]{0,50}\\b(go|goes?|flow|flows?|come\\s+from|land)\\b`)
+        ]
+      },
+      {
+        // "give me the field 360 on <Field>" / "the full picture of <Field>" — the
+        // unified field-forensics synthesis tool, requested by its own vocabulary.
+        // The literal "field 360" / "360 on <field>" phrase is unambiguous.
+        intent: "field-360",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.field_360", "sfi.explain_field"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Full 360 profile of a single field \u2014 everything that validates / writes / reads / uses it across automation, code, UI, integrations, composed into one report.",
+        patterns: [
+          /\bfield\s*360\b/,
+          /\b360\b[^.?!]{0,20}\b(on|of|for)\b[^.?!]{0,20}(?:[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*|[a-z][a-z0-9_]*__c)\b/,
+          new RegExp(`\\b(fulls+(?:picture|profile)|everythings+thats+(?:touches|uses))\\b[^.?!]{0,30}\\b${NAMED_FIELD_ID}\\b`)
+        ]
+      },
+      {
+        // "What READS OR WRITES <Field> on <Object>" — the universal find-anywhere
+        // for a named field (both directions). The "reads or/and writes" (or the
+        // "used anywhere") frame distinguishes it from provenance (writers-only)
+        // below. Requires the named field id so bare English never fires.
+        intent: "find-field-anywhere-usage",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.find_field_anywhere"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Where a NAMED field is used anywhere \u2014 every incoming edge (apex reads/writes, flow ops, layout placements, VR refs), grouped by referrer type. Both read and write directions.",
+        patterns: [
+          new RegExp(`\\b(reads?\\s+(?:or|and)\\s+writes?|writes?\\s+(?:or|and)\\s+reads?)\\b[^.?!]{0,60}\\b${NAMED_FIELD_ID}\\b`),
+          new RegExp(`\\b${NAMED_FIELD_ID}\\b[^.?!]{0,40}\\bused\\s+anywhere\\b`)
+        ]
+      },
+      {
+        // "What WRITES <Field> on <Object> — is it a flow?" — the source-of-a-field
+        // ask (writers only): who/what SETS this field's value, and is it manual /
+        // automated / integration-synced. Distinguished from find-field-anywhere
+        // above by being writers-only (no "reads"), and from the "which flows write
+        // X" USAGE ask below by NOT scoping to a component type up front (the field
+        // is the subject: "what writes X"). Requires the named field id.
+        intent: "field-provenance",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.field_provenance"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Who/what SETS a field's value \u2014 the writers fabric (apex/flow/trigger writers, formula/auto-number declaration, integration-synced classifier) for a named field.",
+        patterns: [
+          new RegExp(`^(?!.*\\breads?\\b)(?!.*\\bwhich\\s+flows?\\b).*\\bwhat\\s+writes\\b[^.?!]{0,80}\\b${NAMED_FIELD_ID}\\b`),
+          new RegExp(`\\bwhat\\s+(?:sets|populates?|fills?)\\b[^.?!]{0,60}\\b${NAMED_FIELD_ID}\\b[^.?!]{0,40}\\bis\\s+it\\s+(?:a\\s+)?(?:flow|manual|automated|integration)`)
         ]
       },
       {
@@ -27260,7 +28100,33 @@ var init_intent_router = __esm({
           // usage lands here.
           /\bwhere\s+is\b(?![^?]*\bfield\b)(?![^?]*__c)[^?]*\b(used|referenced|consumed)\b/,
           /\b(what|who|which\s+components?)\b.*\b(uses?|references?|depends?\s+on|consumes?)\b/,
-          /\bwhat\s+still\s+references\b/
+          /\bwhat\s+still\s+references\b/,
+          // USAGE REACH (find_component_usages). "Which flows WRITE (to) <field>" —
+          // the writers of a field scoped to a component TYPE (flows). Distinct from
+          // field_provenance ("what writes X") by naming the referrer type first;
+          // find_component_usages is the right dispatcher for "which <type> touch X".
+          /\bwhich\s+(?:flows?|classes?|triggers?|automations?|processes?)\b[^.?!]{0,20}\b(writes?|write\s+to|updates?|reads?|references?|touch\w*|sets?)\b/,
+          // "which flow SHOULD (do X / update Y) and why isn't it running" — a
+          // which-component-does-this usage lookup phrased as a troubleshooting ask.
+          /\bwhich\s+(?:flow|class|automation|process)\b[^.?!]{0,30}\bshould\b/,
+          // "is <NamedFlow> triggered by <OtherFlow> or standalone" — whether one
+          // component invokes another (an incoming-edge usage question).
+          /\bis\s+(?:the\s+)?[a-z][a-z0-9_]*_[a-z0-9_]+\b[^.?!]{0,30}\btriggered\s+by\b/,
+          // "does updating <field> trigger any <X> automation" — whether writing a
+          // field fires downstream automation (the field's incoming/outgoing usage).
+          // `[^?!]` (not `[^.?!]`) so the gap can span the dotted `Object.field__c`
+          // name, whose `.` the standard class would otherwise stop at.
+          /\bdoes\s+updating\b[^?!]{0,50}\btrigger\b[^?!]{0,30}\bautomation\b/,
+          // "is <object> connected to <ExternalSystem>" — integration-usage of a
+          // component; find_component_usages composes graph edges + the integration
+          // map (the rule already carries integration_map as a secondary tool).
+          /\b(is|are)\b[^.?!]{0,40}\b(connected\s+to|integrated\s+with|synced?\s+(?:to|with)|feeding)\b[^.?!]{0,30}\b(marketo|pardot|hubspot|external|api)\b/,
+          // "is <NamedComponent> even/still needed anymore BASED ON USAGE" — a
+          // still-in-use check on a named component, answered by walking its usage
+          // edges. The "based on usage" / "still used anywhere" frame is the tell;
+          // it keeps this off the cleanup-catalog tools (which take no named id).
+          /\b(?:even|still)\s+(?:needed|used|referenced)\b[^?!]{0,20}\b(?:anymore\s+)?based\s+on\s+usage\b/,
+          /\bstill\s+(?:used|referenced)\s+anywhere\b/
         ]
       },
       {
@@ -27476,6 +28342,121 @@ var init_intent_router = __esm({
           /\bcompare\b.*\b(permission\s+sets?|profiles?)\b/
         ]
       },
+      {
+        // DISCOVERY/META REACH: "compare A and B" / "explain the difference between
+        // A and B" where A and B are TWO NAMED components (permission-set groups,
+        // flows, classes) — a two-component diff, which compare_components answers.
+        // Sits AFTER compare-profiles (that owns the "profiles"/"permission sets"
+        // wording) and AFTER explain-flow (whose narration patterns carry a
+        // compare-frame negative-lookahead, so a two-flow "difference between A and
+        // B" deliberately falls through to HERE rather than being narrated as one
+        // flow). Precision: every pattern requires TWO distinct named tokens joined
+        // by "and"/"vs"/"versus" (or the explicit plural "PSGs"/"perm groups"), so
+        // a single-component "explain X" never lands here.
+        intent: "compare-components",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.compare_components"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Comparing two named components is a vault diff \u2014 resolve both, then compare_components.",
+        patterns: [
+          // "compare the <NamedA> and <NamedB> PSGs" / "… perm groups" — an
+          // explicit two-thing compare of permission-set GROUPS (compare-profiles
+          // keys on "profiles"/"permission sets", not the "PSG"/"perm group" plural).
+          new RegExp(`\\bcompare\\b[^.?!]{0,80}\\b(?:psgs?|perm(?:ission)?\\s+set\\s+groups?|perm\\s+groups?)\\b`),
+          new RegExp(`\\b(?:psgs?|perm(?:ission)?\\s+set\\s+groups?|perm\\s+groups?)\\b[^.?!]{0,80}\\b(?:compare|difference|differ|versus|vs\\.?)\\b`),
+          // "compare/difference between <NamedA> and <NamedB>" — two API-name tokens
+          // (>=2 underscores each: unambiguously component ids, never prose) joined
+          // by "and"/"&". The two-id requirement is what distinguishes a real
+          // comparison from a single-component narration. The leading
+          // `(?!.*record\s+types?)` yields a "difference between A and B and C record
+          // TYPES" enumeration to record-type-enumeration below (list all types),
+          // which is the honest surface for several record types side by side.
+          new RegExp(`^(?!.*\\brecord\\s+types?\\b).*\\b(?:compare|difference|differ|versus|vs\\.?)\\b[^.?!]{0,40}\\b${NAMED_COMPONENT_ID}\\b[^.?!]{0,20}\\b(?:and|&|versus|vs\\.?)\\b[^.?!]{0,20}\\b${NAMED_COMPONENT_ID}\\b`)
+        ]
+      },
+      {
+        // DISCOVERY/META REACH: "does <NamedFlow> relate to the <concept> concept" /
+        // "is <A> the same as <B>" — an org-vocabulary disambiguation, which
+        // disambiguate_concepts answers (are these two tokens the same or distinct
+        // concepts here). Anchored on the literal "concept(s)" noun OR the "same
+        // as … thing/idea" frame so it never grabs a compare (two components) or a
+        // field-lineage ("where does X go") question.
+        intent: "disambiguate-concepts-nl",
+        plane: "vault",
+        tools: ["sfi.disambiguate_concepts"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Whether two org-specific concepts/terms mean the same thing is a vocabulary disambiguation (disambiguate_concepts).",
+        patterns: [
+          /\b(?:relate\s+to|related\s+to|same\s+as|different\s+from|distinct\s+from|the\s+same\s+thing)\b[^.?!]{0,50}\bconcepts?\b/,
+          /\bconcepts?\b[^.?!]{0,50}\b(?:relate\s+to|related\s+to|same\s+as|different\s+from|distinct\s+from)\b/,
+          /\bis\b[^.?!]{0,30}\bthe\s+same\s+(?:as|thing\s+as|concept\s+as)\b/
+        ]
+      },
+      {
+        // DISCOVERY/META REACH: "which queues does <Named>_Queue route to and who
+        // are the MEMBERS" — a NEUTRAL single-queue inspection (no failure frame),
+        // which get_component renders (the Queue node carries members + routing).
+        // resolve binds the named queue first. Distinct from empty-queues above,
+        // which only fires on a can't/stuck SYMPTOM. Anchored on a `_queue`
+        // API-name suffix (or the literal "queue" + "members") so it never grabs a
+        // schema-inventory ("list all queues") ask.
+        intent: "queue-membership",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "A single queue's members and routing targets are on its Queue node \u2014 resolve the queue, then get_component.",
+        patterns: [
+          /\bwho\s+are\s+the\s+members?\b[^.?!]{0,60}\bqueues?\b/,
+          /\bqueues?\b[^.?!]{0,60}\bwho\s+are\s+the\s+members?\b/,
+          /\bwhich\s+queues?\b[^.?!]{0,40}\broute\b/
+        ]
+      },
+      {
+        // DISCOVERY/META REACH: "what's the API version on the TDTM handlers / these
+        // HEDA classes" — the per-class apiVersion is a get_component field. The
+        // existing schema-rule api-version patterns cover the SINGULAR
+        // "api version of X class" (Family-D contract) but missed the PLURAL
+        // "handlers"/"classes" scan. Requires the api-version phrase with a PLURAL
+        // handlers/classes/triggers noun (mandatory `s`) so the singular
+        // "what is the api version of the AccountService class" stays on schema and
+        // a plain "what version are we on" (org release) never matches.
+        intent: "component-api-version",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "The api version across a set of Apex classes / triggers / handlers is a per-component property scan \u2014 list_components then get_component per member.",
+        patterns: [
+          /\bapi\s+version\b[^.?!]{0,60}\b(?:classes|handlers|triggers)\b/,
+          /\b(?:classes|handlers|triggers)\b[^.?!]{0,60}\bapi\s+version\b/
+        ]
+      },
+      {
+        // DISCOVERY/META REACH: "explain the difference between <RT_A> and <RT_B>
+        // and <RT_C> record types" — an enumeration of MULTIPLE record types on an
+        // object; list_components(type: 'RecordType') is the honest surface (the
+        // user wants each type side by side, not a pairwise diff). Requires the
+        // literal "record types" plural AND at least the "difference"/"vs" framing
+        // over 3+ named types joined by "and" — so a two-thing "compare A and B"
+        // (handled by compare-components) and a single "what is the X record type"
+        // do not land here.
+        intent: "record-type-enumeration",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Distinguishing several record types on an object is a vault enumeration \u2014 list_components(RecordType) plus get_component per type.",
+        suggestArgs: () => ({ type: "RecordType" }),
+        patterns: [
+          // "difference between A and B and C record types" — 3+ names joined by
+          // "and", trailing "record types". The two "and"-joins are the tell that
+          // this is a multi-type enumeration, not a pairwise compare.
+          /\b(?:difference|differ|distinguish|compare)\b[^.?!]{0,120}\band\b[^.?!]{0,60}\band\b[^.?!]{0,60}\brecord\s+types?\b/
+        ]
+      },
       {
         intent: "capabilities",
         plane: "vault",
@@ -27487,7 +28468,21 @@ var init_intent_router = __esm({
           /\bwhat\s+can\s+you\s+do\b/,
           /\bwhat\s+are\s+you\s+capable\b/,
           /\bwhat\s+tools?\s+(do\s+you\s+have|are\s+available)\b/,
-          /\bhelp\b.*\b(capabilit|tools?|commands?)\b/
+          /\bhelp\b.*\b(capabilit|tools?|commands?)\b/,
+          // DISCOVERY/META REACH: "what are you actually able to answer about this
+          // org", "what can I ask" — a self-capability ask. `able to answer` /
+          // `can .. ask` co-anchored so it never grabs an org-content question
+          // ("what can this profile do"): the subject is the tool ("you"/"I"/"this"),
+          // not an org component.
+          /\bwhat\b[^.?!]{0,30}\b(?:you|i)\b[^.?!]{0,20}\b(?:able\s+to\s+answer|answer\s+about|ask\s+about|ask\s+you)\b/,
+          /\bwhat\s+can\s+i\s+ask\b/,
+          // "can you (even) tell me anything about … record data … or is this just
+          // metadata" — a boundary/capability probe. `just metadata` / `only
+          // metadata` is the capability-boundary tell (capabilities reports the
+          // metadata-vs-live-record boundary); it never appears in a real
+          // org-content question.
+          /\b(?:just|only)\s+metadata\b/,
+          /\bcan\s+you\s+(?:even\s+)?tell\s+me\s+anything\s+about\b[^.?!]{0,40}\b(?:record\s+data|data\s+in\s+here)\b/
         ]
       },
       {
@@ -35219,7 +36214,7 @@ var init_effective_permissions = __esm({
     };
     BASE_DISCLOSURES = Object.freeze([
       "Permission-set GROUP membership IS expanded: a PermissionSetGroup passed in `permissionSetIds` is unioned into its member permission sets (declared metadata). Muting permission sets are DISCLOSED but NOT subtracted \u2014 a group with a muting set may confer LESS than shown.",
-      "App and tab visibility are a separate surface (now extracted \u2014 see `app_access` / `tab_availability`); they are not part of this permission union, which composes object / field / Apex / system permissions.",
+      "App and tab visibility are a separate surface (now extracted \u2014 see `app_access` / `tab_availability`); they are not part of this permission union, which composes object / field / Apex / system / custom permissions AND record-type visibilities (for the per-object grouped record-type view use `recordtype_availability`).",
       "Field-level access is summarised here (count of fields with FLS); use `field_access_audit` for a specific field. Object permission is NOT record access \u2014 record visibility still depends on OWD + sharing (`why_cant_user_see_record`)."
     ]);
     effectivePermissionsHandler = async (ctx, input2) => {
@@ -35260,6 +36255,8 @@ var init_effective_permissions = __esm({
       const apexClasses = /* @__PURE__ */ new Set();
       const systemPermMap = /* @__PURE__ */ new Map();
       const customPermMap = /* @__PURE__ */ new Map();
+      const rtVisMap = /* @__PURE__ */ new Map();
+      const containersWithoutRtData = [];
       const presentContainers = [];
       const missingContainers = [];
       for (const containerId of containers) {
@@ -35282,6 +36279,24 @@ var init_effective_permissions = __esm({
             systemPermMap.set(p2, set);
           }
         }
+        const rtRaw = nodeResult.value.properties["recordTypeVisibilities"];
+        if (Array.isArray(rtRaw)) {
+          for (const entry of rtRaw) {
+            if (entry === null || typeof entry !== "object")
+              continue;
+            const rt2 = entry.recordType;
+            if (typeof rt2 !== "string")
+              continue;
+            const accum = rtVisMap.get(rt2) ?? { visible: false, grantedBy: /* @__PURE__ */ new Set() };
+            if (entry.visible !== false) {
+              accum.visible = true;
+              accum.grantedBy.add(containerId);
+            }
+            rtVisMap.set(rt2, accum);
+          }
+        } else {
+          containersWithoutRtData.push(containerId);
+        }
         const edgesResult = await listEdges(ctx.graph, containerId, {
           direction: "out",
           edgeType: "grantedBy"
@@ -35352,6 +36367,11 @@ var init_effective_permissions = __esm({
         });
       }
       const missingCustomPerms = customPermissions.filter((c2) => c2.targetMissing).length;
+      const recordTypeVisibilities = [...rtVisMap.entries()].map(([recordType, a2]) => ({
+        recordType,
+        visible: a2.visible,
+        grantedBy: [...a2.grantedBy].sort()
+      })).sort((x2, y2) => x2.recordType < y2.recordType ? -1 : x2.recordType > y2.recordType ? 1 : 0);
       const totalObjects = objectPermissions.length;
       const limit = input2.limit ?? DEFAULT_LIMIT5;
       const TOOL = "sfi.effective_permissions";
@@ -35405,18 +36425,23 @@ var init_effective_permissions = __esm({
       if (missingCustomPerms > 0) {
         disclosures.push(`${missingCustomPerms} granted custom permission(s) name a definition not present in this vault (targetMissing) \u2014 likely managed-package or not retrieved; the grant is declared but the definition is not resolvable here. Custom permissions are NOT system userPermissions, so they are not double-counted under systemPermissions.`);
       }
+      if (containersWithoutRtData.length > 0) {
+        disclosures.push(`${containersWithoutRtData.length} container(s) carry no extracted \`recordTypeVisibilities\` property (${[...containersWithoutRtData].sort().join(", ")}) \u2014 the vault was refreshed before record-type extraction, so their record-type visibility is NOT in this union; re-run \`/sfi-refresh\`. The missing contribution is "not modeled", never a verified "no record types".`);
+      }
       return ok({
         data: {
           containers: presentContainers,
           objectPermissions: objectPage,
           systemPermissions: systemPage,
           customPermissions,
+          recordTypeVisibilities,
           summary: {
             objects: totalObjects,
             fieldsWithFls: fieldsWithFls.size,
             apexClasses: apexClasses.size,
             systemPermissions: systemPermissions.length,
-            customPermissions: customPermissions.length
+            customPermissions: customPermissions.length,
+            recordTypeVisibilities: recordTypeVisibilities.length
           },
           limit,
           offset,
@@ -40698,8 +41723,9 @@ var init_field_lineage = __esm({
 });
 
 // ../mcp/dist/src/tools/field-mapping-between-objects.js
+import { basename as basename12 } from "node:path";
 import { z as z51 } from "zod";
-var fieldMappingBetweenObjectsInputSchema, parsePropertiesJson5, loadFields2, tokenize4, jaccard, fieldTokens, TEXT_TYPES, NUMBER_TYPES, DATE_TYPES, PICKLIST_TYPES2, REFERENCE_TYPES, typeCompatible, openVault, HEURISTIC_MAPPING_DISCLOSURE, vaultNotFoundResponse2, fieldMappingBetweenObjectsHandler;
+var fieldMappingBetweenObjectsInputSchema, parsePropertiesJson5, loadFields2, tokenize4, jaccard, fieldTokens, TEXT_TYPES, NUMBER_TYPES, DATE_TYPES, PICKLIST_TYPES2, REFERENCE_TYPES, typeCompatible, openVault, HEURISTIC_MAPPING_DISCLOSURE, servedVaultRef, isSelfReferentialAlias, SINGLE_VAULT_NOTE, OMIT_VAULT_HINT, vaultNotFoundResponse2, fieldMappingBetweenObjectsHandler;
 var init_field_mapping_between_objects = __esm({
   "../mcp/dist/src/tools/field-mapping-between-objects.js"() {
     "use strict";
@@ -40707,7 +41733,12 @@ var init_field_mapping_between_objects = __esm({
     init_src2();
     init_src3();
     fieldMappingBetweenObjectsInputSchema = z51.object({
-      vault: z51.string().min(1),
+      /**
+       * Optional registered-vault alias. When omitted the tool answers from
+       * the SERVED vault (the one this MCP session was launched against) —
+       * the normal single-vault deployment needs no registry at all.
+       */
+      vault: z51.string().min(1).optional(),
       objectA: z51.string().min(1),
       objectB: z51.string().min(1),
       similarityThreshold: z51.number().min(0).max(1).optional(),
@@ -40815,8 +41846,22 @@ var init_field_mapping_between_objects = __esm({
       return ok({ store, dispose: async () => closeGraph(store) });
     };
     HEURISTIC_MAPPING_DISCLOSURE = "field-mapping suggestions are heuristic \u2014 labels are matched by token overlap and types by compatibility table. Verify each suggested pair against your business rules before relying on the mapping for a migration script.";
-    vaultNotFoundResponse2 = (vault, objectA, objectB, ctx) => {
-      const message = `vault alias '${vault}' is not registered. Run \`sfi register-vault ${vault} <path>\` first, or \`sfi list-vaults\` to see what's registered.`;
+    servedVaultRef = (ctx) => ({
+      alias: basename12(ctx.vaultRoot),
+      path: ctx.vaultRoot,
+      registeredAt: "",
+      lastRefreshedAt: ctx.manifest.refreshedAt,
+      sourceTreeHash: ctx.manifest.sourceTreeHash,
+      componentCount: null
+    });
+    isSelfReferentialAlias = (alias, vaultRoot) => {
+      const a2 = alias.toLowerCase();
+      return a2 === vaultRoot.toLowerCase() || a2 === basename12(vaultRoot).toLowerCase();
+    };
+    SINGLE_VAULT_NOTE = "No multi-vault registry found (set SF_INTELLIGENCE_REGISTRY_PATH to enable). This looks like a single-vault install \u2014 answered from the served vault.";
+    OMIT_VAULT_HINT = "Omit `vault` to map fields within the served vault.";
+    vaultNotFoundResponse2 = (vault, objectA, objectB, ctx, extraBoundaries = []) => {
+      const message = `vault alias '${vault}' is not registered. Run \`sfi register-vault ${vault} <path>\` first, or \`sfi list-vaults\` to see what's registered. ${OMIT_VAULT_HINT}`;
       return ok({
         data: {
           vault: {
@@ -40832,7 +41877,7 @@ var init_field_mapping_between_objects = __esm({
           suggestedPairs: [],
           unpairedFromA: [],
           unpairedFromB: [],
-          boundaries: [HEURISTIC_MAPPING_DISCLOSURE, message]
+          boundaries: [HEURISTIC_MAPPING_DISCLOSURE, message, ...extraBoundaries]
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -40844,22 +41889,40 @@ var init_field_mapping_between_objects = __esm({
       const registryRoot = findRegistryRoot(ctx.vaultRoot);
       const threshold = input2.similarityThreshold ?? 0.5;
       const includeTypeIncompatible = input2.includeTypeIncompatible === true;
-      const registry = await loadRegistry(registryRoot);
-      if (!registry.ok && registry.error.kind === "registry-missing") {
-        return vaultNotFoundResponse2(input2.vault, input2.objectA, input2.objectB, ctx);
-      }
-      const pathResult = await resolveVault(registryRoot, input2.vault);
-      if (!pathResult.ok) {
-        return vaultNotFoundResponse2(input2.vault, input2.objectA, input2.objectB, ctx);
-      }
-      const vaultRefResult = await getVaultRef(registryRoot, input2.vault);
-      if (!vaultRefResult.ok) {
-        return err({
-          kind: "internal",
-          message: "failed to load vault metadata after alias resolution"
-        });
+      let vaultPath;
+      let vaultRef;
+      const extraBoundaries = [];
+      if (input2.vault === void 0) {
+        vaultPath = ctx.vaultRoot;
+        vaultRef = servedVaultRef(ctx);
+      } else {
+        const registry = await loadRegistry(registryRoot);
+        if (!registry.ok && registry.error.kind === "registry-missing") {
+          if (!isSelfReferentialAlias(input2.vault, ctx.vaultRoot)) {
+            return vaultNotFoundResponse2(input2.vault, input2.objectA, input2.objectB, ctx, [
+              "No multi-vault registry found (set SF_INTELLIGENCE_REGISTRY_PATH to enable). This looks like a single-vault install \u2014 omit `vault` to map fields within the served vault."
+            ]);
+          }
+          vaultPath = ctx.vaultRoot;
+          vaultRef = { ...servedVaultRef(ctx), alias: input2.vault };
+          extraBoundaries.push(SINGLE_VAULT_NOTE);
+        } else {
+          const pathResult = await resolveVault(registryRoot, input2.vault);
+          if (!pathResult.ok) {
+            return vaultNotFoundResponse2(input2.vault, input2.objectA, input2.objectB, ctx);
+          }
+          const vaultRefResult = await getVaultRef(registryRoot, input2.vault);
+          if (!vaultRefResult.ok) {
+            return err({
+              kind: "internal",
+              message: "failed to load vault metadata after alias resolution"
+            });
+          }
+          vaultPath = pathResult.value;
+          vaultRef = vaultRefResult.value;
+        }
       }
-      const opened = await openVault(ctx, pathResult.value);
+      const opened = await openVault(ctx, vaultPath);
       if (!opened.ok)
         return opened;
       try {
@@ -40901,13 +41964,13 @@ var init_field_mapping_between_objects = __esm({
         const unpairedFromB = fieldsB.filter((f2) => !claimedB.has(f2.fieldApiName)).map((f2) => f2.fieldApiName).sort();
         return ok({
           data: {
-            vault: vaultRefResult.value,
+            vault: vaultRef,
             objectA: { apiName: input2.objectA, fieldCount: fieldsA.length },
             objectB: { apiName: input2.objectB, fieldCount: fieldsB.length },
             suggestedPairs,
             unpairedFromA,
             unpairedFromB,
-            boundaries: [HEURISTIC_MAPPING_DISCLOSURE]
+            boundaries: [HEURISTIC_MAPPING_DISCLOSURE, ...extraBoundaries]
           },
           vaultState: {
             sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -42275,7 +43338,9 @@ var init_find_component_usages = __esm({
       if (!edgesRes.ok) {
         return err({ kind: "internal", message: `graph query failed: ${edgesRes.error.message}` });
       }
-      const usageEdges = edgesRes.value.filter((e2) => !NON_USAGE_EDGE_TYPES.has(e2.edgeType));
+      const incomingEdges = edgesRes.value;
+      const usageEdges = incomingEdges.filter((e2) => !NON_USAGE_EDGE_TYPES.has(e2.edgeType));
+      const grantEdges = incomingEdges.filter((e2) => e2.edgeType === "grantedBy");
       const byType = /* @__PURE__ */ new Map();
       for (const e2 of usageEdges) {
         const rt2 = typeOf(e2.fromId);
@@ -42322,7 +43387,16 @@ var init_find_component_usages = __esm({
         }
       }
       const hasStaticEvidence = graphReferrerCount > 0 || grepMatches.length > 0;
-      if (!retrieved && graphReferrerCount === 0 && !hasStaticEvidence) {
+      const surfaceGrants = targetType === "CustomPermission" || usageEdges.length === 0 && grantEdges.length > 0;
+      let grantedBySection;
+      if (surfaceGrants) {
+        const granterIds = [...new Set(grantEdges.map((e2) => e2.fromId))].sort();
+        grantedBySection = {
+          count: granterIds.length,
+          granters: granterIds.slice(0, GRAPH_REFERRER_SAMPLE).map((id) => ({ id, type: typeOf(id) }))
+        };
+      }
+      if (!retrieved && graphReferrerCount === 0 && !hasStaticEvidence && grantEdges.length === 0) {
         return err({
           kind: "component-not-found",
           message: `no component or referrer matches \`${componentId}\` in this vault`,
@@ -42345,6 +43419,9 @@ var init_find_component_usages = __esm({
       if (GREP_RELIANT_PREFIXES.has(targetType)) {
         boundaries.push(`${targetType} usage has a weaker graph tier \u2014 FRONTEND references ($Label / $Resource / $Setup and @salesforce imports in LWC/Aura/Visualforce) are modeled as graph edges on vaults refreshed at 0.1.10+, but Apex references (System.Label.X, dynamic config reads) are still grep-only, so the grep supplement carries part of the answer here. Confirm by reading the matched source.`);
       }
+      if (grantedBySection !== void 0) {
+        boundaries.push(`Access grants are listed SEPARATELY in \`grantedBy\` (${grantedBySection.count} granting container(s)) \u2014 a grant is ACCESS, not usage, so granters never appear in graphReferrers. For a CustomPermission this answers "which Profiles / PermissionSets grant it?"; checking a custom permission in code (FeatureManagement / $Permission) is usage and stays in the usage tiers.`);
+      }
       if (!retrieved) {
         boundaries.push("This component is a PHANTOM \u2014 referenced by the edges below but NOT retrieved into the vault, so its own definition is unavailable; the referrer list is still valid.");
       }
@@ -42352,6 +43429,7 @@ var init_find_component_usages = __esm({
         data: {
           target: { componentId, type: targetType, apiName: targetApiName, retrieved },
           graphReferrers,
+          ...grantedBySection !== void 0 ? { grantedBy: grantedBySection } : {},
           grepSupplement: {
             tier: "text-match",
             ran: grepRan,
@@ -43306,7 +44384,7 @@ var init_find_formula_references = __esm({
 
 // ../mcp/dist/src/tools/find-hardcoded-values-anywhere.js
 import { readFile as readFile74 } from "node:fs/promises";
-import { basename as basename12 } from "node:path";
+import { basename as basename13 } from "node:path";
 import { z as z63 } from "zod";
 var MAX_LIMIT9, DEFAULT_LIMIT9, FIND_HARDCODED_ANYWHERE_TOOL, SALESFORCE_ID_REGEX, EMAIL_REGEX, DATE_REGEX, NUMERIC_REGEX, HARDCODED_APEX_RULES, APEX_SOURCE_SUFFIXES, scanApexSourceForEmails, NUMERIC_FP_DISCLOSURE, ID_FP_DISCLOSURE, TEST_CLASS_REFUSAL_DISCLOSURE, APEX_SOURCE_EMAIL_SCAN_DISCLOSURE, findHardcodedValuesAnywhereInputBaseSchema, findHardcodedValuesAnywhereInputSchema, RULE_TO_CATEGORY, coerceIssue4, regexForCategory, snippetAround, scanText, isTestClass, compareMatches, matchKey, findHardcodedValuesAnywhereHandler;
 var init_find_hardcoded_values_anywhere = __esm({
@@ -43349,7 +44427,7 @@ var init_find_hardcoded_values_anywhere = __esm({
         } catch {
           continue;
         }
-        const name = basename12(file.absolutePath);
+        const name = basename13(file.absolutePath);
         const apiName = name.endsWith(".trigger") ? name.slice(0, -".trigger".length) : name.slice(0, -".cls".length);
         const componentType = name.endsWith(".trigger") ? "ApexTrigger" : "ApexClass";
         const componentId = `${componentType}:${apiName}`;
@@ -50063,7 +51141,7 @@ var init_lightning_pages = __esm({
 
 // ../mcp/dist/src/tools/list-components.js
 import { z as z90 } from "zod";
-var LIST_COMPONENTS_TOOL, STANDARD_OBJECT_API_NAMES2, objectApiNameFromParentId, isStandardObjectApiName, COMPONENT_TYPES2, LIST_MAX_LIMIT2, LIST_DEFAULT_LIMIT2, LIST_PAYLOAD_BUDGET_BYTES, fitNodesToBudget, APEX_BOOLEAN_FILTERS, coercedOptionalBoolean, listComponentsInputSchema, listComponentsHandler;
+var LIST_COMPONENTS_TOOL, STANDARD_OBJECT_API_NAMES2, objectApiNameFromParentId, isStandardObjectApiName, COMPONENT_TYPES2, LIST_MAX_LIMIT2, LIST_DEFAULT_LIMIT2, LIST_PAYLOAD_BUDGET_BYTES, ITEM_SLIM_THRESHOLD_BYTES, SLIM_STRING_MAX_CHARS, slimOversizedNode, fitNodesToBudget, APEX_BOOLEAN_FILTERS, coercedOptionalBoolean, listComponentsInputSchema, listComponentsHandler;
 var init_list_components = __esm({
   "../mcp/dist/src/tools/list-components.js"() {
     "use strict";
@@ -50172,6 +51250,21 @@ var init_list_components = __esm({
     LIST_MAX_LIMIT2 = 500;
     LIST_DEFAULT_LIMIT2 = 50;
     LIST_PAYLOAD_BUDGET_BYTES = 38e3;
+    ITEM_SLIM_THRESHOLD_BYTES = 2048;
+    SLIM_STRING_MAX_CHARS = 256;
+    slimOversizedNode = (node) => {
+      if (Buffer.byteLength(JSON.stringify(node), "utf8") <= ITEM_SLIM_THRESHOLD_BYTES) {
+        return node;
+      }
+      const compact = {};
+      for (const [key, value] of Object.entries(node.properties ?? {})) {
+        if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string" && value.length <= SLIM_STRING_MAX_CHARS) {
+          compact[key] = value;
+        }
+      }
+      compact["propertiesTruncated"] = true;
+      return { ...node, properties: compact };
+    };
     fitNodesToBudget = (nodes, budgetBytes) => {
       const kept = [];
       let used = 0;
@@ -50299,7 +51392,9 @@ var init_list_components = __esm({
           }
         }
       }
-      const { kept, trimmed } = fitNodesToBudget(pageNodes, LIST_PAYLOAD_BUDGET_BYTES);
+      const slimmedPageNodes = pageNodes.map(slimOversizedNode);
+      const { kept, trimmed } = fitNodesToBudget(slimmedPageNodes, LIST_PAYLOAD_BUDGET_BYTES);
+      const propertiesSlimmed = kept.some((n2) => n2.properties?.["propertiesTruncated"] === true);
       const hasMore = pageNodes.length === limit || trimmed;
       let retrievalHint;
       if (offset === 0 && pageNodes.length === 0 && !hasPropertyFilter && !hasStringPropertyFilter && !recordTriggered) {
@@ -50364,6 +51459,7 @@ var init_list_components = __esm({
           ...docFallbackNote !== void 0 ? { docFallbackNote } : {},
           ...coverageCaveat !== void 0 ? { coverageCaveat } : {},
           ...formulaFieldCount !== void 0 ? { formulaFieldCount } : {},
+          ...propertiesSlimmed ? { propertiesSlimmed: true } : {},
           ...trimmed ? {
             truncated: true,
             note: `Response trimmed to ${kept.length} of ${pageNodes.length} fetched rows to stay under the ~45 KB MCP response limit. Use totalCount (${totalCount}) for the authoritative vault count; advance with offset += ${kept.length} (or narrow via parentId) for the rest.`
@@ -54410,7 +55506,7 @@ import { createHash as createHash7 } from "node:crypto";
 import { readFile as readFile82 } from "node:fs/promises";
 import { join as join23, resolve as resolve3 } from "node:path";
 import { z as z115 } from "zod";
-var RESOLVE_FALLBACK_MAX_TOKENS, tryResolveFallback, routeQuestionInputSchema, routeTrust, clarificationIdFor, selectedEntityArgsForRoute, extractEntityQuery, inferEntityTypes, refineEntityResolution, applyGlossaryAliases, entityAmbiguityRequiresClarification, splitCompoundQuestion, mixedInventoryAndStoragePlan, PLAN_FAMILY, ASSESSMENT_FAMILY, ROUTE_PREAMBLE_TOOLS, REGEX_BONUS, resolveActiveVaultAlias, buildRouteToolArgsMap, mergeRouteHintsIntoCandidates, invokeFromArgsMap, rerankForMode, MARGIN, DESTRUCTIVE_TOOL, INFORMATIONAL_IMPACT_TOOL, planesDiverge, risksDiverge, marginClarification, LIVE_DISCLOSURE_LOOKAHEAD, liveConsentDisclosure, guidanceForMode, buildFunnelCandidates, routerMode, routeQuestionHandler;
+var RESOLVE_FALLBACK_MAX_TOKENS, SAVE_ORDER_INTENTS, SINGLE_ENTITY_INTENTS, COMPARISON_ASIDE, stripComparisonAside, tryResolveFallback, routeQuestionInputSchema, routeTrust, clarificationIdFor, selectedEntityArgsForRoute, extractEntityQuery, inferEntityTypes, refineEntityResolution, applyGlossaryAliases, entityAmbiguityRequiresClarification, splitCompoundQuestion, mixedInventoryAndStoragePlan, PLAN_FAMILY, ASSESSMENT_FAMILY, ROUTE_PREAMBLE_TOOLS, TOOL_COMPATIBLE_TYPES, ACCESS_FLAVORED_TOOLS, resolvedTypeForGuard, applyComponentTypeGuard, REGEX_BONUS, resolveActiveVaultAlias, buildRouteToolArgsMap, mergeRouteHintsIntoCandidates, invokeFromArgsMap, rerankForMode, MARGIN, DESTRUCTIVE_TOOL, INFORMATIONAL_IMPACT_TOOL, planesDiverge, risksDiverge, marginClarification, LIVE_DISCLOSURE_LOOKAHEAD, liveConsentDisclosure, guidanceForMode, buildFunnelCandidates, routerMode, routeQuestionHandler;
 var init_route_question = __esm({
   "../mcp/dist/src/tools/route-question.js"() {
     "use strict";
@@ -54423,6 +55519,24 @@ var init_route_question = __esm({
     init_resolve2();
     init_tool_profile();
     RESOLVE_FALLBACK_MAX_TOKENS = 3;
+    SAVE_ORDER_INTENTS = /* @__PURE__ */ new Set([
+      "trigger-order",
+      "save-behavior",
+      "automation-on-object",
+      "dlrs-recursion"
+    ]);
+    SINGLE_ENTITY_INTENTS = /* @__PURE__ */ new Set([
+      "explain-flow",
+      "explain-apex",
+      "get-component"
+    ]);
+    COMPARISON_ASIDE = new RegExp("\\s*(?:,|\u2014|-|;)?\\s*\\b(?:is\\s+(?:it|this|that)\\s+the\\s+same\\s+as|is\\s+(?:it|this|that)\\s+different\\s+(?:from|to)|(?:the\\s+)?same\\s+as|compared\\s+to|or\\s+is\\s+(?:it|this|that)|vs\\.?|versus)\\b.*$", "i");
+    stripComparisonAside = (question, intent) => {
+      if (!SINGLE_ENTITY_INTENTS.has(intent))
+        return question;
+      const stripped = question.replace(COMPARISON_ASIDE, "").trim();
+      return stripped.length > 0 ? stripped : question;
+    };
     tryResolveFallback = async (ctx, question) => {
       const tokens = question.trim().split(/\s+/).filter((t2) => t2.length > 0);
       if (tokens.length === 0 || tokens.length > RESOLVE_FALLBACK_MAX_TOKENS) {
@@ -54536,23 +55650,29 @@ var init_route_question = __esm({
         if (intent === "what-if-method-signature" && apiReference.includes(".")) {
           return `${apiReference.slice(0, apiReference.indexOf("."))} class`;
         }
+        if (!apiReference.includes(".")) {
+          const qualifier = question.match(new RegExp(`\\b${apiReference}\\b\\s+(?:field\\s+)?on\\s+(?:the\\s+)?([A-Za-z][A-Za-z0-9_]*)\\b`, "i"))?.[1];
+          if (qualifier !== void 0)
+            return `${qualifier}.${apiReference}`;
+        }
         return apiReference;
       }
       const prefixedTypePhrase = question.match(/\b((?:validation\s+rule|permission\s+set|record\s+type|page\s+layout|object|field|flow|class|trigger|layout|profile|report|dashboard)\s+(?:named\s+)?[A-Z][A-Za-z0-9_]*(?:\s+[A-Z][A-Za-z0-9_]*){0,5})\b/)?.[1];
       if (prefixedTypePhrase !== void 0)
         return prefixedTypePhrase.trim();
-      const typedMatch = question.match(/\b(?:the\s+)?([A-Za-z][A-Za-z0-9_]*(?:[\s_-]+[A-Za-z][A-Za-z0-9_]*){0,5}\s+(?:object|field|flow|class|trigger|layout|profile|permission\s+set|record\s+type|validation\s+rule|report|dashboard))(?:\s+(?:on|for|of)\s+(?:the\s+)?([A-Za-z][A-Za-z0-9_]*)(?:\s+object)?)?\b/i);
+      const typedMatch = question.match(/\b(?:the\s+)?([A-Za-z][A-Za-z0-9_]*(?:[\s_-]+[A-Za-z][A-Za-z0-9_]*){0,5}\s+(?:object|field|flow|class|trigger|layout|profile|permission\s+set|record\s+type|validation\s+rule|report|dashboard|logic))(?:\s+(?:on|for|of)\s+(?:the\s+)?([A-Za-z][A-Za-z0-9_]*)(?:\s+object)?)?\b/i);
       const typedPhrase = typedMatch?.[1];
       if (typedPhrase === void 0)
         return null;
-      const cleaned = typedPhrase.replace(/^(?:(?:what|which|who|where|when|why|how|is|are|can|does|do|did|show|find|explain|locate|list|references?|owns?|edit|read|view|access|change|delete|remove|possible|values?|api|version|data|type|for|of|the|this|that|in|on|to|used|assigned|set)\s+)+/i, "").trim();
-      if (/\b(?:and|when|should|use|there|any|that|no|available|tools?|required\s+fields?|record\s+types?)\b/i.test(cleaned))
+      const cleaned = typedPhrase.replace(/^(?:(?:what|whatever|which|who|where|when|why|how|is|are|can|does|do|did|show|find|explain|locate|list|calls?|invokes?|references?|owns?|edit|read|view|access|change|delete|remove|possible|values?|apex|api|version|data|type|for|of|the|this|that|in|on|to|used|assigned|set|every|all|each|any|me|a|an)\s+)+/i, "").trim();
+      if (/\b(?:and|when|should|use|there|any|that|no|available|tools?|difference|between|required\s+fields?|record\s+types?)\b/i.test(cleaned))
         return null;
-      const distinctive = cleaned.replace(/\b(?:object|field|flow|class|trigger|page|layout|profile|permission|set|record|type|validation|rule|report|dashboard|data)\b/gi, "").replace(/[^A-Za-z0-9_]+/g, "");
+      const distinctive = cleaned.replace(/\b(?:object|field|flow|class|trigger|page|layout|profile|permission|set|record|type|validation|rule|report|dashboard|data|logic)\b/gi, "").replace(/[^A-Za-z0-9_]+/g, "");
       if (distinctive.length === 0)
         return null;
+      const phrase = cleaned.replace(/\s+logic$/i, "");
       const parent = typedMatch?.[2];
-      return parent === void 0 ? cleaned : `${cleaned} on ${parent}`;
+      return parent === void 0 ? phrase : `${phrase} on ${parent}`;
     };
     inferEntityTypes = (query, intent, question) => {
       if (intent === "what-if-method-signature")
@@ -54692,6 +55812,54 @@ var init_route_question = __esm({
     PLAN_FAMILY = /^sfi\.(what_if_|get_impact|safe_to_delete|downstream_effects|tests_for_change|field_lineage)/;
     ASSESSMENT_FAMILY = /(_risk_report$|^sfi\.release_readiness|^sfi\.promotion_readiness|^sfi\.coverage_report|^sfi\.tech_debt_score|^sfi\.governor_limit_risks|^sfi\.crud_fls_audit)/;
     ROUTE_PREAMBLE_TOOLS = /* @__PURE__ */ new Set(["sfi.resolve", "sfi.capabilities"]);
+    TOOL_COMPATIBLE_TYPES = /* @__PURE__ */ new Map([
+      ["sfi.call_graph", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.method_reachability", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.explain_apex_method", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.who_can_access_object", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.object_access_audit", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.field_access_audit", /* @__PURE__ */ new Set(["CustomField"])]
+    ]);
+    ACCESS_FLAVORED_TOOLS = /* @__PURE__ */ new Set([
+      "sfi.who_can_access_object",
+      "sfi.object_access_audit",
+      "sfi.field_access_audit"
+    ]);
+    resolvedTypeForGuard = (route, resolution) => {
+      if (resolution === null || resolution.candidates.length === 0)
+        return null;
+      const top = resolution.candidates[0];
+      if (resolution.disposition === "exact")
+        return top.type;
+      if (resolution.disposition !== "ambiguous")
+        return null;
+      const guardedCompatibleTypes = new Set(route.tools.flatMap((tool) => [...TOOL_COMPATIBLE_TYPES.get(tool) ?? []]));
+      if (guardedCompatibleTypes.size === 0)
+        return null;
+      return resolution.candidates.some((candidate) => guardedCompatibleTypes.has(candidate.type)) ? null : top.type;
+    };
+    applyComponentTypeGuard = (route, resolvedType) => {
+      if (resolvedType !== "Flow")
+        return route;
+      const incompatible = new Set(route.tools.filter((tool) => {
+        const compatible = TOOL_COMPATIBLE_TYPES.get(tool);
+        return compatible !== void 0 && !compatible.has(resolvedType);
+      }));
+      if (incompatible.size === 0)
+        return route;
+      const substitutes = [...incompatible].some((tool) => ACCESS_FLAVORED_TOOLS.has(tool)) ? ["sfi.who_can_run", "sfi.explain_flow", "sfi.get_impact"] : ["sfi.explain_flow", "sfi.get_impact"];
+      const substituteSet = new Set(substitutes);
+      const preamble = route.tools.filter((tool) => ROUTE_PREAMBLE_TOOLS.has(tool));
+      const kept = route.tools.filter((tool) => !ROUTE_PREAMBLE_TOOLS.has(tool) && !incompatible.has(tool) && !substituteSet.has(tool));
+      const originalTools = route.tools;
+      const tools = [...preamble, ...substitutes, ...kept];
+      return {
+        ...route,
+        tools,
+        reason: `${route.reason} The named entity resolved to a Flow, so tools that require an Apex class, object, or field id were replaced with the Flow-appropriate ones.`,
+        plan: route.plan.map((step3) => step3.tools === originalTools ? { ...step3, tools } : step3)
+      };
+    };
     REGEX_BONUS = 0.25;
     resolveActiveVaultAlias = async (ctx) => {
       const normalizedRoot = resolve3(ctx.vaultRoot);
@@ -54902,8 +56070,11 @@ var init_route_question = __esm({
           suggestedArgs: { type: "CustomObject" }
         };
       }
-      const entityQuery = route.needsResolve ? extractEntityQuery(input2.question, route.intent) : null;
-      const entityTypes = entityQuery === null ? [] : inferEntityTypes(entityQuery, route.intent, input2.question);
+      const saveOrderIntent = SAVE_ORDER_INTENTS.has(route.intent);
+      const suggestedObject = route.suggestedArgs?.["objectApiName"];
+      const entityExtractionSource = stripComparisonAside(input2.question, route.intent);
+      const entityQuery = !route.needsResolve ? null : saveOrderIntent ? typeof suggestedObject === "string" ? suggestedObject : null : extractEntityQuery(entityExtractionSource, route.intent);
+      const entityTypes = entityQuery === null ? [] : saveOrderIntent ? ["CustomObject"] : inferEntityTypes(entityQuery, route.intent, input2.question);
       const entityResolution = entityQuery !== null ? await resolveComponents(ctx.graph, entityQuery, {
         limit: 5,
         ...entityTypes.length > 0 ? { types: entityTypes } : {}
@@ -54942,6 +56113,7 @@ var init_route_question = __esm({
       } else if (entityEvidence?.disposition === "ambiguous" && route.clarification === null) {
         route = { ...route, confidence: "medium" };
       }
+      route = applyComponentTypeGuard(route, resolvedTypeForGuard(route, refinedEntityResolution));
       const marginRouteToolArgs = await buildRouteToolArgsMap(route, ctx);
       if (routerMode() === "hybrid" && route.confidence !== "high") {
         const gateCandidates = buildFunnelCandidates(route, input2.question, marginRouteToolArgs, input2.mode);
@@ -54950,6 +56122,59 @@ var init_route_question = __esm({
           route = { ...route, confidence: "low", clarification: marginClar };
         }
       }
+      if (entityQuery !== null && refinedEntityResolution !== null && refinedEntityResolution.disposition === "none") {
+        const bareQuery = entityQuery.replace(/^(?:the|a|an)\s+/i, "").replace(/\s+(?:class(?:es)?|trigger(?:s)?|field(?:s)?|object(?:s)?|flow(?:s)?|component(?:s)?|layout(?:s)?|profile(?:s)?|report(?:s)?|dashboard(?:s)?|rule(?:s)?)$/i, "");
+        const bareRetry = bareQuery !== entityQuery && bareQuery.length > 0 ? await resolveComponents(ctx.graph, bareQuery, {
+          limit: 5,
+          ...entityTypes.length > 0 ? { types: entityTypes } : {}
+        }) : null;
+        const bareResolution = bareRetry?.ok === true && bareRetry.value.disposition !== "none" ? bareRetry.value : null;
+        if (bareResolution !== null) {
+          entityEvidence = {
+            query: bareQuery,
+            typeHints: entityTypes,
+            disposition: bareResolution.disposition,
+            clarificationRequired: false,
+            warning: bareResolution.disposition === "ambiguous" ? "Possible component matches were found, but none is strong enough to interrupt routing. Resolve the component before executing a component-specific analysis." : null,
+            candidates: bareResolution.candidates.slice(0, 5).map((candidate) => ({
+              componentId: candidate.id,
+              type: candidate.type,
+              apiName: candidate.apiName,
+              label: candidate.label,
+              parentApiName: candidate.parentApiName,
+              score: candidate.score,
+              base: candidate.base,
+              matchKind: candidate.matchKind,
+              evidence: candidate.evidence
+            }))
+          };
+        } else {
+          const premiseWarning = `PREMISE CHECK: no component matching '${entityQuery}' exists in the vault \u2014 verify the name (a typo, or metadata newer than the last refresh; /sfi-refresh may help). The routed tool fails closed on an unknown component; do not present its error as an answer about a real component.`;
+          route = {
+            ...route,
+            confidence: "low",
+            reason: `${route.reason} ${premiseWarning}`
+          };
+          entityEvidence = {
+            query: entityQuery,
+            typeHints: entityTypes,
+            disposition: "none",
+            clarificationRequired: false,
+            warning: premiseWarning,
+            candidates: []
+          };
+        }
+      } else if (entityQuery !== null && refinedEntityResolution !== null && refinedEntityResolution.disposition === "ambiguous" && (/__(?:c|mdt|e|x|b|kav)\b/i.test(entityQuery) || entityQuery.includes(".")) && !refinedEntityResolution.candidates.some((candidate) => candidate.apiName.toLowerCase() === entityQuery.toLowerCase() || candidate.id.toLowerCase().endsWith(`:${entityQuery.toLowerCase()}`))) {
+        const premiseWarning = `PREMISE CHECK: no component named '${entityQuery}' exists in the vault \u2014 the listed candidates are fuzzy lookalikes, not the component you named. Verify the name (a typo, or metadata newer than the last refresh; /sfi-refresh may help). The routed tool fails closed on an unknown component; do not present its error as an answer about a real component.`;
+        route = {
+          ...route,
+          confidence: "low",
+          reason: `${route.reason} ${premiseWarning}`
+        };
+        if (entityEvidence !== void 0) {
+          entityEvidence = { ...entityEvidence, warning: premiseWarning };
+        }
+      }
       const clarificationId = clarificationIdFor(ctx.manifest.sourceTreeHash, route);
       if (clarificationId !== null && route.clarification !== null) {
         route = {
@@ -65549,7 +66774,7 @@ var init_tools = __esm({
         similarityThreshold: { type: "number", minimum: 0, maximum: 1 },
         includeTypeIncompatible: { type: "boolean" }
       },
-      required: ["vault", "objectA", "objectB"]
+      required: ["objectA", "objectB"]
     });
     INTEGRATION_PROCEDURE_CHAIN_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -65661,7 +66886,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.resolve",
-        description: "Typo-tolerant resolver: messy/misspelled text -> ranked candidate components with a disposition (exact|ambiguous|none) + per-candidate evidence. Call FIRST when the user names a component informally; tolerates typos, filler, and the org's own misspellings that search_components cannot. CONFIRMED glossary annotations act as curated synonyms (candidates marked `glossary-alias`) \u2014 an alias never shadows an exact api-name match, and a synonym shared by two components yields `ambiguous` + clarification. Heuristic; never silently picks.",
+        description: "Typo-tolerant resolver: messy/misspelled text -> ranked candidate components with a disposition (exact|ambiguous|none) + per-candidate evidence. Call FIRST when the user names a component informally; tolerates typos, filler, and the org's own misspellings that search_components cannot. Leading/trailing schema nouns are TYPE hints, not name content: 'SSN field' scores exactly like bare 'SSN' (the noun is stripped from fuzzy matching and instead prefers candidates of the hinted type among equally-confident matches \u2014 it never floats a weak fuzzy match of that type over an exact-name match of another). A dotted 'Object.Field' query is a definitive parent-scoped hit. CONFIRMED glossary annotations act as curated synonyms (candidates marked `glossary-alias`) \u2014 an alias never shadows an exact api-name match, and a synonym shared by two components yields `ambiguous` + clarification. Heuristic; never silently picks.",
         inputSchema: RESOLVE_INPUT_SCHEMA
       },
       {
@@ -65691,7 +66916,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.route_question",
-        description: "Front-door router: for a plain-language question, surface a meaning-ranked shortlist of the sfi.* tools that can answer it \u2014 your host LLM picks which to run \u2014 plus the plane it belongs to (vault | live | hybrid | unknown), so the user never types a tool name. Read-only; it advises, it does not answer. Compound questions carry step ids and `dependsOn` edges: independent steps may run in parallel; a `then`-linked step waits for its prerequisite. On ambiguity it fails closed with `executionBlocked`, a clarification id, and offered options; resume deterministically by calling again with the exact same question plus `clarificationResponse: { clarificationId, selection }`. Stale ids and invented selections are rejected. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, surfaces `suggestedArgs` (heuristic per-intent hints \u2014 e.g. `event: 'update'` for a save-order question so you can call `what_happens_on_save` without guessing the DML event), and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap instead of fabricating (set `logGap: true` to also append the gap to the local backlog; off by default, privacy-first per CR-16); under `SFI_TOOL_PROFILE=core` the response also carries `invoke`: the routed tools as EXECUTABLE calls (core tools direct, everything else as the byte-identical `sfi.run_analysis` gateway envelope, suggestedArgs threaded) (a short phrase that merely NAMES a real vault component, with no question, is instead routed to sfi.resolve rather than 'unknown'). In the default hybrid mode the meaning-ranked `toolCandidates` are PRIMARY: every routable question carries the shortlist (offline TF-IDF over the capability map, no neural model, no network) plus a `guidance` line stating the loop YOU own \u2014 read the candidates \u2192 resolve any named component \u2192 pick/sequence the tool(s) \u2192 run them \u2192 ground via sfi.synthesize_answer. YOU decide which to run; the deterministic `route` rides along only as a non-authoritative HINT (suggested tool order + any resolved entity / suggestedArgs). Set `SFI_ROUTER_MODE=offline` for a deterministic, no-LLM route (Design A) where the route is authoritative and candidates are omitted \u2014 for CI / air-gapped hosts. An optional `mode` ('ask' | 'plan' | 'assessment') tailors the guidance and reranks the candidates toward that mode's family \u2014 'plan' favors the what_if_* / impact tools (an ordered change plan), 'assessment' favors the *_risk_report / readiness / coverage tools (a full evaluation), 'ask' is a quick grounded answer. Call this first on a vague/broad question to decide which tool(s) to run.",
+        description: "Front-door router: for a plain-language question, surface a meaning-ranked shortlist of the sfi.* tools that can answer it \u2014 your host LLM picks which to run \u2014 plus the plane it belongs to (vault | live | hybrid | unknown), so the user never types a tool name. Read-only; it advises, it does not answer. Compound questions carry step ids and `dependsOn` edges: independent steps may run in parallel; a `then`-linked step waits for its prerequisite. On GENUINE ambiguity it fails closed with `executionBlocked`, a clarification id, and offered options; resume deterministically by calling again with the exact same question plus `clarificationResponse: { clarificationId, selection }`. Stale ids and invented selections are rejected. Bare schema nouns in the question (trigger/flow/field/object/profile/permission set/record type) are INTENT vocabulary, never named-entity lookups \u2014 'the Contact trigger' scopes a save-order question to the Contact OBJECT, it does not shop 'trigger' to the resolver; an object-qualified field ('Status__c on Case') is resolved parent-scoped; and an entity the resolver reports `exact` never raises the components-match menu \u2014 that menu is reserved for two genuinely competing components. The resolved TYPE also gates the routed tools: when the named entity resolves to a FLOW, tools that hard-error on a Flow id (call_graph / method_reachability / explain_apex_method, and the object/field access audits) are SWAPPED for the Flow-appropriate ones (who_can_run for access asks, explain_flow \u2014 which narrates the Apex the Flow invokes \u2014 plus get_impact) instead of routing into a guaranteed error. Qualifier words never outrank the HEAD question: 'bulk'/'load' on a save-order or test-coverage ask, 'seats'/'license' on a permission-set-assignment ask, and 'integration'/vendor words on a field-write / profile-security / what-if ask all stay on the head intent (never forced onto governor_limit_risks / live_license_usage / integration_map); field_lineage is reserved for explicit lineage/provenance questions ('where does this data come from'), never a field-adjacent default. FALSE PREMISE: when the question names a component the resolver cannot find \u2014 disposition `none`, or a literal API reference (dotted / __c-suffixed) that none of the fuzzy candidates actually match \u2014 the route is STILL returned (the routed tool fails closed on the unknown id) but its confidence is downgraded and `entityEvidence.warning` carries a premise disclosure (no component matching '<name>' exists in the vault \u2014 verify the name), so a nonexistent component is never answered as if it were real. Honesty routes: asks the surface genuinely cannot answer route to an explicit gap, never a lookalike tool \u2014 e.g. 'which USERS hold permission set X' (PermissionSetAssignment is not modeled; effective_permissions describes GRANTS, not holders); profile user-roster asks route live (live_group_count over User by ProfileId) with a partial-answer disclosure; and cross-vault compare routes carry a disclosure that a SECOND registered vault is required, so a single-vault install is never routed confident-clean into vault-not-found. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, surfaces `suggestedArgs` (heuristic per-intent hints \u2014 e.g. `event: 'update'` for a save-order question so you can call `what_happens_on_save` without guessing the DML event), and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap instead of fabricating (set `logGap: true` to also append the gap to the local backlog; off by default, privacy-first per CR-16); under `SFI_TOOL_PROFILE=core` the response also carries `invoke`: the routed tools as EXECUTABLE calls (core tools direct, everything else as the byte-identical `sfi.run_analysis` gateway envelope, suggestedArgs threaded) (a short phrase that merely NAMES a real vault component, with no question, is instead routed to sfi.resolve rather than 'unknown'). In the default hybrid mode the meaning-ranked `toolCandidates` are PRIMARY: every routable question carries the shortlist (offline TF-IDF over the capability map, no neural model, no network) plus a `guidance` line stating the loop YOU own \u2014 read the candidates \u2192 resolve any named component \u2192 pick/sequence the tool(s) \u2192 run them \u2192 ground via sfi.synthesize_answer. YOU decide which to run; the deterministic `route` rides along only as a non-authoritative HINT (suggested tool order + any resolved entity / suggestedArgs). Set `SFI_ROUTER_MODE=offline` for a deterministic, no-LLM route (Design A) where the route is authoritative and candidates are omitted \u2014 for CI / air-gapped hosts. An optional `mode` ('ask' | 'plan' | 'assessment') tailors the guidance and reranks the candidates toward that mode's family \u2014 'plan' favors the what_if_* / impact tools (an ordered change plan), 'assessment' favors the *_risk_report / readiness / coverage tools (a full evaluation), 'ask' is a quick grounded answer. Call this first on a vague/broad question to decide which tool(s) to run.",
         inputSchema: ROUTE_QUESTION_INPUT_SCHEMA
       },
       {
@@ -65721,7 +66946,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.list_components",
-        description: 'List components of a given type (optionally narrowed by parentId), sorted by id. Paginated via limit/offset; `hasMore` hints at additional pages (a truncated page returns a `nextCursor` to resume). For `type: \'ApexClass\'`, optional boolean filters list interface/async/API implementers at the DB layer (correct pagination, not a post-filtered page): `isBatchable` / `isQueueable` / `isSchedulable` / `isRestResource` / `hasFutureMethod` / `hasInvocableMethod` / `hasAuraEnabledMethod` / `isTest` \u2014 e.g. `{ type: \'ApexClass\', isBatchable: true }` returns every Batchable class. When manifest coverage for the requested `type` is not `complete`, a structured `coverageCaveat` flags the inventory as potentially incomplete (scoped refresh, errored retrieve, not modeled) \u2014 including on non-empty pages. When the FIRST page is empty, a `retrievalHint` (FRESH-02) says WHY \u2014 "none in the org" (retrieved, none found) vs "not retrieved" (a scoped refresh skipped the type \u2014 run /sfi-refresh) vs "not modeled" \u2014 so an empty list is never a silent `[]` read as "the org has none". (The hint is suppressed when a boolean filter is active, since an empty filtered result is not a coverage gap.)',
+        description: 'List components of a given type (optionally narrowed by parentId), sorted by id. Paginated via limit/offset; `hasMore` hints at additional pages (a truncated page returns a `nextCursor` to resume). Grant-heavy rows (Profile / PermissionSet, whose nodes carry tens of KB of declarative grants) are slimmed to scalar properties \u2014 each such row is marked `properties.propertiesTruncated: true` and the page carries a top-level `propertiesSlimmed: true` \u2014 so the whole inventory fits per page; fetch full detail per component via sfi.get_component. For `type: \'ApexClass\'`, optional boolean filters list interface/async/API implementers at the DB layer (correct pagination, not a post-filtered page): `isBatchable` / `isQueueable` / `isSchedulable` / `isRestResource` / `hasFutureMethod` / `hasInvocableMethod` / `hasAuraEnabledMethod` / `isTest` \u2014 e.g. `{ type: \'ApexClass\', isBatchable: true }` returns every Batchable class. When manifest coverage for the requested `type` is not `complete`, a structured `coverageCaveat` flags the inventory as potentially incomplete (scoped refresh, errored retrieve, not modeled) \u2014 including on non-empty pages. When the FIRST page is empty, a `retrievalHint` (FRESH-02) says WHY \u2014 "none in the org" (retrieved, none found) vs "not retrieved" (a scoped refresh skipped the type \u2014 run /sfi-refresh) vs "not modeled" \u2014 so an empty list is never a silent `[]` read as "the org has none". (The hint is suppressed when a boolean filter is active, since an empty filtered result is not a coverage gap.)',
         inputSchema: LIST_COMPONENTS_INPUT_SCHEMA
       },
       {
@@ -65941,7 +67166,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.effective_permissions",
-        description: "Compute a user's EFFECTIVE access \u2014 the UNION of a profile + assigned permission sets, max-wins, with each permission attributed to the container(s) that grant it. `why_cant_user_see_record` evaluates a single record question against a bundle; nothing else rolls the containers up into one combined ability \u2014 this does. Input: `profileId` and/or `permissionSetIds[]` (at least one). A `PermissionSetGroup:` id may be passed in `permissionSetIds[]` \u2014 it is EXPANDED into its member permission sets (declared membership) and unioned in, so a PSG-assigned user gets a real answer (a permset reachable both directly and via a group is unioned once, not double-counted). It composes each container's outgoing `grantedBy` edges (object + field + apex) and `properties.userPermissions` (system perms). `objectPermissions[]` carries the OR'd `allowCreate`/`allowRead`/`allowEdit`/`allowDelete`/`viewAllRecords`/`modifyAllRecords` per object plus `grantedBy` (the containers contributing a flag); `systemPermissions[]` lists each user-permission with its `grantedBy`; `customPermissions[]` (CR-CAP-10) lists each granted custom permission with its `grantedBy` + `targetMissing` (true when the granted name has no `CustomPermission` definition in the vault \u2014 managed-package / not-retrieved; declared but not resolvable, and NOT folded into systemPermissions); `summary` reports objects / fieldsWithFls / apexClasses / systemPermissions / customPermissions counts. The object list PAGES (`limit` default 100 / max 200, `offset`/`hasMore`/`truncated`). `declared` confidence. `disclosures` is explicit about the boundaries: permission-set GROUP membership IS expanded, but muting permission sets are DISCLOSED, not subtracted (effective access may be lower); app/tab visibility is a SEPARATE surface (now extracted \u2014 see `app_access` / `tab_availability`), not part of this union; field-level detail is summarised (use `field_access_audit`); object permission is NOT record access (record visibility needs OWD + sharing); custom permissions are declared grants, NOT system userPermissions, so they are never double-counted. Missing containers are ignored with a disclosure; if none exist \u2192 `component-not-found`.",
+        description: "Compute a user's EFFECTIVE access \u2014 the UNION of a profile + assigned permission sets, max-wins, with each permission attributed to the container(s) that grant it. `why_cant_user_see_record` evaluates a single record question against a bundle; nothing else rolls the containers up into one combined ability \u2014 this does. Input: `profileId` and/or `permissionSetIds[]` (at least one). A `PermissionSetGroup:` id may be passed in `permissionSetIds[]` \u2014 it is EXPANDED into its member permission sets (declared membership) and unioned in, so a PSG-assigned user gets a real answer (a permset reachable both directly and via a group is unioned once, not double-counted). It composes each container's outgoing `grantedBy` edges (object + field + apex), `properties.userPermissions` (system perms), and `properties.recordTypeVisibilities` (record-type visibility). `objectPermissions[]` carries the OR'd `allowCreate`/`allowRead`/`allowEdit`/`allowDelete`/`viewAllRecords`/`modifyAllRecords` per object plus `grantedBy` (the containers contributing a flag); `systemPermissions[]` lists each user-permission with its `grantedBy`; `customPermissions[]` (CR-CAP-10) lists each granted custom permission with its `grantedBy` + `targetMissing` (true when the granted name has no `CustomPermission` definition in the vault \u2014 managed-package / not-retrieved; declared but not resolvable, and NOT folded into systemPermissions); `recordTypeVisibilities[]` unions each container's declared record-type visibility (max-wins \u2014 visible=true wins; `<visible>` omitted in older metadata counts as visible, only an explicit false hides), each entry `{recordType, visible, grantedBy}` \u2014 record-type visibility is part of THIS union now, no longer only the separate `recordtype_availability` surface (that tool remains for the per-object grouped view); a container carrying no extracted `recordTypeVisibilities` property (a vault refreshed before record-type extraction) contributes nothing and is DISCLOSED (re-run /sfi-refresh), never fabricated as 'no record types'; `summary` reports objects / fieldsWithFls / apexClasses / systemPermissions / customPermissions / recordTypeVisibilities counts. The object list PAGES (`limit` default 100 / max 200, `offset`/`hasMore`/`truncated`). `declared` confidence. `disclosures` is explicit about the boundaries: permission-set GROUP membership IS expanded, but muting permission sets are DISCLOSED, not subtracted (effective access may be lower); app/tab visibility is a SEPARATE surface (now extracted \u2014 see `app_access` / `tab_availability`), not part of this union; field-level detail is summarised (use `field_access_audit`); object permission is NOT record access (record visibility needs OWD + sharing); custom permissions are declared grants, NOT system userPermissions, so they are never double-counted. Missing containers are ignored with a disclosure; if none exist \u2192 `component-not-found`.",
         inputSchema: EFFECTIVE_PERMISSIONS_INPUT_SCHEMA
       },
       {
@@ -66480,7 +67705,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.field_mapping_between_objects",
-        description: 'Map the fields of one object onto another for a conversion or migration \u2014 which field on object A corresponds to which field on object B, and which fields have no match and would lose data. Answers "map {A} fields to {B} for conversion", "which {A} fields lose data converting to {B}", "what\'s the field mapping between these two objects" (the classic Lead-to-Contact conversion mapping). v3.1 Q174 honesty-anchor tool: given a single vault alias and TWO CustomObject api-names, returns a heuristic field pairing for migration mapping (the Lead-vs-Contact conversion case). Each `FieldPair` carries `fieldA` / `fieldB` shape (apiName, label, type), the Jaccard `labelSimilarity` over tokenized api-name + label tokens, the `typeCompatible` flag from the static type-compatibility table (text\u2194text, number\u2194number, date\u2194date, picklist\u2194picklist, reference\u2194reference), and `confidence: \'heuristic\'`. Optional `similarityThreshold` (default 0.50) suppresses pairs below the floor; `includeTypeIncompatible: true` retains label-matched pairs whose types disagree (each flagged `typeMismatch: true`). `unpairedFromA` / `unpairedFromB` list fields without a suggested match. `boundaries[]` ALWAYS surfaces the verbatim Q174 phrase: \'field-mapping suggestions are heuristic \u2014 labels are matched by token overlap and types by compatibility table. Verify each suggested pair against your business rules before relying on the mapping for a migration script.\' A v3.1 release without this phrase is a contract violation regardless of test-suite green (PLAN-v3.1 \xA710 constitutional axis).',
+        description: "Map the fields of one object onto another for a conversion or migration \u2014 which field on object A corresponds to which field on object B, and which fields have no match and would lose data. Answers \"map {A} fields to {B} for conversion\", \"which {A} fields lose data converting to {B}\", \"what's the field mapping between these two objects\" (the classic Lead-to-Contact conversion mapping). v3.1 Q174 honesty-anchor tool: given TWO CustomObject api-names, returns a heuristic field pairing for migration mapping (the Lead-vs-Contact conversion case). `vault` is OPTIONAL \u2014 omit it (the normal single-vault install) to map within the SERVED vault; supply a registered alias only in a multi-vault-registry deployment. With no registry, a self-referential alias (the served vault's directory name or path) still answers from the served vault with a single-vault disclosure; any other alias gets an honest alias-not-found refusal plus the omit-`vault` hint. Each `FieldPair` carries `fieldA` / `fieldB` shape (apiName, label, type), the Jaccard `labelSimilarity` over tokenized api-name + label tokens, the `typeCompatible` flag from the static type-compatibility table (text\u2194text, number\u2194number, date\u2194date, picklist\u2194picklist, reference\u2194reference), and `confidence: 'heuristic'`. Optional `similarityThreshold` (default 0.50) suppresses pairs below the floor; `includeTypeIncompatible: true` retains label-matched pairs whose types disagree (each flagged `typeMismatch: true`). `unpairedFromA` / `unpairedFromB` list fields without a suggested match. `boundaries[]` ALWAYS surfaces the verbatim Q174 phrase: 'field-mapping suggestions are heuristic \u2014 labels are matched by token overlap and types by compatibility table. Verify each suggested pair against your business rules before relying on the mapping for a migration script.' A v3.1 release without this phrase is a contract violation regardless of test-suite green (PLAN-v3.1 \xA710 constitutional axis).",
         inputSchema: FIELD_MAPPING_BETWEEN_OBJECTS_INPUT_SCHEMA
       },
       // v3.2 — OmniStudio composition tier. The
@@ -66550,7 +67775,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.find_component_usages",
-        description: 'The universal "where is this component used?" answer for ANY canonical component type (`componentId`) \u2014 one entry point instead of fanning out across find_field_anywhere / find_code_usages / get_impact / grep. Composes two evidence tiers: (1) GRAPH \u2014 incoming dependency edges to the target, grouped by referrer type, each carrying edge `confidence`, EXCLUDING access grants (`grantedBy`) and structural `parentOf` (access is not usage); (2) GREP supplement (`text-match` tier, `includeGrep` default true) \u2014 a literal search of Apex AND frontend bundle source (LWC/Aura/Visualforce \u2014 `$Label`/`$Resource`/`@salesforce` module references) for the api name, catching references the graph does not model (dynamic SOQL, reflective access, CustomMetadataType / CustomLabel / StaticResource refs). `graphReferrers[]` (type + count + sample), `grepSupplement` (matches with path/line/snippet), `summary` (counts + `hasStaticEvidence`), `boundaries[]`, `truncated`. HONESTY: empty graph + empty grep = "no static evidence in the vault" (in `boundaries`), NEVER "nothing uses this" \u2014 dynamic constructs, un-modeled families (reports/dashboards/list-views), and managed packages are invisible. Phantom-aware (a referenced-but-not-retrieved target still answers from its edges). Specialized tools (find_field_anywhere, layout_assignments, \u2026) stay for a deeper single-family answer; this unifies the common case. Non-canonical id \u2192 `invalid-query`; an id with no node AND no referrers \u2192 `component-not-found`.',
+        description: 'The universal "where is this component used?" answer for ANY canonical component type (`componentId`) \u2014 one entry point instead of fanning out across find_field_anywhere / find_code_usages / get_impact / grep. Composes two evidence tiers: (1) GRAPH \u2014 incoming dependency edges to the target, grouped by referrer type, each carrying edge `confidence`, EXCLUDING access grants (`grantedBy`) and structural `parentOf` (access is not usage); (2) GREP supplement (`text-match` tier, `includeGrep` default true) \u2014 a literal search of Apex AND frontend bundle source (LWC/Aura/Visualforce \u2014 `$Label`/`$Resource`/`@salesforce` module references) for the api name, catching references the graph does not model (dynamic SOQL, reflective access, CustomMetadataType / CustomLabel / StaticResource refs). `graphReferrers[]` (type + count + sample), `grepSupplement` (matches with path/line/snippet), `summary` (counts + `hasStaticEvidence`), `boundaries[]`, `truncated`. ACCESS-GRANT section: grants stay OUT of `graphReferrers`, but a separate `grantedBy` section (`{count, granters[{id,type}]}`) surfaces the granting containers when the target is a `CustomPermission` (its only incoming edges ARE grants \u2014 this answers "which Profiles / PermissionSets grant it?"; always present for that type, count 0 = no container grants it) or when the target has zero usage edges but incoming `grantedBy` edges; absent otherwise. HONESTY: empty graph + empty grep = "no static evidence in the vault" (in `boundaries`), NEVER "nothing uses this" \u2014 dynamic constructs, un-modeled families (reports/dashboards/list-views), and managed packages are invisible; grants are NOT usage, so `grantedBy` never counts toward `hasStaticEvidence`. Phantom-aware (a referenced-but-not-retrieved target still answers from its edges, including a granted-but-undefined managed-package CustomPermission). Specialized tools (find_field_anywhere, layout_assignments, \u2026) stay for a deeper single-family answer; this unifies the common case. Non-canonical id \u2192 `invalid-query`; an id with no node, no referrers AND no grants \u2192 `component-not-found`.',
         inputSchema: FIND_COMPONENT_USAGES_INPUT_SCHEMA
       },
       {
@@ -68630,7 +69855,7 @@ var init_package_version = __esm({
     "use strict";
     readCliPackageVersion = () => {
       if (true)
-        return "0.1.20";
+        return "0.1.21";
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
           const raw = readFileSync3(fileURLToPath(new URL(rel, import.meta.url)), "utf8");
@@ -68647,7 +69872,7 @@ var init_package_version = __esm({
 
 // dist/src/refresh-pipeline.js
 import { mkdir as mkdir10, readdir as readdir5, stat as stat7, writeFile as writeFile9 } from "node:fs/promises";
-import { basename as basename13, dirname as dirname20, join as join28, sep as sep3 } from "node:path";
+import { basename as basename14, dirname as dirname20, join as join28, sep as sep3 } from "node:path";
 var EXTRACT_CACHE_VERSION, SUPPORTED_TYPES, EXTRACTORS, dispatchFile, BUNDLE_PARENT_DIRS, walkDir, relativeSegments, DX_WRAPPER_SEGMENTS, KNOWN_SIDECAR_SUFFIXES, isKnownSidecar, skipAttributionKey, componentTypeFromSourcePath, FOLD_TO_FIELD_USAGE, foldReportDashboardUsageIntoFields, walkAndExtract, composeDocument, parentApiNameFor, writeNodeDocument, writeIndex, RENDER_PAGE_SIZE, renderVault, parseTypeFilter;
 var init_refresh_pipeline = __esm({
   "dist/src/refresh-pipeline.js"() {
@@ -68954,7 +70179,7 @@ var init_refresh_pipeline = __esm({
         return;
       }
       const sorted = entries.filter((entry) => !entry.name.startsWith(".")).sort((a2, b2) => a2.name < b2.name ? -1 : a2.name > b2.name ? 1 : 0);
-      const currentName = basename13(currentDir);
+      const currentName = basename14(currentDir);
       const isBundleParent = BUNDLE_PARENT_DIRS.has(currentName);
       for (const entry of sorted) {
         const abs = join28(currentDir, entry.name);
@@ -69005,7 +70230,7 @@ var init_refresh_pipeline = __esm({
     };
     componentTypeFromSourcePath = (sourceRoot, absPath, isDirectory = false) => {
       const segments = relativeSegments(sourceRoot, absPath);
-      const fileName = isDirectory ? basename13(absPath) : segments[segments.length - 1] ?? basename13(absPath);
+      const fileName = isDirectory ? basename14(absPath) : segments[segments.length - 1] ?? basename14(absPath);
       const dirSegments = isDirectory ? segments : segments.slice(0, -1);
       return dispatchFile(dirSegments, fileName, isDirectory);
     };
@@ -69203,7 +70428,7 @@ ${body}
 
 // dist/src/source-reconcile.js
 import { cp, readdir as readdir6, rm as rm3, stat as stat8 } from "node:fs/promises";
-import { basename as basename14, join as join29, relative as relative3, sep as sep4 } from "node:path";
+import { basename as basename15, join as join29, relative as relative3, sep as sep4 } from "node:path";
 var BUNDLE_PARENT_DIRS2, KNOWN_SIDECAR_SUFFIXES2, isKnownSidecar2, primaryRelPathForSidecar, walkSourceEntries, authoritativePathSet, reconcileSourceDeletions, syncAuthoritativeRetrieveIntoSource;
 var init_source_reconcile = __esm({
   "dist/src/source-reconcile.js"() {
@@ -69239,7 +70464,7 @@ var init_source_reconcile = __esm({
           return;
         }
         const sorted = entries.filter((entry) => !entry.name.startsWith(".")).sort((a2, b2) => a2.name < b2.name ? -1 : a2.name > b2.name ? 1 : 0);
-        const isBundleParent = BUNDLE_PARENT_DIRS2.has(basename14(currentDir));
+        const isBundleParent = BUNDLE_PARENT_DIRS2.has(basename15(currentDir));
         for (const entry of sorted) {
           const abs = join29(currentDir, entry.name);
           if (entry.isDirectory()) {
@@ -69296,7 +70521,7 @@ var init_source_reconcile = __esm({
       for (const entry of sourceEntries) {
         if (!typesToReconcile.has(entry.type))
           continue;
-        const fileName = basename14(entry.absPath);
+        const fileName = basename15(entry.absPath);
         const primaryRel = primaryRelPathForSidecar(entry.relPath, fileName);
         const authoritativeKey = primaryRel ?? entry.relPath;
         if (authoritative.has(authoritativeKey) || authoritative.has(entry.relPath))
@@ -138554,7 +139779,7 @@ var makeShutdownOnce = (ctx) => {
 
 // dist/src/commands/demo.js
 init_refresh();
-var buildVersion = () => true ? "0.1.20" : "dev";
+var buildVersion = () => true ? "0.1.21" : "dev";
 var SHUTDOWN_SIGNALS2 = ["SIGINT", "SIGTERM"];
 var resolveDemoSource = () => {
   let dir = dirname21(fileURLToPath2(import.meta.url));
@@ -139539,7 +140764,7 @@ init_vault_git();
 init_watch();
 var readVersion = () => {
   if (true)
-    return "0.1.20";
+    return "0.1.21";
   const pkgUrl = new URL("../../package.json", import.meta.url);
   const raw = readFileSync6(fileURLToPath3(pkgUrl), "utf8");
   const parsed = JSON.parse(raw);