sf-intelligence 0.1.4 → 0.1.5

package/dist/index.js

@@ -1027,6 +1027,7 @@ var init_resolve = __esm({
       const minBase = options?.minScore ?? MIN_BASE;
       const queryTokens = tokenizeText(query);
       const normQuery = normalizeName(query);
+      const querySpaceWords = new Set(query.trim().split(/\s+/).map(normalizeName).filter((w) => w.length > 0));
       let index;
       try {
         index = await getResolveIndex(store);
@@ -1037,6 +1038,12 @@ var init_resolve = __esm({
         });
       }
       const candidateIdx = gatherCandidates(index, queryTokens, normQuery);
+      const objectNormNames = /* @__PURE__ */ new Set();
+      for (const n of index.nodes) {
+        if (n.type === "CustomObject")
+          objectNormNames.add(n.normName);
+      }
+      const namedObjectWords = new Set([...querySpaceWords].filter((w) => objectNormNames.has(w)));
       const typeFilter = options?.types !== void 0 && options.types.length > 0 ? new Set(options.types) : null;
       const parentFilter = options?.parentId;
       const pass1 = [];
@@ -1079,7 +1086,8 @@ var init_resolve = __esm({
           if (perToken[i].score > globalBest[i])
             globalBest[i] = perToken[i].score;
         }
-        const wholeExact = normQuery.length >= 2 && node.normName === normQuery && query.includes(".") === node.apiName.includes(".");
+        const crossObjectFieldDecoy = node.type === "CustomField" && namedObjectWords.size > 0 && (node.parentApiName === null || !namedObjectWords.has(normalizeName(node.parentApiName)));
+        const wholeExact = normQuery.length >= 2 && node.normName === normQuery && query.includes(".") === node.apiName.includes(".") && !crossObjectFieldDecoy;
         pass1.push({ node, perToken, wholeExact, parentMatched });
       }
       const anchorIdx = [];
@@ -2488,7 +2496,7 @@ var init_finding_suppression = __esm({
 
 // ../mcp/dist/src/tools/crud-fls-audit.js
 import { z as z2 } from "zod";
-var CRUD_FLS_TOOL, CRUD_FLS_MAX_LIMIT, CRUD_FLS_DEFAULT_LIMIT, LIST_PAGE_SIZE, CRUD_FLS_RULES, SCANNED_TYPES, SEVERITY_SET, Q80_FALSE_POSITIVE_DISCLOSURE, CROSS_METHOD_DATAFLOW_DISCLOSURE, DYNAMIC_SOQL_DISCLOSURE, crudFlsAuditInputSchema, coerceIssue, compareClassById, crudFlsAuditHandler;
+var CRUD_FLS_TOOL, CRUD_FLS_MAX_LIMIT, CRUD_FLS_DEFAULT_LIMIT, LIST_PAGE_SIZE, CRUD_FLS_RULES, SCANNED_TYPES, SEVERITY_SET, Q80_FALSE_POSITIVE_DISCLOSURE, CROSS_METHOD_DATAFLOW_DISCLOSURE, DYNAMIC_SOQL_DISCLOSURE, crudFlsAuditInputSchema, CRUD_FLS_PAYLOAD_BUDGET_BYTES, trimEntryFindings, fitClassesToBudget, coerceIssue, compareClassById, crudFlsAuditHandler;
 var init_crud_fls_audit = __esm({
   "../mcp/dist/src/tools/crud-fls-audit.js"() {
     "use strict";
@@ -2518,8 +2526,39 @@ var init_crud_fls_audit = __esm({
     CROSS_METHOD_DATAFLOW_DISCLOSURE = "cross-method dataflow is invisible \u2014 a method that delegates the dangerous operation to a helper is analyzed in isolation; the helper behavior is invisible. Spot-check the call chain before treating a finding as a bug.";
     DYNAMIC_SOQL_DISCLOSURE = "dynamic SOQL (Database.query) strings are stripped before pattern passes; the embedded SQL is invisible to the FLS recognizer.";
     crudFlsAuditInputSchema = z2.object({
-      limit: z2.number().int().min(1).max(CRUD_FLS_MAX_LIMIT).optional()
+      limit: z2.number().int().min(1).max(CRUD_FLS_MAX_LIMIT).optional(),
+      offset: z2.number().int().min(0).optional()
     });
+    CRUD_FLS_PAYLOAD_BUDGET_BYTES = 36e3;
+    trimEntryFindings = (entry, budgetBytes) => {
+      const kept = [];
+      let used = Buffer.byteLength(JSON.stringify({ ...entry, findings: [] }), "utf8");
+      for (const finding of entry.findings) {
+        const size = Buffer.byteLength(JSON.stringify(finding), "utf8") + 1;
+        if (kept.length > 0 && used + size > budgetBytes)
+          break;
+        kept.push(finding);
+        used += size;
+      }
+      return { ...entry, findings: kept, findingsTruncated: true };
+    };
+    fitClassesToBudget = (classes, budgetBytes) => {
+      const kept = [];
+      let used = 0;
+      for (const entry of classes) {
+        const size = Buffer.byteLength(JSON.stringify(entry), "utf8") + 1;
+        if (kept.length === 0 && size > budgetBytes) {
+          kept.push(trimEntryFindings(entry, budgetBytes));
+          return { kept, trimmed: true };
+        }
+        if (kept.length > 0 && used + size > budgetBytes) {
+          return { kept, trimmed: true };
+        }
+        kept.push(entry);
+        used += size;
+      }
+      return { kept, trimmed: false };
+    };
     coerceIssue = (raw) => {
       if (raw === null || typeof raw !== "object")
         return null;
@@ -2592,8 +2631,11 @@ var init_crud_fls_audit = __esm({
         }
       }
       const classes = [...perClass.values()].sort(compareClassById);
-      const truncated = classes.length > limit;
-      const slice = classes.slice(0, limit);
+      const offset = input2.offset ?? 0;
+      const page = classes.slice(offset, offset + limit);
+      const { kept, trimmed } = fitClassesToBudget(page, CRUD_FLS_PAYLOAD_BUDGET_BYTES);
+      const returnedEnd = offset + kept.length;
+      const truncated = returnedEnd < classes.length;
       const boundaries = classes.length === 0 ? [] : [
         Q80_FALSE_POSITIVE_DISCLOSURE,
         CROSS_METHOD_DATAFLOW_DISCLOSURE,
@@ -2601,13 +2643,19 @@ var init_crud_fls_audit = __esm({
       ];
       return ok({
         data: {
-          classes: slice,
+          classes: kept,
           totalClassCount: classes.length,
           totalFindingCount,
           suppressedFindingCount,
           byRule,
           boundaries,
-          truncated
+          limit,
+          offset,
+          truncated,
+          ...truncated ? { nextOffset: returnedEnd } : {},
+          ...trimmed ? {
+            note: `Response trimmed to ${kept.length} of ${page.length} classes (${classes.length} total) to stay under the ~45 KB MCP response limit. Advance with offset += ${kept.length} for the rest.`
+          } : {}
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -7199,7 +7247,10 @@ var init_event_subscribers = __esm({
       "Flow"
     ]);
     eventSubscribersInputSchema = z29.object({
-      eventId: z29.string().min(1),
+      // Optional (R0791 fix): OMIT to get the catalog of ALL Platform Events with
+      // their subscriber counts — answers "what platform events does this org
+      // publish?". Supply it for the subscriber list of one specific event.
+      eventId: z29.string().min(1).optional(),
       limit: z29.number().int().min(1).max(EVENT_SUBSCRIBERS_MAX_LIMIT).optional()
     });
     validateEventId = (eventId) => {
@@ -7234,6 +7285,46 @@ var init_event_subscribers = __esm({
     };
     compareSubscribers2 = (a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
     eventSubscribersHandler = async (ctx, input2) => {
+      const limit = input2.limit ?? EVENT_SUBSCRIBERS_DEFAULT_LIMIT;
+      if (input2.eventId === void 0) {
+        const nodesResult = await listNodesByType(ctx.graph, "CustomObject", {
+          limit: EVENT_SUBSCRIBERS_MAX_LIMIT
+        });
+        if (!nodesResult.ok) {
+          return err({ kind: "internal", message: `graph query failed: ${nodesResult.error.message}` });
+        }
+        const events = [];
+        for (const node of nodesResult.value) {
+          if (!node.apiName.endsWith(EVENT_API_NAME_SUFFIX))
+            continue;
+          const inEdges = await listEdges(ctx.graph, node.id, {
+            direction: "in",
+            edgeType: "listensTo"
+          });
+          if (!inEdges.ok) {
+            return err({ kind: "internal", message: `graph query failed: ${inEdges.error.message}` });
+          }
+          let subscriberCount = 0;
+          for (const edge of inEdges.value) {
+            const sub = await getNodeById(ctx.graph, edge.fromId);
+            if (!sub.ok) {
+              return err({ kind: "internal", message: `graph query failed: ${sub.error.message}` });
+            }
+            if (sub.value !== null && SUBSCRIBER_NODE_TYPES2.has(sub.value.type)) {
+              subscriberCount += 1;
+            }
+          }
+          events.push({ eventId: node.id, eventApiName: node.apiName, subscriberCount });
+        }
+        events.sort((a, b) => a.eventId < b.eventId ? -1 : a.eventId > b.eventId ? 1 : 0);
+        return ok({
+          data: { subscribers: [], eventApiName: null, events: events.slice(0, limit) },
+          vaultState: {
+            sourceTreeHash: ctx.manifest.sourceTreeHash,
+            refreshedAt: ctx.manifest.refreshedAt
+          }
+        });
+      }
       const apiName = validateEventId(input2.eventId);
       if (apiName === null) {
         return err({
@@ -7242,7 +7333,6 @@ var init_event_subscribers = __esm({
           path: "eventId"
         });
       }
-      const limit = input2.limit ?? EVENT_SUBSCRIBERS_DEFAULT_LIMIT;
       const edgesResult = await listEdges(ctx.graph, input2.eventId, {
         direction: "in",
         edgeType: "listensTo"
@@ -7466,6 +7556,23 @@ var init_explain_apex_method = __esm({
   }
 });
 
+// ../mcp/dist/src/tools/phantom-node.js
+var phantomAwareNotFoundMessage;
+var init_phantom_node = __esm({
+  "../mcp/dist/src/tools/phantom-node.js"() {
+    "use strict";
+    init_src();
+    phantomAwareNotFoundMessage = async (ctx, id, kindLabel) => {
+      const inbound = await listEdges(ctx.graph, id, { direction: "in" });
+      const refs = inbound.ok ? inbound.value.length : 0;
+      if (refs === 0) {
+        return `no ${kindLabel} with id ${id}`;
+      }
+      return `\`${id}\` is referenced by ${refs} other component(s) in this org (e.g. code, tests, or permission grants) but its own ${kindLabel} definition was never retrieved into the vault \u2014 typically a managed-package component or one outside the retrieve scope. Run \`sfi refresh\` if it should be retrievable; otherwise treat it as external.`;
+    };
+  }
+});
+
 // ../mcp/dist/src/tools/explain-field.js
 import { z as z31 } from "zod";
 var CUSTOM_FIELD_PREFIX, CUSTOM_METADATA_DEFINITION_SUFFIX, explainFieldInputSchema, readFieldType2, readFieldFormula, readFieldReferenceTo, readFieldDescription, readFieldInlineHelpText, readFieldRequired, readFieldLabel2, parentTypeApiName2, shouldIncludeRecordValues, readFieldApiName, findValueForField, compareRecordValues, collectRecordValues, explainFieldHandler;
@@ -7474,6 +7581,7 @@ var init_explain_field = __esm({
     "use strict";
     init_dist();
     init_src();
+    init_phantom_node();
     CUSTOM_FIELD_PREFIX = "CustomField:";
     CUSTOM_METADATA_DEFINITION_SUFFIX = "__mdt";
     explainFieldInputSchema = z31.object({
@@ -7587,7 +7695,7 @@ var init_explain_field = __esm({
       if (node === null) {
         return err({
           kind: "component-not-found",
-          message: `no field with id ${input2.fieldId}`,
+          message: await phantomAwareNotFoundMessage(ctx, input2.fieldId, "CustomField"),
           path: input2.fieldId
         });
       }
@@ -9906,7 +10014,7 @@ var init_code_quality_patterns = __esm({
         return [];
       const issues = [];
       const seen = /* @__PURE__ */ new Set();
-      const collect = (re, op, sobject) => {
+      const collect2 = (re, op, sobject) => {
         const r = new RegExp(re.source, "g");
         let m;
         while ((m = r.exec(stripped)) !== null) {
@@ -9926,8 +10034,8 @@ var init_code_quality_patterns = __esm({
           });
         }
       };
-      collect(DML_STATEMENT_PATTERN, "dml", null);
-      collect(DML_DATABASE_CALL_PATTERN, "dml", null);
+      collect2(DML_STATEMENT_PATTERN, "dml", null);
+      collect2(DML_DATABASE_CALL_PATTERN, "dml", null);
       return issues;
     };
     INLINE_SOQL_PATTERN = /\[\s*SELECT\b([\s\S]*?)\]/gi;
@@ -10390,14 +10498,32 @@ var init_src4 = __esm({
 
 // ../mcp/dist/src/tools/field-access-audit.js
 import { z as z35 } from "zod";
-var CUSTOM_FIELD_PREFIX3, PERMISSION_TYPE_VALUES, GRANTOR_TYPES, APEX_NODE_TYPES, fieldAccessAuditInputSchema, resolvePermissionLevel, permissionMatches, compareGrants, compareApexAccess, fieldAccessAuditHandler;
+var CUSTOM_FIELD_PREFIX3, synthesizeFieldNode, PERMISSION_TYPE_VALUES, GRANTOR_TYPES, APEX_NODE_TYPES, fieldAccessAuditInputSchema, resolvePermissionLevel, permissionMatches, compareGrants, compareApexAccess, fieldAccessAuditHandler;
 var init_field_access_audit = __esm({
   "../mcp/dist/src/tools/field-access-audit.js"() {
     "use strict";
     init_dist();
     init_src();
     init_src4();
+    init_phantom_node();
     CUSTOM_FIELD_PREFIX3 = "CustomField:";
+    synthesizeFieldNode = (fieldId) => {
+      const afterPrefix = fieldId.slice(CUSTOM_FIELD_PREFIX3.length);
+      const dot = afterPrefix.lastIndexOf(".");
+      const apiName = dot >= 0 ? afterPrefix.slice(dot + 1) : afterPrefix;
+      return {
+        id: fieldId,
+        type: "CustomField",
+        apiName,
+        label: null,
+        parentId: dot >= 0 ? `CustomObject:${afterPrefix.slice(0, dot)}` : null,
+        sourcePath: "",
+        lastModifiedDate: null,
+        lastModifiedBy: null,
+        apiVersion: null,
+        properties: {}
+      };
+    };
     PERMISSION_TYPE_VALUES = ["read", "edit", "all"];
     GRANTOR_TYPES = /* @__PURE__ */ new Set([
       "Profile",
@@ -10451,14 +10577,6 @@ var init_field_access_audit = __esm({
         });
       }
       const fieldNode = fieldResult.value;
-      if (fieldNode === null) {
-        return err({
-          kind: "component-not-found",
-          message: `no field with id ${fieldId}`,
-          path: fieldId
-        });
-      }
-      const detection = detectPiiClassificationWithReason(fieldNode);
       const grantedByResult = await listEdges(ctx.graph, fieldId, {
         direction: "in",
         edgeType: "grantedBy"
@@ -10478,6 +10596,16 @@ var init_field_access_audit = __esm({
           message: `graph query failed: ${allIncomingResult.error.message}`
         });
       }
+      if (fieldNode === null && allIncomingResult.value.length === 0) {
+        return err({
+          kind: "component-not-found",
+          message: await phantomAwareNotFoundMessage(ctx, fieldId, "CustomField"),
+          path: fieldId
+        });
+      }
+      const notModeled = fieldNode === null;
+      const effectiveField = fieldNode ?? synthesizeFieldNode(fieldId);
+      const detection = detectPiiClassificationWithReason(effectiveField);
       let profilesWithRead = 0;
       let profilesWithEdit = 0;
       let profilesWithUnknown = 0;
@@ -10559,7 +10687,11 @@ var init_field_access_audit = __esm({
       return ok({
         data: {
           fieldId,
-          fieldLabel: fieldNode.label ?? fieldNode.apiName,
+          fieldLabel: effectiveField.label ?? effectiveField.apiName,
+          notModeled,
+          ...notModeled ? {
+            notModeledNote: `\`${fieldId}\`'s own field definition was not retrieved into the vault \u2014 standard fields and managed-package fields are not modeled. The grants and Apex access below are read from the permission/usage edges (accurate); the field's data type, formula, and description are unavailable, and the PII classification is inferred from the field name alone.`
+          } : {},
           piiClassification: detection.piiClassification,
           piiCategory: detection.piiCategory,
           grants: [...grants].sort(compareGrants),
@@ -10591,6 +10723,7 @@ var init_safe_to_delete_field = __esm({
     init_dist();
     init_src();
     init_src2();
+    init_phantom_node();
     CUSTOM_FIELD_PREFIX4 = "CustomField:";
     EXAMPLES_PER_CATEGORY_LIMIT = 5;
     CATEGORY_ORDER = [
@@ -10799,10 +10932,49 @@ var init_safe_to_delete_field = __esm({
         });
       }
       if (nodeResult.value === null) {
-        return err({
-          kind: "component-not-found",
-          message: `no field with id ${fieldId}`,
-          path: fieldId
+        const inboundResult = await listEdges(ctx.graph, fieldId, {
+          direction: "in"
+        });
+        if (!inboundResult.ok) {
+          return err({
+            kind: "internal",
+            message: `graph query failed: ${inboundResult.error.message}`
+          });
+        }
+        if (inboundResult.value.length === 0) {
+          return err({
+            kind: "component-not-found",
+            message: await phantomAwareNotFoundMessage(ctx, fieldId, "CustomField"),
+            path: fieldId
+          });
+        }
+        return ok({
+          data: {
+            fieldId,
+            verdict: "review",
+            reasoning: [
+              {
+                category: "unknown",
+                verdict: "review",
+                count: inboundResult.value.length,
+                examples: [],
+                note: `This field's own definition was not retrieved into the vault \u2014 standard fields and managed-package fields are not modeled. It is referenced by ${inboundResult.value.length} component(s)/grant(s). NOT proven safe to delete: a standard field cannot be deleted via metadata, and a not-modeled field cannot be fully assessed. Run \`sfi refresh\` if it should be retrievable, or treat it as external.`
+              }
+            ],
+            trust: {
+              provenance: "offline_snapshot",
+              confidence: "declared",
+              freshness: { snapshotRefreshedAt: ctx.manifest.refreshedAt },
+              completeness: { status: "partial" },
+              limitations: [
+                "The field's own definition is not in the vault (standard or managed-package field); this verdict is based on inbound references only."
+              ]
+            }
+          },
+          vaultState: {
+            sourceTreeHash: ctx.manifest.sourceTreeHash,
+            refreshedAt: ctx.manifest.refreshedAt
+          }
         });
       }
       if (nodeResult.value.properties["system"] === true) {
@@ -13293,6 +13465,11 @@ var init_find_dead_code = __esm({
                FALSE) AS is_own_entry_point
       FROM nodes
       WHERE type IN (${placeholders})
+        -- Standard fields (api name has no __c suffix) are platform fields:
+        -- not deletable and not "dead code". Only custom / managed-package
+        -- fields (which end in __c) are valid CustomField dead-code candidates
+        -- (NI-6: stops IsPartner/IsCustomerPortal/etc. being flagged dead).
+        AND NOT (type = 'CustomField' AND api_name NOT LIKE '%\\_\\_c' ESCAPE '\\')
     ),
     incoming AS (
       SELECT e.to_id AS cid,
@@ -16150,7 +16327,7 @@ var init_generate_architecture_overview = __esm({
 
 // ../mcp/dist/src/tools/pii-inventory.js
 import { z as z60 } from "zod";
-var PII_INVENTORY_MAX_LIMIT, PII_INVENTORY_DEFAULT_LIMIT, SCAN_PAGE_SIZE, CLASSIFICATION_FILTER_VALUES, CATEGORY_FILTER_VALUES, piiInventoryInputSchema, emptyClassificationCounts, emptyCategoryCounts, classificationMatches, categoryMatches, readDataType, readDescription, compareFields, fetchAllCustomFields2, piiInventoryHandler;
+var PII_INVENTORY_MAX_LIMIT, PII_INVENTORY_DEFAULT_LIMIT, SCAN_PAGE_SIZE, CLASSIFICATION_FILTER_VALUES, CATEGORY_FILTER_VALUES, piiInventoryInputSchema, PII_PAYLOAD_BUDGET_BYTES, fitFieldsToBudget, emptyClassificationCounts, emptyCategoryCounts, classificationMatches, categoryMatches, readDataType, readDescription, compareFields, fetchAllCustomFields2, piiInventoryHandler;
 var init_pii_inventory = __esm({
   "../mcp/dist/src/tools/pii-inventory.js"() {
     "use strict";
@@ -16171,8 +16348,23 @@ var init_pii_inventory = __esm({
     piiInventoryInputSchema = z60.object({
       classification: z60.enum(CLASSIFICATION_FILTER_VALUES).optional(),
       category: z60.enum(CATEGORY_FILTER_VALUES).optional(),
-      limit: z60.number().int().min(1).max(PII_INVENTORY_MAX_LIMIT).optional()
+      limit: z60.number().int().min(1).max(PII_INVENTORY_MAX_LIMIT).optional(),
+      offset: z60.number().int().min(0).optional()
     });
+    PII_PAYLOAD_BUDGET_BYTES = 38e3;
+    fitFieldsToBudget = (fields, budgetBytes) => {
+      const kept = [];
+      let used = 0;
+      for (const field of fields) {
+        const size = Buffer.byteLength(JSON.stringify(field), "utf8") + 1;
+        if (kept.length > 0 && used + size > budgetBytes) {
+          return { kept, trimmed: true };
+        }
+        kept.push(field);
+        used += size;
+      }
+      return { kept, trimmed: false };
+    };
     emptyClassificationCounts = () => ({
       pii: 0,
       sensitive: 0,
@@ -16259,17 +16451,26 @@ var init_pii_inventory = __esm({
         });
       }
       const sorted = [...matched].sort(compareFields);
-      const truncated = sorted.length > limit;
-      const fields = sorted.slice(0, limit);
+      const offset = input2.offset ?? 0;
+      const page = sorted.slice(offset, offset + limit);
+      const { kept, trimmed } = fitFieldsToBudget(page, PII_PAYLOAD_BUDGET_BYTES);
+      const returnedEnd = offset + kept.length;
+      const truncated = returnedEnd < sorted.length;
       return ok({
         data: {
-          fields,
+          fields: kept,
           summary: {
             total: matched.length,
             byClassification,
             byCategory
           },
-          truncated
+          limit,
+          offset,
+          truncated,
+          ...truncated ? { nextOffset: returnedEnd } : {},
+          ...trimmed ? {
+            note: `Response trimmed to ${kept.length} of ${page.length} matched fields to stay under the ~45 KB MCP response limit. Advance with offset += ${kept.length} for the rest.`
+          } : {}
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -16983,6 +17184,7 @@ var init_get_component = __esm({
     init_dist();
     init_src();
     init_src2();
+    init_phantom_node();
     DEFAULT_COMPONENT_BODY_MAX_BYTES = 3e4;
     getComponentInputSchema = z64.object({
       id: z64.string().min(1),
@@ -16997,9 +17199,10 @@ var init_get_component = __esm({
         });
       }
       if (nodeResult.value === null) {
+        const kindLabel = input2.id.includes(":") ? input2.id.slice(0, input2.id.indexOf(":")) : "component";
         return err({
           kind: "component-not-found",
-          message: `no node with id ${input2.id}`,
+          message: await phantomAwareNotFoundMessage(ctx, input2.id, kindLabel),
           path: input2.id
         });
       }
@@ -17454,11 +17657,201 @@ var init_get_subgraph = __esm({
   }
 });
 
+// ../mcp/dist/src/knowledge-topics.js
+var TRAILHEAD, HELP, KNOWLEDGE_TOPICS, resolveTopicKey;
+var init_knowledge_topics = __esm({
+  "../mcp/dist/src/knowledge-topics.js"() {
+    "use strict";
+    TRAILHEAD = { label: "Trailhead", url: "https://trailhead.salesforce.com" };
+    HELP = { label: "Salesforce Help", url: "https://help.salesforce.com" };
+    KNOWLEDGE_TOPICS = Object.freeze({
+      "flow-vs-apex": {
+        title: "Flow vs Apex \u2014 when to use which",
+        summary: "Prefer declarative record-triggered Flow for most automation; reach for an Apex trigger only when you need logic Flow cannot do well: complex bulk processing, callouts with fine control, recursion management, custom error handling, or operations across many records/objects in one transaction. Keep one record-triggered Flow (or one trigger) per object/timing and delegate to a handler. Avoid mixing Workflow Rules / Process Builder with Flow on the same object.",
+        docs: [
+          { label: "Record-Triggered Automation (Architects)", url: "https://architect.salesforce.com/decision-guides/trigger-automation" },
+          TRAILHEAD
+        ]
+      },
+      "order-of-execution": {
+        title: "Apex order of execution on save",
+        summary: `On save Salesforce runs, in order: system validation, before-save record-triggered flows, before triggers, system + custom validation rules, duplicate rules, after triggers, assignment/auto-response/workflow rules, processes & after-save flows, escalation rules, roll-up summary recalculation, sharing recalculation, then commit and post-commit (async, email, @future). Knowing the order explains why a field looks stale or an automation "didn't fire".`,
+        docs: [
+          { label: "Apex Developer Guide \u2014 Triggers and Order of Execution", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_order_of_execution.htm" }
+        ]
+      },
+      "governor-limits": {
+        title: "Apex governor limits to design around",
+        summary: "Per-transaction limits force bulk-safe design: 100 SOQL queries (200 async), 150 DML statements, 50,000 rows retrieved, 10s sync / 60s async CPU time, 6 MB sync / 12 MB async heap, 100 callouts, 10 emails. Never put SOQL/DML inside loops; bulkify; query selectively; move heavy work to Batch/Queueable.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Execution Governors and Limits", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_gov_limits.htm" }
+        ]
+      },
+      "async-apex": {
+        title: "Asynchronous Apex options",
+        summary: "Future (@future): simplest fire-and-forget, primitives only, for callouts/decoupling \u2014 no chaining, no monitoring. Queueable: like future but accepts objects, can chain, returns a job id. Batch (Database.Batchable): process millions of records in chunks (start/execute/finish), higher limits. Schedulable: run Apex on a cron schedule (often to enqueue a Batch). Choose by data volume, need to chain/monitor, and scheduling.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Asynchronous Apex", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_async_overview.htm" },
+          TRAILHEAD
+        ]
+      },
+      "trigger-framework": {
+        title: "Apex trigger framework pattern",
+        summary: "Adopt one-trigger-per-object that immediately delegates to a handler class; keep zero business logic in the trigger body. A framework gives you context routing (before/after, insert/update/...), recursion control (static guards), and bulk-safe handler methods. Popular patterns: a simple hand-rolled handler base class, or community frameworks. Consistency matters more than which framework.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Triggers", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers.htm" },
+          TRAILHEAD
+        ]
+      },
+      "bulkification": {
+        title: "Bulkified Apex best practices",
+        summary: "Assume every trigger/method processes up to 200 records. Query once with maps keyed by id, never inside loops; collect DML into lists and do one insert/update outside loops; use collections and Maps for lookups; pass record collections, not single records. Test with \u2265200-record bulk data, not one record.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Bulk Trigger Idioms", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_triggers_bulk_idioms.htm" }
+        ]
+      },
+      "apex-testing": {
+        title: "Apex testing, coverage, and test data",
+        summary: "Production deploys require \u226575% org-wide Apex coverage and all tests passing (each trigger must have some coverage). Coverage is a floor, not the goal: assert real behavior with System.assertEquals on distinct expected/actual values. Build test data in @isTest test-data-factory classes; use Test.startTest/stopTest for limits and async; avoid SeeAllData=true. Structure: one test class per class, descriptive methods, positive + negative + bulk cases.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Testing Apex", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_testing.htm" }
+        ]
+      },
+      "apex-callouts": {
+        title: "Making external callouts from Apex",
+        summary: "Use Named Credentials for endpoints + auth (never hardcode URLs/secrets); call via HttpRequest/HttpResponse or external services. Callouts cannot follow uncommitted DML in the same transaction \u2014 do them before DML or from async (@future(callout=true)/Queueable). Set timeouts, handle non-200s, and write tests with HttpCalloutMock.",
+        docs: [
+          { label: "Apex Developer Guide \u2014 Invoking Callouts Using Apex", url: "https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts.htm" }
+        ]
+      },
+      "sfdx-source-driven-dev": {
+        title: "Source-driven development with SFDX",
+        summary: "Treat metadata as source in version control. Use a Salesforce DX project (sfdx-project.json), scratch orgs for feature development, and the `sf` CLI to retrieve/deploy/convert source. Pair with a CI/CD pipeline (validate + run tests on PR, deploy on merge) and unlocked packages for modular delivery.",
+        docs: [
+          { label: "Salesforce DX Developer Guide", url: "https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_setup_intro.htm" },
+          TRAILHEAD
+        ]
+      },
+      "package-strategy": {
+        title: "Unlocked packages & modular structure",
+        summary: "Decompose the org into unlocked packages aligned to functional domains, each with a clear dependency direction (no cycles). Packages give versioning, clean install/upgrade, and ownership boundaries. Start with a small number of coarse packages; split as ownership and dependencies clarify. Keep a base/common package for shared components.",
+        docs: [
+          { label: "SFDX \u2014 Unlocked Packages", url: "https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_unlocked_pkg_intro.htm" },
+          TRAILHEAD
+        ]
+      },
+      "profiles-vs-permission-sets": {
+        title: "Profiles vs Permission Sets",
+        summary: 'Modern best practice: keep profiles minimal (login hours, default record types, page layouts as needed) and grant capabilities via Permission Sets and Permission Set Groups. This avoids "profile proliferation", makes access additive and auditable, and lets you assign least-privilege bundles per role. Salesforce is moving permissions toward permission sets.',
+        docs: [HELP, TRAILHEAD]
+      },
+      "owd-sharing-model": {
+        title: "OWD & the sharing model (greenfield)",
+        summary: "Set Org-Wide Defaults to the most restrictive level each object needs (Private / Public Read Only / Public Read-Write), then OPEN UP access with the role hierarchy, sharing rules (ownership- or criteria-based), permission sets (View All/Modify All), teams, and manual/Apex sharing. Design least-privilege: start Private and grant deliberately. Plan sharing recalculation cost for large data volumes.",
+        docs: [HELP, TRAILHEAD]
+      },
+      "standard-vs-custom-objects": {
+        title: "Standard vs custom objects",
+        summary: "Use standard objects (Account, Contact, Opportunity, Case, Lead, ...) whenever they fit \u2014 they come with built-in features, reports, and integrations. Create custom objects only for concepts standard objects do not represent. Prefer extending a standard object with custom fields over cloning it. Consider the data model, relationships, and license implications before adding custom objects.",
+        docs: [HELP, TRAILHEAD]
+      },
+      "naming-conventions": {
+        title: "Naming & documentation conventions",
+        summary: "Establish conventions from day one: consistent API names (PascalCase objects, clear field suffixes), prefixes for app/domain, description + help-text on every field, and a documented automation/trigger naming scheme. Conventions make the org self-describing and reduce technical debt. Record them in a living standards doc.",
+        docs: [TRAILHEAD, HELP]
+      },
+      "sandbox-environment-strategy": {
+        title: "Sandbox & environment strategy",
+        summary: "Use a tiered environment path: developer/scratch orgs for build, an integration/partial sandbox for merged work, a full or partial sandbox for UAT/staging, then production. Match sandbox type to need (Developer/Developer Pro for config/code, Partial/Full for data-dependent testing). Automate refresh + seeding and gate promotion with CI tests.",
+        docs: [HELP, TRAILHEAD]
+      },
+      "single-vs-multi-org": {
+        title: "Single-org vs multi-org strategy",
+        summary: "Prefer a single org when business units share processes, data, and customers \u2014 it maximizes the 360\xB0 view and minimizes integration/duplication cost. Choose multi-org when regulatory isolation, radically different processes, divestiture risk, or per-region governance demand hard boundaries. Weigh org limits, governance maturity, and the cost of cross-org integration before splitting.",
+        docs: [{ label: "Architect decision guides", url: "https://architect.salesforce.com/decision-guides" }, TRAILHEAD]
+      },
+      "data-retention-archiving": {
+        title: "Data retention & archiving strategy",
+        summary: "Plan retention up front: classify data by regulatory/operational need, define how long each object is kept hot, and archive or purge the rest. Options include Big Objects for low-cost archival, scheduled batch purges, external/offline archives, and field-history/event-log retention settings. Designing this early prevents storage-limit and LDV pain later.",
+        docs: [HELP, TRAILHEAD]
+      },
+      "large-data-volumes": {
+        title: "Large data volumes (LDV) planning",
+        summary: "At millions of records, design for selectivity: indexed/selective filters, skinny tables (via Support) for hot reports, careful sharing (ownership/data skew avoidance), Big Objects for archival, and bulk/async data loads. Watch for non-selective SOQL, account/ownership skew, and sharing-recalculation cost. Plan partitioning and reporting strategy before volume arrives.",
+        docs: [{ label: "LDV Best Practices (Architects)", url: "https://architect.salesforce.com/well-architected/adaptable/resilient" }, TRAILHEAD]
+      },
+      "release-management": {
+        title: "Release management & deployment pipeline",
+        summary: "Establish a source-of-truth VCS, environment promotion path (dev \u2192 integration \u2192 UAT \u2192 prod), and a CI/CD pipeline that validates + runs Apex tests on every change and deploys on merge. Use unlocked packages or change sets/metadata API, automate with the `sf` CLI or a DevOps tool, and keep deployments small and frequent. Gate prod with required coverage + review.",
+        docs: [TRAILHEAD, { label: "Salesforce DX Developer Guide", url: "https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_setup_intro.htm" }]
+      },
+      "well-architected": {
+        title: "Salesforce Well-Architected principles",
+        summary: "Salesforce Well-Architected frames a healthy org as Trusted (secure, compliant, reliable), Easy (intentional, automated, resilient \u2014 minimal complexity/debt), and Adaptable (composable, scalable). Use it as a checklist when designing: least-privilege security, consolidated automation, documented conventions, modular packaging, and scalable data design.",
+        docs: [{ label: "Salesforce Well-Architected", url: "https://architect.salesforce.com/well-architected/overview" }, TRAILHEAD]
+      },
+      "license-types": {
+        title: "License types & planning",
+        summary: "Match license types to user needs: full Salesforce/CRM licenses for internal power users, Platform licenses for users who only need custom apps + a few standard objects, and Experience Cloud licenses for external community users. Permission Set Licenses add capabilities on top. Count licenses by persona early \u2014 they drive cost and constrain object/feature access.",
+        docs: [HELP, TRAILHEAD]
+      },
+      "integration-patterns": {
+        title: "Integration patterns",
+        summary: "Pick the pattern by need: Request-Reply (synchronous UI callouts), Fire-and-Forget (Platform Events / outbound), Batch Data Sync (scheduled bulk), Remote Call-In (inbound REST/SOAP API), and UI Update from external (streaming/CDC). Prefer middleware/event-driven over point-to-point at scale; use Named Credentials for auth and design idempotent retries + error handling.",
+        docs: [{ label: "Integration Patterns (Architects)", url: "https://architect.salesforce.com/decision-guides/integrate-salesforce" }, TRAILHEAD]
+      }
+    });
+    resolveTopicKey = (topic) => {
+      const t = topic.trim().toLowerCase();
+      if (t.length === 0)
+        return null;
+      const keys = Object.keys(KNOWLEDGE_TOPICS);
+      if (keys.includes(t))
+        return t;
+      const hit = keys.find((k) => k.includes(t) || t.includes(k) || KNOWLEDGE_TOPICS[k].title.toLowerCase().includes(t));
+      return hit ?? null;
+    };
+  }
+});
+
+// ../mcp/dist/src/tools/guidance.js
+import { z as z68 } from "zod";
+var guidanceInputSchema, DISCLOSURE6, guidanceHandler;
+var init_guidance = __esm({
+  "../mcp/dist/src/tools/guidance.js"() {
+    "use strict";
+    init_dist();
+    init_knowledge_topics();
+    guidanceInputSchema = z68.object({
+      topic: z68.string().min(1).optional()
+    });
+    DISCLOSURE6 = "General Salesforce best-practice guidance with links to official docs \u2014 NOT specific to this org or its metadata. For org-specific answers, use the vault tools (schema, automation, permissions, impact) or the opt-in live plane.";
+    guidanceHandler = async (ctx, input2) => {
+      const availableTopics = Object.entries(KNOWLEDGE_TOPICS).map(([key2, t]) => ({ key: key2, title: t.title }));
+      const key = input2.topic !== void 0 ? resolveTopicKey(input2.topic) : null;
+      const guidance = key !== null ? KNOWLEDGE_TOPICS[key] ?? null : null;
+      return ok({
+        data: {
+          topic: key,
+          guidance,
+          matched: guidance !== null,
+          availableTopics,
+          disclosure: DISCLOSURE6
+        },
+        vaultState: {
+          sourceTreeHash: ctx.manifest.sourceTreeHash,
+          refreshedAt: ctx.manifest.refreshedAt
+        }
+      });
+    };
+  }
+});
+
 // ../mcp/dist/src/tools/health-check.js
 import { existsSync as existsSync3 } from "node:fs";
 import { stat as stat4 } from "node:fs/promises";
 import { join as join7 } from "node:path";
-import { z as z68 } from "zod";
+import { z as z69 } from "zod";
 var SKIPPED_FILES_DEGRADED_THRESHOLD, healthCheckInputSchema, probeGraph, probeSourceHash, probeRenderComplete, healthCheckHandler;
 var init_health_check = __esm({
   "../mcp/dist/src/tools/health-check.js"() {
@@ -17467,7 +17860,7 @@ var init_health_check = __esm({
     init_src();
     init_src2();
     SKIPPED_FILES_DEGRADED_THRESHOLD = 100;
-    healthCheckInputSchema = z68.object({});
+    healthCheckInputSchema = z69.object({});
     probeGraph = async (ctx) => {
       try {
         const result = await listNodesByType(ctx.graph, "CustomObject", { limit: 1 });
@@ -17587,7 +17980,7 @@ var init_health_check = __esm({
 // ../mcp/dist/src/tools/integration-procedure-chain.js
 import { readFile as readFile10 } from "node:fs/promises";
 import { XMLParser as XMLParser3, XMLValidator as XMLValidator3 } from "fast-xml-parser";
-import { z as z69 } from "zod";
+import { z as z70 } from "zod";
 var IP_PREFIX, DATA_TRANSFORM_PREFIX, ROOT_ELEMENT3, DATARAPTOR_ACTION_TYPES, REST_ACTION_TYPE, NESTED_IP_ACTION_TYPE, REMOTE_ACTION_TYPE, RESPONSE_ACTION_TYPE, NATIVE_VS_VLOCITY_DISCLOSURE2, APEX_COUPLING_DEFERRAL_DISCLOSURE, RECORD_LEVEL_BOUNDARY_DISCLOSURE, REST_REACHABILITY_DISCLOSURE, integrationProcedureChainInputSchema, unwrapSingle3, toArray3, coerceBoolean2, coerceNumber, nonEmptyString, parsePropertySetConfig, BOUNDARIES_VERBATIM, integrationProcedureChainHandler, walkActions, resolveExternalEndpoints, readNodeStringProperty, readNodeNumberProperty, readNodeBooleanProperty;
 var init_integration_procedure_chain = __esm({
   "../mcp/dist/src/tools/integration-procedure-chain.js"() {
@@ -17611,9 +18004,9 @@ var init_integration_procedure_chain = __esm({
     APEX_COUPLING_DEFERRAL_DISCLOSURE = "v3.2 captures OmniStudio components and intra-OmniStudio call chains (`dispatchesOmniAction`). The Apex-to-OmniProcess coupling (`implements omnistudio.VlocityOpenInterface` etc.) is a v3.3 follow-up \u2014 those edges are NOT yet in the graph.";
     RECORD_LEVEL_BOUNDARY_DISCLOSURE = "v3.2 walks the OmniScript / IP / Card metadata XML. The actual user-entered data and runtime state lives in OmniProcessElement and related SObject records; that is record-level data, out of scope for v0.1's read-the-metadata posture.";
     REST_REACHABILITY_DISCLOSURE = "REST endpoint URLs are surfaced with `parsed` confidence (from the propertySetConfig JSON blob); v3.2 does NOT probe the URL, verify the endpoint is reachable, or resolve the Named Credential against live state.";
-    integrationProcedureChainInputSchema = z69.object({
-      integrationProcedureId: z69.string().min(1),
-      includeChildPropertySetConfig: z69.boolean().optional()
+    integrationProcedureChainInputSchema = z70.object({
+      integrationProcedureId: z70.string().min(1),
+      includeChildPropertySetConfig: z70.boolean().optional()
     });
     unwrapSingle3 = (value) => Array.isArray(value) ? value[0] : value;
     toArray3 = (value) => {
@@ -17915,7 +18308,7 @@ var init_integration_procedure_chain = __esm({
 });
 
 // ../mcp/dist/src/tools/last-modified.js
-import { z as z70 } from "zod";
+import { z as z71 } from "zod";
 var LAST_MODIFIED_UNENRICHED_DISCLOSURE, LAST_MODIFIED_ENRICHED_DISCLOSURE, lastModifiedInputSchema, extractLastModifiedDate2, extractLastModifiedBy2, extractApiVersion, lastModifiedHandler;
 var init_last_modified = __esm({
   "../mcp/dist/src/tools/last-modified.js"() {
@@ -17924,8 +18317,8 @@ var init_last_modified = __esm({
     init_src();
     LAST_MODIFIED_UNENRICHED_DISCLOSURE = "v1.7 Tooling API enrichment has not run for this vault. Run `sfi refresh --with-tooling-api --target-org <alias>` to populate lastModifiedDate / lastModifiedBy / apiVersion for the enriched types.";
     LAST_MODIFIED_ENRICHED_DISCLOSURE = "Freshness fields populated. lastModifiedDate / lastModifiedBy reflect the Tooling API at enrichment time (or the DX-source extractor when the type carries a `<lastModifiedDate>` element).";
-    lastModifiedInputSchema = z70.object({
-      componentId: z70.string().min(1)
+    lastModifiedInputSchema = z71.object({
+      componentId: z71.string().min(1)
     });
     extractLastModifiedDate2 = (legacy, properties) => {
       const propsValue = properties["lastModifiedDate"];
@@ -18001,17 +18394,17 @@ var init_last_modified = __esm({
 });
 
 // ../mcp/dist/src/tools/layout-for-user.js
-import { z as z71 } from "zod";
+import { z as z72 } from "zod";
 var layoutForUserInputSchema, step, evaluateProfileLookup, readLayoutAssignments, layoutTargetsObject, canonicaliseLayoutId, findLayoutAssignment, pickFlexiPageForObject, evaluateLightningPageLookup, layoutForUserHandler;
 var init_layout_for_user = __esm({
   "../mcp/dist/src/tools/layout-for-user.js"() {
     "use strict";
     init_dist();
     init_src();
-    layoutForUserInputSchema = z71.object({
-      objectApiName: z71.string().min(1),
-      recordTypeId: z71.string().min(1).optional(),
-      profileId: z71.string().min(1)
+    layoutForUserInputSchema = z72.object({
+      objectApiName: z72.string().min(1),
+      recordTypeId: z72.string().min(1).optional(),
+      profileId: z72.string().min(1)
     });
     step = (stage, verdict, reason, value) => value === void 0 ? { stage, verdict, reason } : { stage, verdict, reason, value };
     evaluateProfileLookup = async (ctx, profileId) => {
@@ -18229,7 +18622,7 @@ var init_layout_for_user = __esm({
 });
 
 // ../mcp/dist/src/tools/list-components.js
-import { z as z72 } from "zod";
+import { z as z73 } from "zod";
 var COMPONENT_TYPES2, LIST_MAX_LIMIT2, LIST_DEFAULT_LIMIT2, LIST_PAYLOAD_BUDGET_BYTES, fitNodesToBudget, listComponentsInputSchema, listComponentsHandler;
 var init_list_components = __esm({
   "../mcp/dist/src/tools/list-components.js"() {
@@ -18338,11 +18731,11 @@ var init_list_components = __esm({
       }
       return { kept, trimmed: false };
     };
-    listComponentsInputSchema = z72.object({
-      type: z72.enum(COMPONENT_TYPES2).optional(),
-      parentId: z72.string().min(1).optional(),
-      limit: z72.number().int().min(1).max(LIST_MAX_LIMIT2).optional(),
-      offset: z72.number().int().min(0).optional()
+    listComponentsInputSchema = z73.object({
+      type: z73.enum(COMPONENT_TYPES2).optional(),
+      parentId: z73.string().min(1).optional(),
+      limit: z73.number().int().min(1).max(LIST_MAX_LIMIT2).optional(),
+      offset: z73.number().int().min(0).optional()
     });
     listComponentsHandler = async (ctx, input2) => {
       if (input2.type === void 0) {
@@ -18969,7 +19362,7 @@ var init_live_consent = __esm({
 // ../mcp/dist/src/tools/live-plane.js
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { z as z73 } from "zod";
+import { z as z74 } from "zod";
 var nodeExecFile2, redactSecrets, LIVE_PLANE_DISCLOSURE, MAX_SAMPLE_ROWS, liveEnabledSchema, isLivePlaneEnabled, liveTrust, resolveOrg, resolveLiveAccess, liveConsentRequiredError, gateLive, getLiveAuth, runSfJson, apiPath, restGet, liveDescribeInputSchema, liveDescribeHandler, liveCountInputSchema, OBJECT_API_NAME_RE, resolveCountSoql, assertCountSoql, liveCountHandler, liveSampleInputSchema, capSampleSoql, liveSampleHandler, liveFieldPopulationInputSchema, liveFieldPopulationHandler, liveOrgLimitsInputSchema, liveOrgLimitsHandler, MAX_INACTIVE_USER_ROWS, DEFAULT_INACTIVE_DAYS, MS_PER_DAY, liveInactiveUsersInputSchema, soqlDateTime, liveInactiveUsersHandler, DEFAULT_LICENSE_INACTIVE_DAYS, MAX_RECLAIM_ROWS, LICENSE_USAGE_DISCLOSURE, liveLicenseUsageInputSchema, toUtilization, renderLicenseUsageMarkdown, liveLicenseUsageHandler, liveConsentInputSchema, consentTrust, liveConsentHandler, liveQuery, MAX_DETAIL_ROWS, daysAgoSoql, daysSince, livePlaneVaultState, UNAVAILABLE_ERROR, assertSoqlIdentifier, soqlLiteral, MAX_GROUP_BUCKETS, DEFAULT_STALE_DAYS, DEFAULT_RECENT_DAYS, liveGroupCountInputSchema, liveGroupCountHandler, liveStaleRecordsInputSchema, liveStaleRecordsHandler, liveRecentActivityInputSchema, liveRecentActivityHandler, buildEqualityWhere, aggregateCountFromRow, liveAggregateInputSchema, liveAggregateHandler, MAX_DUPLICATE_GROUPS, liveDuplicateCheckInputSchema, liveDuplicateCheckHandler, MAX_OWNER_BUCKETS, liveOwnerBreakdownInputSchema, liveOwnerBreakdownHandler, DEFAULT_REPORT_STALE_DAYS, liveReportUsageInputSchema, liveReportUsageHandler, liveFolderAccessInputSchema, liveFolderAccessHandler, DEFAULT_TEMPLATE_STALE_DAYS, CLASSIC_TEMPLATE_TYPES, liveEmailTemplateUsageInputSchema, liveEmailTemplateUsageHandler, DEFAULT_HEALTH_DAYS, LIMIT_RISK_THRESHOLD, liveOrgHealthInputSchema, liveOrgHealthHandler, liveStorageByObjectInputSchema, liveStorageByObjectHandler, liveDataSkewInputSchema, liveSetupAuditTrailInputSchema, liveSecurityExposureInputSchema;
 var init_live_plane = __esm({
   "../mcp/dist/src/tools/live-plane.js"() {
@@ -18982,8 +19375,8 @@ var init_live_plane = __esm({
     redactSecrets = (message) => message.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/\b00D[A-Za-z0-9]{12,}![A-Za-z0-9._~+/=-]{20,}\b/g, "[REDACTED_TOKEN]");
     LIVE_PLANE_DISCLOSURE = "Live org data is read-only, queried at call time via the Salesforce CLI. It does not update the vault. Enable with SFI_LIVE_PLANE_ENABLED=1 or pass liveEnabled: true.";
     MAX_SAMPLE_ROWS = 200;
-    liveEnabledSchema = z73.object({
-      liveEnabled: z73.boolean().optional()
+    liveEnabledSchema = z74.object({
+      liveEnabled: z74.boolean().optional()
     });
     isLivePlaneEnabled = (input2) => {
       if (input2 === true)
@@ -19061,8 +19454,8 @@ var init_live_plane = __esm({
       }
     };
     liveDescribeInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      orgAlias: z74.string().min(1).optional()
     });
     liveDescribeHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19090,9 +19483,9 @@ var init_live_plane = __esm({
       // Either `soql` (a SELECT COUNT() query) OR `objectApiName` (count every row
       // of that object). Both optional at the schema level; the handler requires
       // exactly one and turns objectApiName into `SELECT COUNT() FROM <object>`.
-      soql: z73.string().min(1).optional(),
-      objectApiName: z73.string().min(1).optional(),
-      orgAlias: z73.string().min(1).optional()
+      soql: z74.string().min(1).optional(),
+      objectApiName: z74.string().min(1).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     OBJECT_API_NAME_RE = /^[A-Za-z][A-Za-z0-9_]*$/;
     resolveCountSoql = (input2) => {
@@ -19156,9 +19549,9 @@ var init_live_plane = __esm({
       });
     };
     liveSampleInputSchema = liveEnabledSchema.extend({
-      soql: z73.string().min(1),
-      limit: z73.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      soql: z74.string().min(1),
+      limit: z74.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     capSampleSoql = (soql, limit) => {
       const trimmed = soql.trim().replace(/;\s*$/, "");
@@ -19195,9 +19588,9 @@ var init_live_plane = __esm({
       });
     };
     liveFieldPopulationInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      fieldApiName: z73.string().min(1),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      fieldApiName: z74.string().min(1),
+      orgAlias: z74.string().min(1).optional()
     });
     liveFieldPopulationHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19243,7 +19636,7 @@ var init_live_plane = __esm({
       });
     };
     liveOrgLimitsInputSchema = liveEnabledSchema.extend({
-      orgAlias: z73.string().min(1).optional()
+      orgAlias: z74.string().min(1).optional()
     });
     liveOrgLimitsHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19274,14 +19667,14 @@ var init_live_plane = __esm({
     liveInactiveUsersInputSchema = liveEnabledSchema.extend({
       /** Inactivity threshold in days (default 30). A user is "inactive" if their
        *  last login is older than this — or they have never logged in. */
-      days: z73.number().int().min(1).max(3650).optional(),
+      days: z74.number().int().min(1).max(3650).optional(),
       /** Include non-Standard user types (integration/system/etc.). Default false
        *  → only human (Standard) users, the usual intent of "who hasn't logged in". */
-      includeAllUserTypes: z73.boolean().optional(),
+      includeAllUserTypes: z74.boolean().optional(),
       /** Max detail rows returned (default + hard cap 500). The TOTAL count is
        *  always reported separately, so a capped list never understates the count. */
-      limit: z73.number().int().min(1).max(MAX_INACTIVE_USER_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      limit: z74.number().int().min(1).max(MAX_INACTIVE_USER_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     soqlDateTime = (d) => d.toISOString().replace(/\.\d{3}Z$/, "Z");
     liveInactiveUsersHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
@@ -19347,10 +19740,10 @@ var init_live_plane = __esm({
     LICENSE_USAGE_DISCLOSURE = 'License counts are live UserLicense / PermissionSetLicense state. "Reclaimable seats" is a PROXY \u2014 it groups active users who have not logged in within the window by their license; it does NOT measure actual feature usage, and some dormant seats are held intentionally (seasonal staff, service/integration accounts mis-typed as Standard, compliance holds). Per-feature-license usage (Marketing User, Knowledge User, etc.) is NOT covered. This tool is READ-ONLY: it never deprovisions or reassigns a license \u2014 verify each seat before reclaiming it.';
     liveLicenseUsageInputSchema = liveEnabledSchema.extend({
       /** Dormancy window for reclaimable seats, in days (default 90). */
-      inactiveDays: z73.number().int().min(1).max(3650).optional(),
+      inactiveDays: z74.number().int().min(1).max(3650).optional(),
       /** Max reclaimable-seat groups returned (default + hard cap 200). */
-      limit: z73.number().int().min(1).max(MAX_RECLAIM_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      limit: z74.number().int().min(1).max(MAX_RECLAIM_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     toUtilization = (rows, nameKey) => rows.map((r) => {
       const total = Number(r.TotalLicenses ?? 0);
@@ -19438,13 +19831,13 @@ var init_live_plane = __esm({
         }
       });
     };
-    liveConsentInputSchema = z73.object({
+    liveConsentInputSchema = z74.object({
       /** Org alias/username; defaults to the vault's source org. */
-      orgAlias: z73.string().min(1).optional(),
+      orgAlias: z74.string().min(1).optional(),
       /** Grant standing consent for the org (persists across sessions). */
-      grant: z73.boolean().optional(),
+      grant: z74.boolean().optional(),
       /** Revoke standing consent for the org. */
-      revoke: z73.boolean().optional()
+      revoke: z74.boolean().optional()
     });
     consentTrust = () => ({
       provenance: "offline_snapshot",
@@ -19531,12 +19924,12 @@ var init_live_plane = __esm({
     DEFAULT_STALE_DAYS = 90;
     DEFAULT_RECENT_DAYS = 7;
     liveGroupCountInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      groupByField: z73.string().min(1),
-      limit: z73.number().int().min(1).max(MAX_GROUP_BUCKETS).optional(),
-      filterField: z73.string().min(1).optional(),
-      filterValue: z73.union([z73.string(), z73.number(), z73.boolean()]).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      groupByField: z74.string().min(1),
+      limit: z74.number().int().min(1).max(MAX_GROUP_BUCKETS).optional(),
+      filterField: z74.string().min(1).optional(),
+      filterValue: z74.union([z74.string(), z74.number(), z74.boolean()]).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveGroupCountHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19604,12 +19997,12 @@ ${renderTrustFooter(trust)}`;
       });
     };
     liveStaleRecordsInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      staleDays: z73.number().int().min(1).max(3650).optional(),
-      dateField: z73.string().min(1).optional(),
-      includeNeverSet: z73.boolean().optional(),
-      limit: z73.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      staleDays: z74.number().int().min(1).max(3650).optional(),
+      dateField: z74.string().min(1).optional(),
+      includeNeverSet: z74.boolean().optional(),
+      limit: z74.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveStaleRecordsHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19671,11 +20064,11 @@ ${renderTrustFooter(trust)}`;
       });
     };
     liveRecentActivityInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      days: z73.number().int().min(1).max(365).optional(),
-      activity: z73.enum(["created", "modified", "both"]).optional(),
-      limit: z73.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      days: z74.number().int().min(1).max(365).optional(),
+      activity: z74.enum(["created", "modified", "both"]).optional(),
+      limit: z74.number().int().min(1).max(MAX_SAMPLE_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveRecentActivityHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19753,11 +20146,11 @@ ${renderTrustFooter(trust)}`;
       return 0;
     };
     liveAggregateInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      fieldApiName: z73.string().min(1),
-      filterField: z73.string().min(1).optional(),
-      filterValue: z73.union([z73.string(), z73.number(), z73.boolean()]).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      fieldApiName: z74.string().min(1),
+      filterField: z74.string().min(1).optional(),
+      filterValue: z74.union([z74.string(), z74.number(), z74.boolean()]).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveAggregateHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19817,12 +20210,12 @@ ${renderTrustFooter(trust)}`;
     };
     MAX_DUPLICATE_GROUPS = 100;
     liveDuplicateCheckInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      fieldApiName: z73.string().min(1),
-      limit: z73.number().int().min(1).max(MAX_DUPLICATE_GROUPS).optional(),
-      filterField: z73.string().min(1).optional(),
-      filterValue: z73.union([z73.string(), z73.number(), z73.boolean()]).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      fieldApiName: z74.string().min(1),
+      limit: z74.number().int().min(1).max(MAX_DUPLICATE_GROUPS).optional(),
+      filterField: z74.string().min(1).optional(),
+      filterValue: z74.union([z74.string(), z74.number(), z74.boolean()]).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveDuplicateCheckHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19881,11 +20274,11 @@ ${renderTrustFooter(trust)}`;
     };
     MAX_OWNER_BUCKETS = 100;
     liveOwnerBreakdownInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      limit: z73.number().int().min(1).max(MAX_OWNER_BUCKETS).optional(),
-      filterField: z73.string().min(1).optional(),
-      filterValue: z73.union([z73.string(), z73.number(), z73.boolean()]).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      limit: z74.number().int().min(1).max(MAX_OWNER_BUCKETS).optional(),
+      filterField: z74.string().min(1).optional(),
+      filterValue: z74.union([z74.string(), z74.number(), z74.boolean()]).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveOwnerBreakdownHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -19962,9 +20355,9 @@ ${renderTrustFooter(trust)}`;
     };
     DEFAULT_REPORT_STALE_DAYS = 90;
     liveReportUsageInputSchema = liveEnabledSchema.extend({
-      staleDays: z73.number().int().min(1).max(3650).optional(),
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      staleDays: z74.number().int().min(1).max(3650).optional(),
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveReportUsageHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -20016,9 +20409,9 @@ ${renderTrustFooter(trust)}`;
       });
     };
     liveFolderAccessInputSchema = liveEnabledSchema.extend({
-      folderType: z73.enum(["Report", "Dashboard", "Email", "Document", "all"]).optional(),
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      folderType: z74.enum(["Report", "Dashboard", "Email", "Document", "all"]).optional(),
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveFolderAccessHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -20073,9 +20466,9 @@ ${renderTrustFooter(trust)}`;
     DEFAULT_TEMPLATE_STALE_DAYS = 180;
     CLASSIC_TEMPLATE_TYPES = /* @__PURE__ */ new Set(["text", "html", "custom", "visualforce"]);
     liveEmailTemplateUsageInputSchema = liveEnabledSchema.extend({
-      staleDays: z73.number().int().min(1).max(3650).optional(),
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      staleDays: z74.number().int().min(1).max(3650).optional(),
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveEmailTemplateUsageHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -20140,8 +20533,8 @@ ${renderTrustFooter(trust)}`;
     DEFAULT_HEALTH_DAYS = 7;
     LIMIT_RISK_THRESHOLD = 0.8;
     liveOrgHealthInputSchema = liveEnabledSchema.extend({
-      days: z73.number().int().min(1).max(90).optional(),
-      orgAlias: z73.string().min(1).optional()
+      days: z74.number().int().min(1).max(90).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveOrgHealthHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -20208,9 +20601,9 @@ ${renderTrustFooter(trust)}`;
       });
     };
     liveStorageByObjectInputSchema = liveEnabledSchema.extend({
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      objectApiNames: z73.array(z73.string().min(1)).max(80).optional(),
-      orgAlias: z73.string().min(1).optional()
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      objectApiNames: z74.array(z74.string().min(1)).max(80).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveStorageByObjectHandler = async (ctx, input2, exec4 = nodeExecFile2) => {
       const gate = await gateLive(ctx, input2);
@@ -20253,25 +20646,25 @@ ${renderTrustFooter(trust)}`;
       });
     };
     liveDataSkewInputSchema = liveEnabledSchema.extend({
-      objectApiName: z73.string().min(1),
-      ownerField: z73.string().min(1).optional(),
-      threshold: z73.number().int().min(1).optional(),
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      objectApiName: z74.string().min(1),
+      ownerField: z74.string().min(1).optional(),
+      threshold: z74.number().int().min(1).optional(),
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveSetupAuditTrailInputSchema = liveEnabledSchema.extend({
-      days: z73.number().int().min(1).max(180).optional(),
-      limit: z73.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
-      orgAlias: z73.string().min(1).optional()
+      days: z74.number().int().min(1).max(180).optional(),
+      limit: z74.number().int().min(1).max(MAX_DETAIL_ROWS).optional(),
+      orgAlias: z74.string().min(1).optional()
     });
     liveSecurityExposureInputSchema = liveEnabledSchema.extend({
-      orgAlias: z73.string().min(1).optional()
+      orgAlias: z74.string().min(1).optional()
     });
   }
 });
 
 // ../mcp/dist/src/tools/live-drift-check.js
-import { z as z74 } from "zod";
+import { z as z75 } from "zod";
 var FIELD_PAGE_SIZE2, liveDriftCheckInputSchema, BOUNDARIES8, isCustomField2, diffFields, liveFieldNames, liveDriftCheckHandler;
 var init_live_drift_check = __esm({
   "../mcp/dist/src/tools/live-drift-check.js"() {
@@ -20280,11 +20673,11 @@ var init_live_drift_check = __esm({
     init_src();
     init_live_plane();
     FIELD_PAGE_SIZE2 = 500;
-    liveDriftCheckInputSchema = z74.object({
-      objectApiName: z74.string().min(1),
-      orgAlias: z74.string().min(1).optional(),
+    liveDriftCheckInputSchema = z75.object({
+      objectApiName: z75.string().min(1),
+      orgAlias: z75.string().min(1).optional(),
       /** Opt-in to the live plane (mirrors the other live_* tools). */
-      liveEnabled: z74.boolean().optional()
+      liveEnabled: z75.boolean().optional()
     });
     BOUNDARIES8 = Object.freeze([
       "Compares the offline snapshot to a LIVE read-only describe; requires the live plane (SFI_LIVE_PLANE_ENABLED or liveEnabled:true). Does not mutate the org.",
@@ -20352,7 +20745,7 @@ var init_live_drift_check = __esm({
 });
 
 // ../mcp/dist/src/tools/lookup-record.js
-import { z as z75 } from "zod";
+import { z as z76 } from "zod";
 var RECORD_NODE_TYPES, CUSTOM_METADATA_RECORD_PREFIX, CUSTOM_SETTING_RECORD_PREFIX, lookupRecordInputSchema, classifyRecordId, normalizeValueEntry, readRecordValues, readTypeApiName, lookupRecordHandler;
 var init_lookup_record = __esm({
   "../mcp/dist/src/tools/lookup-record.js"() {
@@ -20365,8 +20758,8 @@ var init_lookup_record = __esm({
     ]);
     CUSTOM_METADATA_RECORD_PREFIX = "CustomMetadataRecord:";
     CUSTOM_SETTING_RECORD_PREFIX = "CustomSettingRecord:";
-    lookupRecordInputSchema = z75.object({
-      recordId: z75.string().min(1)
+    lookupRecordInputSchema = z76.object({
+      recordId: z76.string().min(1)
     });
     classifyRecordId = (recordId) => {
       if (recordId.startsWith(CUSTOM_METADATA_RECORD_PREFIX)) {
@@ -20459,14 +20852,14 @@ var init_lookup_record = __esm({
 });
 
 // ../mcp/dist/src/tools/manifest.js
-import { z as z76 } from "zod";
+import { z as z77 } from "zod";
 var getManifestInputSchema, getManifestHandler;
 var init_manifest2 = __esm({
   "../mcp/dist/src/tools/manifest.js"() {
     "use strict";
     init_dist();
     init_src2();
-    getManifestInputSchema = z76.object({});
+    getManifestInputSchema = z77.object({});
     getManifestHandler = async (ctx, _input) => {
       const data = {
         ...ctx.manifest,
@@ -20484,7 +20877,7 @@ var init_manifest2 = __esm({
 });
 
 // ../mcp/dist/src/tools/meaningful-test-audit.js
-import { z as z77 } from "zod";
+import { z as z78 } from "zod";
 var LIST_PAGE_SIZE8, APEX_CLASS_PREFIX5, MEANINGFUL_TEST_DISCLOSURE, meaningfulTestAuditInputSchema, isTestClass3, readNonNegativeInt, collectFakeAssertions, buildEntry, compareEntries2, meaningfulTestAuditHandler;
 var init_meaningful_test_audit = __esm({
   "../mcp/dist/src/tools/meaningful-test-audit.js"() {
@@ -20494,8 +20887,8 @@ var init_meaningful_test_audit = __esm({
     LIST_PAGE_SIZE8 = 500;
     APEX_CLASS_PREFIX5 = "ApexClass:";
     MEANINGFUL_TEST_DISCLOSURE = "v2.7 meaningful_test_audit ranks test classes by the v2.1 R2 fake-assertion recognizer output and an assertions-per-KB density heuristic. The recognizer matches System.assert* invocations against literal tokens; assertions via helper methods (MyTestHelper.assertField) and framework wrappers are invisible. A test class with a high fakeAssertionCount may have meaningful tests via a custom assertion helper the recognizer cannot see. When qualityIssues is absent the v2.1 R2 pass has not run for this vault; entries surface with fakeAssertionCount: 0 and the rank is driven by density alone.";
-    meaningfulTestAuditInputSchema = z77.object({
-      classFilter: z77.array(z77.string().min(1)).max(LIST_PAGE_SIZE8).optional()
+    meaningfulTestAuditInputSchema = z78.object({
+      classFilter: z78.array(z78.string().min(1)).max(LIST_PAGE_SIZE8).optional()
     });
     isTestClass3 = (node) => node.properties["isTest"] === true;
     readNonNegativeInt = (node, key) => {
@@ -20600,7 +20993,7 @@ var init_meaningful_test_audit = __esm({
 });
 
 // ../mcp/dist/src/tools/method-reachability.js
-import { z as z78 } from "zod";
+import { z as z79 } from "zod";
 var REACHABILITY_BFS_DEPTH, APEX_CLASS_PREFIX6, APEX_TRIGGER_PREFIX4, REACHABILITY_DISCLOSURE, methodReachabilityInputSchema, isApexCallable3, isTestClass4, entryKindsFor, upstreamWalk, compareEntryHits, compareReachingTests, methodReachabilityHandler;
 var init_method_reachability = __esm({
   "../mcp/dist/src/tools/method-reachability.js"() {
@@ -20612,8 +21005,8 @@ var init_method_reachability = __esm({
     APEX_CLASS_PREFIX6 = "ApexClass:";
     APEX_TRIGGER_PREFIX4 = "ApexTrigger:";
     REACHABILITY_DISCLOSURE = "v2.7 method_reachability ships CLASS granularity (method-level promised in v2.7.1). Dynamic dispatch (Type.forName) and reflective invocation are invisible \u2014 a class genuinely invoked at runtime via reflection or framework wiring will surface as likely-dead-code. Trigger framework base classes (TriggerHandler, fflib) may be partially invisible. BFS is capped at depth 3.";
-    methodReachabilityInputSchema = z78.object({
-      classApiName: z78.string().min(1)
+    methodReachabilityInputSchema = z79.object({
+      classApiName: z79.string().min(1)
     });
     isApexCallable3 = (id) => id.startsWith(APEX_CLASS_PREFIX6) || id.startsWith(APEX_TRIGGER_PREFIX4);
     isTestClass4 = (node) => node.properties["isTest"] === true;
@@ -20753,15 +21146,15 @@ var init_method_reachability = __esm({
 });
 
 // ../mcp/dist/src/tools/naming-convention-report.js
-import { z as z79 } from "zod";
+import { z as z80 } from "zod";
 var namingConventionReportInputSchema, namingConventionReportHandler;
 var init_naming_convention_report = __esm({
   "../mcp/dist/src/tools/naming-convention-report.js"() {
     "use strict";
     init_dist();
     init_src4();
-    namingConventionReportInputSchema = z79.object({
-      scope: z79.string().min(1).optional()
+    namingConventionReportInputSchema = z80.object({
+      scope: z80.string().min(1).optional()
     });
     namingConventionReportHandler = async (ctx, input2) => {
       const result = await recognizeNamingConventions(ctx.graph, input2.scope !== void 0 ? { scope: input2.scope } : {});
@@ -20791,7 +21184,7 @@ var init_naming_convention_report = __esm({
 // ../mcp/dist/src/tools/omniscript-flow.js
 import { readFile as readFile12 } from "node:fs/promises";
 import { XMLParser as XMLParser4 } from "fast-xml-parser";
-import { z as z80 } from "zod";
+import { z as z81 } from "zod";
 var OMNISCRIPT_PREFIX, DISPATCH_EDGE_TYPE, NATIVE_VS_VLOCITY_DISCLOSURE3, RECORD_LEVEL_DISCLOSURE, APEX_COUPLING_DEFERRAL_DISCLOSURE2, omniscriptFlowInputSchema, isOmniScriptId, unwrapSingle4, toArray4, toNullableString, coerceBoolean3, toNullableNumber, parsePropertySetConfig2, walkElements, readSteps, readStringProp, readNumberProp, readBoolProp, compareDispatched, omniscriptFlowHandler;
 var init_omniscript_flow = __esm({
   "../mcp/dist/src/tools/omniscript-flow.js"() {
@@ -20804,9 +21197,9 @@ var init_omniscript_flow = __esm({
     NATIVE_VS_VLOCITY_DISCLOSURE3 = "v3.2 recognizes Industries Native XML shapes (file extensions `.os-meta.xml`, `.oip-meta.xml`, `.rpt-meta.xml`, `.ouc-meta.xml`, `.decisionTable-meta.xml`). Legacy Vlocity-managed-package components (namespace `vlocity_cmt__`) are NOT extracted by v3.2. Mid-migration orgs may show partial coverage.";
     RECORD_LEVEL_DISCLOSURE = "v3.2 walks the OmniScript / IP / Card metadata XML. The actual user-entered data and runtime state lives in OmniProcessElement and related SObject records; that is record-level data, out of scope for v0.1's read-the-metadata posture.";
     APEX_COUPLING_DEFERRAL_DISCLOSURE2 = "v3.2 captures OmniStudio components and intra-OmniStudio call chains (`dispatchesOmniAction`). The Apex-to-OmniProcess coupling (`implements omnistudio.VlocityOpenInterface` etc.) is a v3.3 follow-up \u2014 those edges are NOT yet in the graph.";
-    omniscriptFlowInputSchema = z80.object({
-      omniScriptId: z80.string().min(1),
-      includeChildPropertySetConfig: z80.boolean().optional()
+    omniscriptFlowInputSchema = z81.object({
+      omniScriptId: z81.string().min(1),
+      includeChildPropertySetConfig: z81.boolean().optional()
     });
     isOmniScriptId = (id) => id.startsWith(OMNISCRIPT_PREFIX);
     unwrapSingle4 = (value) => Array.isArray(value) ? value[0] : value;
@@ -21053,7 +21446,7 @@ var init_omniscript_flow = __esm({
 // ../mcp/dist/src/tools/omniuicard-widget-breakdown.js
 import { readFile as readFile13 } from "node:fs/promises";
 import { XMLParser as XMLParser5, XMLValidator as XMLValidator4 } from "fast-xml-parser";
-import { z as z81 } from "zod";
+import { z as z82 } from "zod";
 var OMNI_UI_CARD_PREFIX, ROOT_ELEMENT4, PROPERTY_SET_CONFIG_PARSING_DISCLOSURE, NATIVE_VS_VLOCITY_DISCLOSURE4, omniuicardWidgetBreakdownInputSchema, unwrapSingle5, parseJsonBlob, walkWidgets, countWidgets, buildStates, readStringArrayProperty, readNullableStringProperty, readNullableNumberProperty, readBooleanProperty2, projectDispatchedAction, sortDispatchedActions, buildStatesFromSourceXml, omniuicardWidgetBreakdownHandler;
 var init_omniuicard_widget_breakdown = __esm({
   "../mcp/dist/src/tools/omniuicard-widget-breakdown.js"() {
@@ -21065,8 +21458,8 @@ var init_omniuicard_widget_breakdown = __esm({
     ROOT_ELEMENT4 = "OmniUiCard";
     PROPERTY_SET_CONFIG_PARSING_DISCLOSURE = "widget breakdown parses the propertySetConfig JSON blob. FlexCard authors can edit the raw blob in the OmniStudio designer; widget order in the breakdown follows the JSON's declared order, not the visual designer's drag-drop order.";
     NATIVE_VS_VLOCITY_DISCLOSURE4 = "v3.2 recognizes Industries Native XML shapes (file extensions `.os-meta.xml`, `.oip-meta.xml`, `.rpt-meta.xml`, `.ouc-meta.xml`, `.decisionTable-meta.xml`). Legacy Vlocity-managed-package components (namespace `vlocity_cmt__`) are NOT extracted by v3.2. Mid-migration orgs may show partial coverage.";
-    omniuicardWidgetBreakdownInputSchema = z81.object({
-      omniUiCardId: z81.string().min(1)
+    omniuicardWidgetBreakdownInputSchema = z82.object({
+      omniUiCardId: z82.string().min(1)
     });
     unwrapSingle5 = (value) => Array.isArray(value) ? value[0] : value;
     parseJsonBlob = (raw) => {
@@ -21476,8 +21869,8 @@ var init_soe_payload_bounds = __esm({
 });
 
 // ../mcp/dist/src/tools/order-of-execution.js
-import { z as z82 } from "zod";
-var DISCLOSURE6, SOE_EVENTS, orderOfExecutionInputSchema, workflowMatchesEvent, flowMatchesEvent, triggerMatchesEvent, surfaceFirstCondition, buildActions, buildStep, fetchParentedFirers, fetchTriggersOnFirers, buildAsyncSteps, ASSIGNMENT_TYPES, APPROVAL_TYPES, VALIDATION_TYPES, FLOW_TYPES, TRIGGER_TYPES, WORKFLOW_TYPES, composeForEvent, orderOfExecutionHandler;
+import { z as z83 } from "zod";
+var DISCLOSURE7, SOE_EVENTS, orderOfExecutionInputSchema, workflowMatchesEvent, flowMatchesEvent, triggerMatchesEvent, surfaceFirstCondition, buildActions, buildStep, fetchParentedFirers, fetchTriggersOnFirers, buildAsyncSteps, ASSIGNMENT_TYPES, APPROVAL_TYPES, VALIDATION_TYPES, FLOW_TYPES, TRIGGER_TYPES, WORKFLOW_TYPES, composeForEvent, orderOfExecutionHandler;
 var init_order_of_execution = __esm({
   "../mcp/dist/src/tools/order-of-execution.js"() {
     "use strict";
@@ -21485,10 +21878,10 @@ var init_order_of_execution = __esm({
     init_src();
     init_soe_admission();
     init_soe_payload_bounds();
-    DISCLOSURE6 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
+    DISCLOSURE7 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
     SOE_EVENTS = ["insert", "update", "delete", "undelete"];
-    orderOfExecutionInputSchema = z82.object({
-      objectApiName: z82.string().min(1)
+    orderOfExecutionInputSchema = z83.object({
+      objectApiName: z83.string().min(1)
     });
     workflowMatchesEvent = (triggerType, event) => {
       if (typeof triggerType !== "string")
@@ -21836,7 +22229,7 @@ var init_order_of_execution = __esm({
         objectApiName: input2.objectApiName,
         objectModeled,
         byEvent,
-        disclosure: composeSoeDisclosure(DISCLOSURE6, objectModeled)
+        disclosure: composeSoeDisclosure(DISCLOSURE7, objectModeled)
       };
       const containers = SOE_EVENTS.map((event) => byEvent[event].soe);
       const budget = enforceSoeByteBudget(data, containers);
@@ -21856,7 +22249,7 @@ var init_order_of_execution = __esm({
 });
 
 // ../mcp/dist/src/tools/org-history.js
-import { z as z83 } from "zod";
+import { z as z84 } from "zod";
 var DEFAULT_LIMIT8, MAX_LIMIT9, orgHistoryInputSchema, BOUNDARIES9, orgHistoryHandler;
 var init_org_history = __esm({
   "../mcp/dist/src/tools/org-history.js"() {
@@ -21865,8 +22258,8 @@ var init_org_history = __esm({
     init_history_store();
     DEFAULT_LIMIT8 = 50;
     MAX_LIMIT9 = 500;
-    orgHistoryInputSchema = z83.object({
-      limit: z83.number().int().min(1).max(MAX_LIMIT9).optional()
+    orgHistoryInputSchema = z84.object({
+      limit: z84.number().int().min(1).max(MAX_LIMIT9).optional()
     });
     BOUNDARIES9 = Object.freeze([
       "History only covers refreshes performed since the continuous-learning store shipped; older or single-refresh vaults yield a short/empty timeline.",
@@ -21897,7 +22290,7 @@ var init_org_history = __esm({
 });
 
 // ../mcp/dist/src/tools/org-pulse.js
-import { z as z84 } from "zod";
+import { z as z85 } from "zod";
 var DEFAULT_LIMIT9, MAX_LIMIT10, orgPulseInputSchema, ORG_PULSE_DISCLOSURE, orgPulseHandler;
 var init_org_pulse = __esm({
   "../mcp/dist/src/tools/org-pulse.js"() {
@@ -21906,8 +22299,8 @@ var init_org_pulse = __esm({
     init_src();
     DEFAULT_LIMIT9 = 10;
     MAX_LIMIT10 = 50;
-    orgPulseInputSchema = z84.object({
-      limit: z84.number().int().min(1).max(MAX_LIMIT10).optional()
+    orgPulseInputSchema = z85.object({
+      limit: z85.number().int().min(1).max(MAX_LIMIT10).optional()
     });
     ORG_PULSE_DISCLOSURE = "Freshness and contributor signals come from each component's lastModifiedDate / lastModifiedBy. A plain `sf project retrieve` does NOT populate those \u2014 they need a refresh enriched via the Tooling API. If coverage is ~0% and the contributor list is empty, that means the data was not captured at refresh time, NOT that the org has no history. Run a tooling-API-enabled refresh to populate it.";
     orgPulseHandler = async (ctx, input2) => {
@@ -21942,7 +22335,7 @@ var init_org_pulse = __esm({
 });
 
 // ../mcp/dist/src/tools/outbound-message-catalog.js
-import { z as z85 } from "zod";
+import { z as z86 } from "zod";
 var OUTBOUND_MESSAGE_CATALOG_MAX_ENTRIES, outboundMessageCatalogInputSchema, OUTBOUND_MESSAGE_DISCLOSURE, readOptionalString2, readBoolean, readFields, readName, apiNameToObjectKey, collectInvokers, compareEntries3, compareInvokers, outboundMessageCatalogHandler;
 var init_outbound_message_catalog = __esm({
   "../mcp/dist/src/tools/outbound-message-catalog.js"() {
@@ -21950,8 +22343,8 @@ var init_outbound_message_catalog = __esm({
     init_dist();
     init_src();
     OUTBOUND_MESSAGE_CATALOG_MAX_ENTRIES = 500;
-    outboundMessageCatalogInputSchema = z85.object({
-      objectFilter: z85.string().min(1).optional()
+    outboundMessageCatalogInputSchema = z86.object({
+      objectFilter: z86.string().min(1).optional()
     });
     OUTBOUND_MESSAGE_DISCLOSURE = "Endpoint URLs are captured verbatim from the `<outboundMessages><endpointUrl>` element and NOT VALIDATED \u2014 v2.8 does not probe the URL, does not confirm the destination exists, and does not confirm the message is invoked at runtime. Runtime registration via a custom Apex caller or a programmatically-modified workflow rule is invisible to the offline extractor.";
     readOptionalString2 = (properties, key) => {
@@ -22068,7 +22461,7 @@ var init_outbound_message_catalog = __esm({
 });
 
 // ../mcp/dist/src/tools/package-impact.js
-import { z as z86 } from "zod";
+import { z as z87 } from "zod";
 var DEFAULT_LIMIT10, MAX_LIMIT11, INVENTORY_SAMPLE, EDGE_SCAN_CAP, PACKAGE_IMPACT_DISCLOSURE, packageImpactInputSchema, namespaceOf, buildInventory, buildImpact, packageImpactHandler;
 var init_package_impact = __esm({
   "../mcp/dist/src/tools/package-impact.js"() {
@@ -22080,9 +22473,9 @@ var init_package_impact = __esm({
     INVENTORY_SAMPLE = 5;
     EDGE_SCAN_CAP = 2e3;
     PACKAGE_IMPACT_DISCLOSURE = 'package_impact detects managed/namespaced components by API-name prefix: a name is namespaced iff its leaf splits into >= 3 "__"-delimited segments (NS__Object__c). This reliably catches namespaced objects, fields, and custom metadata \u2014 the bulk of what a package adds \u2014 but MISSES managed Apex referenced via dot-notation (NS.ClassName) and namespaced components without a standard suffix. The vault holds only what `sf project retrieve` pulled: a package\u2019s INTERNAL components are usually NOT retrieved, so packageComponentCount reflects what you can SEE, not the package\u2019s full footprint. "no-detected-dependencies" means NO STATIC evidence in retrieved metadata that your components reference this namespace \u2014 it does NOT prove the package is safe to uninstall (dynamic SOQL, Type.forName("NS.X"), merge-field/formula references, and unretrieved metadata are invisible). Always validate an uninstall in a sandbox first.';
-    packageImpactInputSchema = z86.object({
-      namespace: z86.string().min(1).optional(),
-      limit: z86.number().int().min(1).max(MAX_LIMIT11).optional()
+    packageImpactInputSchema = z87.object({
+      namespace: z87.string().min(1).optional(),
+      limit: z87.number().int().min(1).max(MAX_LIMIT11).optional()
     });
     namespaceOf = (idOrName) => {
       const colon = idOrName.indexOf(":");
@@ -22221,7 +22614,7 @@ var init_package_impact = __esm({
 });
 
 // ../mcp/dist/src/tools/process-builder-migration-candidates.js
-import { z as z87 } from "zod";
+import { z as z88 } from "zod";
 var PROCESS_BUILDER_MAX_LIMIT, PROCESS_BUILDER_DEFAULT_LIMIT, LIST_PAGE_SIZE9, PROCESS_BUILDER_RETIREMENT_NOTE, WORKFLOW_RULE_RETIREMENT_NOTE, BOUNDARIES10, processBuilderMigrationCandidatesInputSchema, propertyNumber, propertyBoolean, propertyString2, countOutgoingEdges, classifyProcessBuilder, classifyWorkflowRule, classifyApprovalProcess, migrationNoteForProcessBuilder, migrationNoteForWorkflowRule, migrationNoteForApprovalProcess, complexityRank, compareByComplexity, compareByApiName2, compareByParent, sortFor, processBuilderMigrationCandidatesHandler;
 var init_process_builder_migration_candidates = __esm({
   "../mcp/dist/src/tools/process-builder-migration-candidates.js"() {
@@ -22237,12 +22630,12 @@ var init_process_builder_migration_candidates = __esm({
       "the complexity classification is heuristic based on edge counts and time-trigger presence; complex business logic in a single-decision Process Builder may rank as 'simple' but require manual review for migration.",
       "the migration tool itself (Setup \u2192 Migrate to Flow) does not run here \u2014 this tool produces the inventory and per-rule guidance."
     ]);
-    processBuilderMigrationCandidatesInputSchema = z87.object({
-      includeWorkflowRules: z87.boolean().optional(),
-      includeApprovalProcesses: z87.boolean().optional(),
-      activeOnly: z87.boolean().optional(),
-      sortBy: z87.enum(["complexity", "object", "name"]).optional(),
-      limit: z87.number().int().min(1).max(PROCESS_BUILDER_MAX_LIMIT).optional()
+    processBuilderMigrationCandidatesInputSchema = z88.object({
+      includeWorkflowRules: z88.boolean().optional(),
+      includeApprovalProcesses: z88.boolean().optional(),
+      activeOnly: z88.boolean().optional(),
+      sortBy: z88.enum(["complexity", "object", "name"]).optional(),
+      limit: z88.number().int().min(1).max(PROCESS_BUILDER_MAX_LIMIT).optional()
     });
     propertyNumber = (node, key) => {
       const v = node.properties[key];
@@ -22599,7 +22992,7 @@ var init_clarify = __esm({
 });
 
 // ../mcp/dist/src/tools/resolve.js
-import { z as z88 } from "zod";
+import { z as z89 } from "zod";
 var RESOLVE_MAX_LIMIT, RESOLVE_DISCLOSURE, resolveInputSchema, resolveHandler;
 var init_resolve2 = __esm({
   "../mcp/dist/src/tools/resolve.js"() {
@@ -22610,11 +23003,11 @@ var init_resolve2 = __esm({
     init_clarify();
     RESOLVE_MAX_LIMIT = 50;
     RESOLVE_DISCLOSURE = "These are typo-tolerant, fuzzy-ranked guesses at which component you meant \u2014 heuristic, not declared. disposition 'exact' = one confident match; 'ambiguous' = several plausible candidates, confirm the right one before acting; 'none' = nothing matched confidently (any listed items are weak near-misses). A high score is string similarity, not proof \u2014 verify the candidate's canonical id and label.";
-    resolveInputSchema = z88.object({
-      query: z88.string().min(1),
-      types: z88.array(z88.string()).optional(),
-      parentId: z88.string().min(1).optional(),
-      limit: z88.number().int().min(1).max(RESOLVE_MAX_LIMIT).optional()
+    resolveInputSchema = z89.object({
+      query: z89.string().min(1),
+      types: z89.array(z89.string()).optional(),
+      parentId: z89.string().min(1).optional(),
+      limit: z89.number().int().min(1).max(RESOLVE_MAX_LIMIT).optional()
     });
     resolveHandler = async (ctx, input2) => {
       const result = await resolveComponents(ctx.graph, input2.query, {
@@ -22671,11 +23064,41 @@ var init_resolve2 = __esm({
 import { appendFile, mkdir as mkdir6 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname5, join as join9 } from "node:path";
-var normalize, routeText, RULES, classifyQuestion, gapLogPath, logGapIfAny;
+var normalize, deriveSaveEvent, deriveKnowledgeTopic, routeText, RULES, classifyQuestion, gapLogPath, logGapIfAny;
 var init_intent_router = __esm({
   "../mcp/dist/src/intent-router.js"() {
     "use strict";
     normalize = (q) => q.trim().toLowerCase().replace(/\s+/g, " ");
+    deriveSaveEvent = (q) => {
+      if (/\b(undelet|restor)/.test(q))
+        return "undelete";
+      if (/\b(creat|insert)/.test(q))
+        return "insert";
+      if (/\b(delet|remov)/.test(q))
+        return "delete";
+      return "update";
+    };
+    deriveKnowledgeTopic = (q) => {
+      if (/\b(flow\s+(vs\.?|versus|or)\s+apex|apex\s+(vs\.?|versus|or)\s+flow)\b/.test(q))
+        return "flow-vs-apex";
+      if (/\bwhen\s+(should\s+i|to)\s+use\b.*\bflow\b/.test(q))
+        return "flow-vs-apex";
+      if (/\b(apex\s+)?trigger\s+framework\b/.test(q))
+        return "trigger-framework";
+      if (/\basync(hronous)?\s+apex\b/.test(q) || /\b(future|queueable|batch|schedulable)\b.*\b(vs\.?|versus|when\s+to|which\s+to|each\s+appropriate|options?)\b/.test(q))
+        return "async-apex";
+      if (/\b(sfdx|source[-\s]driven\s+development|scratch\s+orgs?)\b/.test(q))
+        return "sfdx-source-driven-dev";
+      if (/\bunlocked\s+packages?\b/.test(q))
+        return "package-strategy";
+      if (/\bsingle[-\s]org\b.*\bmulti[-\s]org\b/.test(q))
+        return "single-vs-multi-org";
+      if (/\bdata\s+(retention|archiv)/.test(q))
+        return "data-retention-archiving";
+      if (/\b(large\s+data\s+volumes?|\bldv\b)/.test(q))
+        return "large-data-volumes";
+      return void 0;
+    };
     routeText = (question) => {
       const normalized = normalize(question).replace(/\s*\[[^\]]+\]\s*$/, "");
       const stripped = normalized.replace(/^.*?\b(answer this|route this|do not guess|tell me|include|show what|fail closed|flag anything|use the safest|state what)\b[^:]*:\s*/, "");
@@ -22737,7 +23160,10 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "Storage, API usage, and governor headroom are live org telemetry.",
         patterns: [
-          /\b(org|governor)\s+limits?\b/,
+          // "governor limits" → live runtime headroom, BUT not when the question is
+          // about static Apex risk ("governor limit risks in our Apex", "SOQL in
+          // loops") — that's the vault governor-risks scan (NI-7 misroute fix).
+          /\b(org|governor)\s+limits?\b(?!.*\b(risk|apex|loop|soql|dml|static|trigger|class)\b)/,
           /\b(api|daily)\s+(usage|calls?|limit)\b/,
           /\b(data|file)\s+storage\b/,
           /\bhow\s+much\s+(storage|api|data)\b/,
@@ -22771,6 +23197,25 @@ var init_intent_router = __esm({
           /\brecords?\s+by\s+owner\b/
         ]
       },
+      {
+        // METADATA counts are vault, not live. "How many layouts / fields / objects
+        // / profiles / validation rules ... [per X]" was stolen by the live
+        // group-count/record-count rules and misrouted to live GROUP BY (B30.1).
+        // Record counts (accounts, contacts, rows) fall through to the live rules
+        // below. Placed AFTER field-population so "how many fields are populated"
+        // stays hybrid/live.
+        intent: "metadata-count",
+        plane: "vault",
+        tools: ["sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Counting metadata components (layouts, fields, objects, profiles, validation rules, flows, classes, record types, list views) is a vault list_components count \u2014 not live record data.",
+        patterns: [
+          /\bhow\s+many\b.*\b(page\s+layouts?|layouts?|custom\s+objects?|profiles?|permission\s+sets?|validation\s+rules?|flows?|(apex\s+)?classes?|triggers?|record\s+types?|list\s+views?|report\s+types?|record\s+pages?|flexipages?|approval\s+process(es)?|custom\s+settings?|quick\s+actions?|sharing\s+rules?|named\s+credentials?|picklists?)\b/,
+          // fields, but NOT field usage/population (those are unused-fields / field-population)
+          /\bhow\s+many\b.*\b(custom\s+)?fields?\b(?!.*\b(used|populated|filled|actually|unused|empty|blank|set|values?)\b)/
+        ]
+      },
       {
         intent: "group-count",
         plane: "live",
@@ -22958,7 +23403,27 @@ var init_intent_router = __esm({
         patterns: [
           /\b(page\s+)?layouts?\b.*\b(who|access|assigned|profile|sees?|user)\b/,
           /\bwho\s+(sees|has|can)\b.*\blayouts?\b/,
-          /\bwhich\s+layout\b/
+          /\bwhich\s+layout\b/,
+          // "what/which (page) layouts show|contain|have a FIELD" — a field->layout
+          // question (vs the who-sees-layout above) used to fall through (B21).
+          /\b(what|which)\s+(page\s+)?layouts?\b.*\b(show|contain|display|include|have|with|for)\b.*\bfield\b/
+        ]
+      },
+      {
+        // Layout INVENTORY + CONTENTS (vs layout-access's who-sees-which). "How many
+        // layouts exist for X", "what fields / related lists / quick actions are on
+        // the Y layout" used to fall through to generic schema or unrouted (B21.1).
+        intent: "layout-inventory",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Page-layout inventory (how many / which layouts on an object) and contents (fields, related lists, quick actions on a named layout) are modeled in the vault \u2014 Layout is a covered type.",
+        patterns: [
+          /\bhow\s+many\b.*\blayouts?\b/,
+          /\b(what|which|list)\b.*\b(page\s+)?layouts?\b.*\b(exist|are\s+there|for\s+the|on\s+the|does|available)\b/,
+          /\bwhat\b.*\b(fields?|related\s+lists?|quick\s+actions?|sections?|buttons?)\b.*\bon\b.*\blayout\b/,
+          /\b(related\s+lists?|quick\s+actions?)\b.*\b(on|appear|for)\b.*\blayout\b/
         ]
       },
       {
@@ -22999,9 +23464,13 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "God-mode / over-permission detection is a vault permission synthesis.",
         patterns: [
-          /\b(over[-\s]?permission|god[-\s]?mode|too\s+much\s+access|modify\s+all|view\s+all)\b/,
+          /\b(over[-\s]?permission(ed|s)?|god[-\s]?mode|too\s+much\s+access|modify\s+all|view\s+all)\b/,
           /\bwho\s+is\s+(an?\s+)?admin\b/,
-          /\b(permission|access)\s+(risk|sprawl|hygiene)\b/
+          /\b(permission|access)\s+(risk|sprawl|hygiene)\b/,
+          // Specific high-risk system permissions — "who can author apex / customize
+          // the application / manage users / modify metadata / view setup" — all
+          // answered by the permission_risk_report over-privilege pass.
+          /\bwho\s+(can|has)\b.*\b(author\s+apex|customi[sz]e\s+(the\s+)?application|manage\s+(users|sharing|roles|profiles)|modify\s+metadata|view\s+setup)\b/
         ]
       },
       {
@@ -23101,14 +23570,21 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: true,
         reason: "Order of execution / what runs on save is reconstructed from the vault graph. what_happens_on_save needs an explicit DML event \u2014 default to 'update' (or insert/delete to match the question) when none is stated.",
+        suggestArgs: (q) => ({ event: deriveSaveEvent(q) }),
         patterns: [
           /\b(trigger\s+order|order\s+of\s+execution)\b/,
-          /\bwhat\s+(happens|runs|fires)\b.*\b(on\s+save|when\b.*\b(created|saved|updated|inserted|deleted))\b/,
+          /\bwhat\s+(happens|runs|fires)\b.*\b(on\s+save|when\b.*\b(created|saved|updated|inserted|deleted|undeleted|restored))\b/,
           // "which/what flows|triggers|VRs|workflows run|fire when ..." — the
           // "which" phrasing was a router gap (e.g. "which flows run when a Case is
           // created"), so the question fell through to unrouted.
           /\b(what|which)\s+(triggers?|automation|flows?|validation\s+rules?|workflows?)\b.*\b(fire|run|execute|happen)\b/,
-          /\b(flows?|triggers?|automation)\b.*\bwhen\b.*\b\w+\s+is\b.*\b(created|updated|inserted|deleted|saved)\b/
+          /\b(flows?|triggers?|automation)\b.*\bwhen\b.*\b\w+\s+is\b.*\b(created|updated|inserted|deleted|saved)\b/,
+          // "what APEX/code/class runs when ..." — a noun between "what" and the
+          // verb (vs the adjacent "what runs") used to fall through (B21).
+          /\bwhat\s+(apex|code|class(es)?)\b.*\bruns?\b.*\bwhen\b/,
+          // "what happens when a Case STATUS CHANGES" — a status/stage change is a
+          // save-order event the "(created|updated|...)" verb list missed (B21).
+          /\bwhat\s+(happens|runs|fires)\b.*\b(status|stage)\b.*\bchang/
         ]
       },
       {
@@ -23124,6 +23600,25 @@ var init_intent_router = __esm({
           /\bwhat\s+changed\b.*\bfield\b.*\bon\s+save\b/
         ]
       },
+      {
+        // What a validation rule enforces / its error — get_component on the rule.
+        // MUST precede automation-on-object, which else steals "what does the X
+        // validation rule on <object> enforce" (it has "validation rule … on
+        // account") and sends it to automation_build_advisor instead of the rule's
+        // formula+error (NI-11). "What validation rules exist/run" stays schema /
+        // trigger-order (those lack the enforce/does/error verbs below).
+        intent: "explain-validation-rule",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "A validation rule's condition and error message are in the vault \u2014 resolve the rule, then get_component for its formula and error text.",
+        patterns: [
+          /\bvalidation\s+rules?\b.*\b(enforce|does|do\b|check|mean|prevent|block|error|message|stop)\b/,
+          /\bwhat\s+(does|error|message)\b.*\bvalidation\s+rule\b/,
+          /\b(error|message)\b.*\bvalidation\s+rule\b.*\b(show|display|return)\b/
+        ]
+      },
       {
         intent: "automation-on-object",
         plane: "vault",
@@ -23330,6 +23825,23 @@ var init_intent_router = __esm({
           /\borg\s+(risk|health)\b/
         ]
       },
+      {
+        // "Which classes implement <interface>" (Batchable, Schedulable, Queueable,
+        // RestResource, ...) — grep Apex source for the implements clause. The
+        // apex-search verbs (uses/references) didn't cover "implement" (B21.16/17,
+        // E.4-6 / BL-13 interface filters).
+        intent: "interface-implementers",
+        plane: "vault",
+        tools: ["sfi.search_apex_source", "sfi.find_apex_usages"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Classes implementing an interface (Batchable / Schedulable / Queueable / RestResource) are found by grepping Apex source for the implements clause.",
+        patterns: [
+          /\b(which|what)\s+(classes?|apex)\b.*\bimplements?\b/,
+          /\bimplements?\b.*\b(batchable|schedulable|queueable|database\.\w+|interface)\b/,
+          /\b(batchable|schedulable|queueable)\b.*\b(classes?|implement)\b/
+        ]
+      },
       {
         intent: "apex-search",
         plane: "vault",
@@ -23357,19 +23869,53 @@ var init_intent_router = __esm({
           /\bapi\b.*\b(connections?|surfaces?)\b/
         ]
       },
+      {
+        // "What platform events does this org publish / exist?" → CATALOG mode
+        // (event_subscribers with NO eventId). No named component to resolve —
+        // distinct from who-subscribes-to-EVENT-X below. NI-1: follow-up to the D6
+        // catalog fix so the route stops telling the agent to resolve a component
+        // that was never named.
+        intent: "event-catalog",
+        plane: "vault",
+        tools: ["sfi.event_subscribers"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Lists every Platform Event the org publishes with its subscriber count (event_subscribers catalog mode \u2014 call with no eventId).",
+        patterns: [
+          /\bwhat\s+(platform\s+events?|cdc\s+channels?)\b/,
+          /\b(platform\s+events?)\b.*\b(publish|emit|defined|exist|list|are\s+there)\b/
+        ]
+      },
       {
         intent: "event-subscribers",
         plane: "vault",
         tools: ["sfi.resolve", "sfi.event_subscribers", "sfi.cdc_subscribers"],
         liveRequired: false,
         needsResolve: true,
-        reason: "Who subscribes to a platform event / change data capture channel.",
+        reason: "Who subscribes to a specific platform event / change data capture channel.",
         patterns: [
           /\b(platform\s+events?|change\s+data\s+capture|cdc)\b.*\b(subscrib|listen|consum)\b/,
           /\bwho\s+(subscribes?|listens?)\b/,
           /\b(subscribers?|subscriptions?)\b.*\bevents?\b/
         ]
       },
+      {
+        // Inbound Apex REST (@RestResource) — "what REST endpoints are exposed".
+        // MUST precede the outbound `endpoints` rule, which would otherwise grab
+        // "endpoints" and misroute to the outbound catalog (B21.15).
+        intent: "rest-endpoints",
+        plane: "vault",
+        tools: ["sfi.search_apex_source", "sfi.find_apex_usages"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Inbound Apex REST endpoints are @RestResource/@Http* classes \u2014 grep Apex source for the annotations.",
+        patterns: [
+          /\b(apex\s+)?rest\s+(endpoints?|resources?|services?|api)\b/,
+          /\b@?restresource\b/,
+          /\b(inbound|exposed|expose)\b.*\brest\b/,
+          /\brest\b.*\b(endpoints?|resources?)\b.*\b(expose|exposed|apex|class)\b/
+        ]
+      },
       {
         intent: "endpoints",
         plane: "vault",
@@ -23434,6 +23980,24 @@ var init_intent_router = __esm({
           /\b(safe\s+to\s+delete|can\s+i\s+delete|ok\s+to\s+(delete|remove))\b/
         ]
       },
+      {
+        // MUST precede impact-analysis + what-if-field: a question about changing a
+        // field's stored VALUE (not its type/required/deletion) routes to the
+        // value-change tier. The discriminator is the word "value(s)" near a
+        // change/impact verb; schema what-ifs say "field type" / "delete" / "required".
+        intent: "value-change",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.value_change_audit", "sfi.what_if_change_field_value"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Changing a field's stored VALUE (not its schema) has a distinct blast radius \u2014 identity / integration-key / uniqueness / automation / cross-object \u2014 surfaced by value_change_audit (a set of fields on an object) or what_if_change_field_value (one field). Distinct from the type/required/delete what-ifs.",
+        patterns: [
+          /\bvalue[-\s]changes?\b/,
+          /\b(chang|updat|edit|modif|bulk[-\s]?updat)\w*\b[^.?!]{0,40}\bvalues?\b/,
+          /\bvalues?\b[^.?!]{0,40}\b(impact|affect|break|desync|safe|risk)\w*/,
+          /\b(impact|affect|safe|risky?)\b[^.?!]{0,70}\b(chang|updat|edit|modif)\w*\b[^.?!]{0,40}\bvalues?\b/
+        ]
+      },
       {
         intent: "impact-analysis",
         plane: "vault",
@@ -23646,6 +24210,37 @@ var init_intent_router = __esm({
         ]
       },
       // === Schema / naming (general — near the end) =============================
+      {
+        // KNOWLEDGE plane (B1) — greenfield/best-practice asks with NO org-specific
+        // answer. Patterns are deliberately narrow (only asks no vault rule already
+        // catches: flow-vs-apex, trigger framework, async options, SFDX, unlocked
+        // packages) so org-specific questions still route to vault/live. Other
+        // greenfield topics (governor limits, callouts, coverage, naming) are caught
+        // by their vault rules earlier and stay org-specific; their curated topics
+        // remain reachable via an explicit sfi.guidance { topic } call.
+        intent: "guidance",
+        plane: "knowledge",
+        tools: ["sfi.guidance"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "General Salesforce best-practice question with no org-specific answer \u2014 sfi.guidance returns a curated summary + official doc links (not org data).",
+        suggestArgs: (q) => {
+          const topic = deriveKnowledgeTopic(q);
+          return topic !== void 0 ? { topic } : void 0;
+        },
+        patterns: [
+          /\b(flow\s+(vs\.?|versus|or)\s+apex|apex\s+(vs\.?|versus|or)\s+flow)\b/,
+          /\bwhen\s+(should\s+i|to)\s+use\b.*\bflow\b/,
+          /\b(apex\s+)?trigger\s+framework\b/,
+          /\basync(hronous)?\s+apex\b/,
+          /\b(future|queueable|batch|schedulable)\b.*\b(vs\.?|versus|when\s+to|which\s+to|each\s+appropriate|options?)\b/,
+          /\b(sfdx|source[-\s]driven\s+development|scratch\s+orgs?)\b/,
+          /\bunlocked\s+packages?\b/,
+          /\bsingle[-\s]org\b.*\bmulti[-\s]org\b/,
+          /\bdata\s+(retention|archiv)/,
+          /\b(large\s+data\s+volumes?|\bldv\b)/
+        ]
+      },
       {
         intent: "resolve-lookup",
         plane: "vault",
@@ -23673,6 +24268,92 @@ var init_intent_router = __esm({
           /\b(suffix|prefix)\b.*\b(convention|standard)\b/
         ]
       },
+      {
+        // Lightning record pages / FlexiPages — assignment + component breakdown.
+        // "Which Lightning record page is assigned to X", "what components are on
+        // the Y record page" fell through to schema/unrouted (B21.2).
+        intent: "flexipage",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Lightning record pages (FlexiPage) \u2014 assignment and component breakdown \u2014 are modeled in the vault.",
+        patterns: [
+          /\b(lightning\s+(record\s+)?page|flexipage)s?\b/,
+          /\b(component|assign|which|what)\b.*\brecord\s+pages?\b/,
+          /\brecord\s+pages?\b.*\b(assign|component|layout|for\s+the)\b/
+        ]
+      },
+      {
+        // Picklist-value differences across record types — get_component on each
+        // RecordType shows its picklist value sets. Fell through (B21.4).
+        intent: "record-type-picklist",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Record-type picklist-value assignments are in the vault \u2014 list the record types, then get_component each to compare picklist values.",
+        patterns: [
+          /\brecord\s+types?\b.*\b(picklist|differ|difference|values?)\b/,
+          /\bpicklist\s+values?\b.*\b(record\s+types?|differ|between|across)\b/,
+          /\bwhich\s+picklist\s+values?\b.*\brecord\s+type/
+        ]
+      },
+      {
+        // Approval processes — list + steps. Fell through to schema/unrouted (B21.6).
+        intent: "approval-process",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Approval processes and their steps are modeled in the vault (ApprovalProcess).",
+        patterns: [
+          /\bapproval\s+process(es)?\b/,
+          /\bapproval\s+steps?\b/,
+          /\bapproval\b.*\b(steps?|process|who\s+approves?|approvers?|stages?)\b/
+        ]
+      },
+      {
+        // List views inventory (B21.8). Note: ListView is retrieved but not
+        // graph-modeled (notModeled), so relationships are limited — list only.
+        intent: "list-views",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "List views are catalogued in the vault via list_components (ListView). Coverage note: ListView is retrieved but not graph-modeled.",
+        patterns: [/\blist\s+views?\b/]
+      },
+      {
+        // Custom Settings vs Custom Metadata Types — both retrieved as CustomObject.
+        // Disambiguation gap (B21.9).
+        intent: "custom-settings-cmdt",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.list_components", "sfi.get_component"],
+        liveRequired: false,
+        needsResolve: false,
+        reason: "Custom Settings and Custom Metadata Types are modeled as CustomObject in the vault \u2014 list + get_component to see what they store.",
+        patterns: [
+          /\bcustom\s+settings?\b/,
+          /\bcustom\s+metadata\s+types?\b/,
+          /\b(cmdt|__mdt)\b/,
+          /\bhierarch(y|ical|ic)\b.*\bsettings?\b/
+        ]
+      },
+      {
+        // Difference between two profiles / permission sets (B21.10).
+        intent: "compare-profiles",
+        plane: "vault",
+        tools: ["sfi.resolve", "sfi.compare_components"],
+        liveRequired: false,
+        needsResolve: true,
+        reason: "Comparing two profiles or permission sets is a vault diff \u2014 resolve both, then compare_components.",
+        patterns: [
+          /\b(difference|differ|compare|versus|vs\.?)\b.*\bprofiles?\b/,
+          /\bprofiles?\b.*\b(difference|differ|compare|versus|vs\b)\b/,
+          /\bcompare\b.*\b(permission\s+sets?|profiles?)\b/
+        ]
+      },
       {
         intent: "schema",
         plane: "vault",
@@ -23707,6 +24388,7 @@ var init_intent_router = __esm({
       }
       for (const rule of RULES) {
         if (rule.patterns.some((p) => p.test(q))) {
+          const suggestedArgs = rule.suggestArgs?.(q);
           return {
             question,
             plane: rule.plane,
@@ -23715,7 +24397,8 @@ var init_intent_router = __esm({
             liveRequired: rule.liveRequired,
             needsResolve: rule.needsResolve,
             reason: rule.reason,
-            gap: rule.gap ?? null
+            gap: rule.gap ?? null,
+            ...suggestedArgs !== void 0 ? { suggestedArgs } : {}
           };
         }
       }
@@ -23763,7 +24446,7 @@ var init_intent_router = __esm({
 });
 
 // ../mcp/dist/src/tools/route-question.js
-import { z as z89 } from "zod";
+import { z as z90 } from "zod";
 var routeQuestionInputSchema, routeTrust, routeQuestionHandler;
 var init_route_question = __esm({
   "../mcp/dist/src/tools/route-question.js"() {
@@ -23771,11 +24454,11 @@ var init_route_question = __esm({
     init_dist();
     init_answer_render();
     init_intent_router();
-    routeQuestionInputSchema = z89.object({
+    routeQuestionInputSchema = z90.object({
       /** The user's plain-language question. */
-      question: z89.string().min(1),
+      question: z90.string().min(1),
       /** Append a gap entry to the local backlog when the route has one (default true). */
-      logGap: z89.boolean().optional()
+      logGap: z90.boolean().optional()
     });
     routeTrust = () => ({
       provenance: "offline_snapshot",
@@ -23806,7 +24489,7 @@ var init_route_question = __esm({
 });
 
 // ../mcp/dist/src/tools/scheduled-job-catalog.js
-import { z as z90 } from "zod";
+import { z as z91 } from "zod";
 var SCHEDULED_JOB_CATALOG_MAX_CLASSES, scheduledJobCatalogInputSchema, SCHEDULED_JOB_CATALOG_DISCLOSURE, readCronExpressions, readEdgeCronExpression, readIsSchedulable, collectScheduledCalls, compareEntries4, compareCalls, scheduledJobCatalogHandler;
 var init_scheduled_job_catalog = __esm({
   "../mcp/dist/src/tools/scheduled-job-catalog.js"() {
@@ -23814,7 +24497,7 @@ var init_scheduled_job_catalog = __esm({
     init_dist();
     init_src();
     SCHEDULED_JOB_CATALOG_MAX_CLASSES = 500;
-    scheduledJobCatalogInputSchema = z90.object({});
+    scheduledJobCatalogInputSchema = z91.object({});
     SCHEDULED_JOB_CATALOG_DISCLOSURE = "Scanning for System.schedule() invocations is heuristic \u2014 the v0.3 Apex scanner detects literal call sites only, NOT runtime registration via Tooling API. Runtime schedules require Tooling API access (CronTrigger / AsyncApexJob). A class flagged `isSchedulable: true` may not currently be scheduled; conversely, a class scheduled via a helper-wrapper or dynamic class load is invisible to the scanner.";
     readCronExpressions = (properties) => {
       const raw = properties["cronExpressions"];
@@ -23903,7 +24586,7 @@ var init_scheduled_job_catalog = __esm({
 
 // ../mcp/dist/src/tools/search-apex-source.js
 import { readFile as readFile14 } from "node:fs/promises";
-import { z as z91 } from "zod";
+import { z as z92 } from "zod";
 var SEARCH_APEX_SOURCE_MAX_LIMIT, SEARCH_APEX_SOURCE_DEFAULT_LIMIT, APEX_SUFFIXES, searchApexSourceInputSchema, searchApexSourceHandler, buildMatcher, searchFile;
 var init_search_apex_source = __esm({
   "../mcp/dist/src/tools/search-apex-source.js"() {
@@ -23913,10 +24596,10 @@ var init_search_apex_source = __esm({
     SEARCH_APEX_SOURCE_MAX_LIMIT = 200;
     SEARCH_APEX_SOURCE_DEFAULT_LIMIT = 50;
     APEX_SUFFIXES = [".cls", ".trigger"];
-    searchApexSourceInputSchema = z91.object({
-      query: z91.string().min(1),
-      regex: z91.boolean().optional(),
-      limit: z91.number().int().min(1).max(SEARCH_APEX_SOURCE_MAX_LIMIT).optional()
+    searchApexSourceInputSchema = z92.object({
+      query: z92.string().min(1),
+      regex: z92.boolean().optional(),
+      limit: z92.number().int().min(1).max(SEARCH_APEX_SOURCE_MAX_LIMIT).optional()
     });
     searchApexSourceHandler = async (ctx, input2) => {
       const limit = input2.limit ?? SEARCH_APEX_SOURCE_DEFAULT_LIMIT;
@@ -23993,7 +24676,7 @@ var init_search_apex_source = __esm({
 });
 
 // ../mcp/dist/src/tools/search-components.js
-import { z as z92 } from "zod";
+import { z as z93 } from "zod";
 var SEARCH_MAX_LIMIT2, searchComponentsInputSchema, SUGGESTIONS_NOTE, searchComponentsHandler;
 var init_search_components = __esm({
   "../mcp/dist/src/tools/search-components.js"() {
@@ -24001,10 +24684,10 @@ var init_search_components = __esm({
     init_dist();
     init_src();
     SEARCH_MAX_LIMIT2 = 100;
-    searchComponentsInputSchema = z92.object({
-      query: z92.string().min(1),
-      limit: z92.number().int().min(1).max(SEARCH_MAX_LIMIT2).optional(),
-      types: z92.array(z92.string()).optional()
+    searchComponentsInputSchema = z93.object({
+      query: z93.string().min(1),
+      limit: z93.number().int().min(1).max(SEARCH_MAX_LIMIT2).optional(),
+      types: z93.array(z93.string()).optional()
     });
     SUGGESTIONS_NOTE = "No exact substring matches. These are typo-tolerant, fuzzy-ranked guesses (heuristic) at what you may have meant \u2014 verify the canonical id before acting.";
     searchComponentsHandler = async (ctx, input2) => {
@@ -24055,7 +24738,7 @@ var init_search_components = __esm({
 
 // ../mcp/dist/src/tools/search-flow-metadata.js
 import { readFile as readFile15 } from "node:fs/promises";
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 var SEARCH_FLOW_METADATA_MAX_LIMIT, SEARCH_FLOW_METADATA_DEFAULT_LIMIT, FLOW_FILE_SUFFIX, searchFlowMetadataInputSchema, searchFlowMetadataHandler, buildMatcher2, searchFile2;
 var init_search_flow_metadata = __esm({
   "../mcp/dist/src/tools/search-flow-metadata.js"() {
@@ -24065,10 +24748,10 @@ var init_search_flow_metadata = __esm({
     SEARCH_FLOW_METADATA_MAX_LIMIT = 200;
     SEARCH_FLOW_METADATA_DEFAULT_LIMIT = 50;
     FLOW_FILE_SUFFIX = ".flow-meta.xml";
-    searchFlowMetadataInputSchema = z93.object({
-      query: z93.string().min(1),
-      regex: z93.boolean().optional(),
-      limit: z93.number().int().min(1).max(SEARCH_FLOW_METADATA_MAX_LIMIT).optional()
+    searchFlowMetadataInputSchema = z94.object({
+      query: z94.string().min(1),
+      regex: z94.boolean().optional(),
+      limit: z94.number().int().min(1).max(SEARCH_FLOW_METADATA_MAX_LIMIT).optional()
     });
     searchFlowMetadataHandler = async (ctx, input2) => {
       const limit = input2.limit ?? SEARCH_FLOW_METADATA_DEFAULT_LIMIT;
@@ -24145,14 +24828,14 @@ var init_search_flow_metadata = __esm({
 });
 
 // ../mcp/dist/src/tools/snapshot-trend.js
-import { z as z94 } from "zod";
+import { z as z95 } from "zod";
 var trendInputSchema, TREND_DISCLOSURE, trendHandler, churnInputSchema, CHURN_DISCLOSURE, diffNodeSets, churnHandler;
 var init_snapshot_trend = __esm({
   "../mcp/dist/src/tools/snapshot-trend.js"() {
     "use strict";
     init_dist();
     init_src2();
-    trendInputSchema = z94.object({});
+    trendInputSchema = z95.object({});
     TREND_DISCLOSURE = "Trend points come from persisted `sfi snapshot create` captures. Successful `sfi refresh` auto-captures a snapshot unless `meta/config.json` sets `snapshotOnRefresh: false`.";
     trendHandler = async (ctx, _input) => {
       const listed = await listSnapshots(ctx.vaultRoot);
@@ -24178,9 +24861,9 @@ var init_snapshot_trend = __esm({
         }
       });
     };
-    churnInputSchema = z94.object({
-      fromLabel: z94.string().min(1).optional(),
-      toLabel: z94.string().min(1).optional()
+    churnInputSchema = z95.object({
+      fromLabel: z95.string().min(1).optional(),
+      toLabel: z95.string().min(1).optional()
     });
     CHURN_DISCLOSURE = 'Churn compares two persisted snapshot labels by structural id/hash only \u2014 not semantic "risk". Use `sfi.diff_snapshots` for the full slice.';
     diffNodeSets = (fromNodes, toNodes) => {
@@ -24318,7 +25001,7 @@ var init_coverage_trust = __esm({
 });
 
 // ../mcp/dist/src/tools/unassigned-permission-sets.js
-import { z as z95 } from "zod";
+import { z as z96 } from "zod";
 var UNASSIGNED_MAX_LIMIT, UNASSIGNED_DEFAULT_LIMIT, LIST_PAGE_SIZE10, BOUNDARIES11, unassignedPermissionSetsInputSchema, namespacePrefixOf2, propertyString3, propertyBoolean2, propertyNumberOrNull, detectEnrichmentStatus, compareById2, unassignedPermissionSetsHandler;
 var init_unassigned_permission_sets = __esm({
   "../mcp/dist/src/tools/unassigned-permission-sets.js"() {
@@ -24332,10 +25015,10 @@ var init_unassigned_permission_sets = __esm({
       "tooling-api freshness reflects when v1.7 R2 last ran; live org assignment changes since then are not reflected. To refresh, run `sfi refresh --classify-permissions`.",
       "unknownAssignmentCount values require v1.7 Tooling API enrichment to resolve \u2014 they are NOT counted toward unassignedCount."
     ]);
-    unassignedPermissionSetsInputSchema = z95.object({
-      includeManagedPackage: z95.boolean().optional(),
-      includeMutingPermissionSets: z95.boolean().optional(),
-      limit: z95.number().int().min(1).max(UNASSIGNED_MAX_LIMIT).optional()
+    unassignedPermissionSetsInputSchema = z96.object({
+      includeManagedPackage: z96.boolean().optional(),
+      includeMutingPermissionSets: z96.boolean().optional(),
+      limit: z96.number().int().min(1).max(UNASSIGNED_MAX_LIMIT).optional()
     });
     namespacePrefixOf2 = (apiName) => {
       const idx = apiName.indexOf("__");
@@ -24476,7 +25159,7 @@ var init_unassigned_permission_sets = __esm({
 });
 
 // ../mcp/dist/src/tools/unused-components.js
-import { z as z96 } from "zod";
+import { z as z97 } from "zod";
 var UNUSED_MAX_LIMIT, UNUSED_DEFAULT_LIMIT, LIST_PAGE_SIZE11, DEFAULT_UNUSED_TYPES, COMPONENT_TYPES3, unusedComponentsInputSchema, INVISIBLE_REFERENCES_NOTES, DEFAULT_INVISIBLE_REFERENCES_NOTE, noteForType, ENTRY_POINT_TYPES, isInactiveEntryPoint, isUnused, isTestApexClass, compareById3, compareGlobally, scanType, unusedComponentsHandler;
 var init_unused_components = __esm({
   "../mcp/dist/src/tools/unused-components.js"() {
@@ -24551,9 +25234,9 @@ var init_unused_components = __esm({
       "CustomMetadataRecord",
       "CustomSettingRecord"
     ];
-    unusedComponentsInputSchema = z96.object({
-      types: z96.array(z96.enum(COMPONENT_TYPES3)).optional(),
-      limit: z96.number().int().min(1).max(UNUSED_MAX_LIMIT).optional()
+    unusedComponentsInputSchema = z97.object({
+      types: z97.array(z97.enum(COMPONENT_TYPES3)).optional(),
+      limit: z97.number().int().min(1).max(UNUSED_MAX_LIMIT).optional()
     });
     INVISIBLE_REFERENCES_NOTES = Object.freeze({
       ApexClass: "Dynamic Apex (Type.forName), reflective dispatch, and Tooling API references are invisible to the v1.x scanner; spot-check before deleting.",
@@ -24697,7 +25380,7 @@ var init_unused_components = __esm({
 });
 
 // ../mcp/dist/src/tools/unused-fields-deep.js
-import { z as z97 } from "zod";
+import { z as z98 } from "zod";
 var UNUSED_FIELDS_DEEP_REQUIRED_COVERAGE, completenessForUnusedFieldsDeep, UNUSED_FIELDS_DEEP_MAX_LIMIT, UNUSED_FIELDS_DEEP_DEFAULT_LIMIT, LIST_PAGE_SIZE12, FRONTEND_REFERENCE_TYPES, INVISIBILITY_WARNINGS, BOUNDARIES12, unusedFieldsDeepInputSchema, containsApiName, propertyString4, propertyStringArray2, criteriaItemsText, layoutSectionFields, relatedListFields, buildCorpora, checkNoIncomingEdges, checkNoFormulaTextReferences, checkNoLayoutReferences, checkNoSoqlStringReferences, checkNoUnresolvedApexReferences, checkNoLwcAuraVfReferences, checkNoConditionalContextReferences, checkNoIntegrationExposure, parseParentApiName2, fieldTypeOf2, isCustomField3, namespacePrefixOf3, computeConfidence, recommendedActionFor, compareById4, unusedFieldsDeepHandler;
 var init_unused_fields_deep = __esm({
   "../mcp/dist/src/tools/unused-fields-deep.js"() {
@@ -24748,11 +25431,11 @@ var init_unused_fields_deep = __esm({
     BOUNDARIES12 = Object.freeze([
       "even after checking formula expressions, layout placements, SOQL strings, conditional contexts, LWC / Aura / VF references, and integration exposure, the scanner cannot see dynamic SOQL, LWC dynamic field access (record[fieldName]), Apex reflective access (obj.get(...)), or runtime metadata references. Treat a 'high-confidence unused' flag as 'no static evidence of use' rather than 'definitely unused.'"
     ]);
-    unusedFieldsDeepInputSchema = z97.object({
-      parentObjectFilter: z97.string().min(1).optional(),
-      excludeManagedPackage: z97.boolean().optional(),
-      excludeStandardFields: z97.boolean().optional(),
-      limit: z97.number().int().min(1).max(UNUSED_FIELDS_DEEP_MAX_LIMIT).optional()
+    unusedFieldsDeepInputSchema = z98.object({
+      parentObjectFilter: z98.string().min(1).optional(),
+      excludeManagedPackage: z98.boolean().optional(),
+      excludeStandardFields: z98.boolean().optional(),
+      limit: z98.number().int().min(1).max(UNUSED_FIELDS_DEEP_MAX_LIMIT).optional()
     });
     containsApiName = (text, apiName) => text.toLowerCase().includes(apiName.toLowerCase());
     propertyString4 = (node, key) => {
@@ -25130,7 +25813,7 @@ var init_unused_fields_deep = __esm({
 });
 
 // ../mcp/dist/src/tools/tech-debt-score.js
-import { z as z98 } from "zod";
+import { z as z99 } from "zod";
 var LIST_PAGE_SIZE13, DEFAULT_WEIGHTS, Q115_DISCLOSURE, SCORE_DIRECTION_DISCLOSURE, WEIGHT_SCHEME_DISCLOSURE, SCALE_FACTORS, ALLOWED_WEIGHT_KEYS, techDebtScoreInputSchema, bandFor, contribFor, recommendationFor, weightedScore, computeApiVersionDistribution, computeCodeQualityCounts, computeFreshnessCounts, techDebtScoreHandler;
 var init_tech_debt_score = __esm({
   "../mcp/dist/src/tools/tech-debt-score.js"() {
@@ -25176,8 +25859,8 @@ var init_tech_debt_score = __esm({
       "apiVersions",
       "unassignedGrants"
     ];
-    techDebtScoreInputSchema = z98.object({
-      excludeCategories: z98.array(z98.enum([
+    techDebtScoreInputSchema = z99.object({
+      excludeCategories: z99.array(z99.enum([
         "deadWeight",
         "legacyAutomation",
         "codeQuality",
@@ -25188,13 +25871,13 @@ var init_tech_debt_score = __esm({
       // `.passthrough()` keeps unknown weight keys in the parsed input so
       // the handler can surface them in a structured `invalid-query`
       // refusal rather than silently dropping them at the Zod boundary.
-      weights: z98.object({
-        deadWeight: z98.number().min(0).max(1).optional(),
-        legacyAutomation: z98.number().min(0).max(1).optional(),
-        codeQuality: z98.number().min(0).max(1).optional(),
-        freshness: z98.number().min(0).max(1).optional(),
-        apiVersions: z98.number().min(0).max(1).optional(),
-        unassignedGrants: z98.number().min(0).max(1).optional()
+      weights: z99.object({
+        deadWeight: z99.number().min(0).max(1).optional(),
+        legacyAutomation: z99.number().min(0).max(1).optional(),
+        codeQuality: z99.number().min(0).max(1).optional(),
+        freshness: z99.number().min(0).max(1).optional(),
+        apiVersions: z99.number().min(0).max(1).optional(),
+        unassignedGrants: z99.number().min(0).max(1).optional()
       }).passthrough().optional()
     });
     bandFor = (score) => {
@@ -25554,12 +26237,13 @@ var init_tech_debt_score = __esm({
 });
 
 // ../mcp/dist/src/tools/synthesis-reports.js
-import { z as z99 } from "zod";
-var synthesisInputSchema, orgRiskReportInputSchema, fieldCleanupCandidatesInputSchema, automationRiskReportInputSchema, permissionRiskReportInputSchema, releaseReadinessReportInputSchema, SYNTHESIS_DISCLOSURE, rankSeverity, sortFindings, coverageTrust, orgRiskReportHandler, fieldCleanupCandidatesHandler, automationRiskReportHandler, permissionRiskReportHandler, releaseReadinessReportHandler;
+import { z as z100 } from "zod";
+var synthesisInputSchema, orgRiskReportInputSchema, fieldCleanupCandidatesInputSchema, automationRiskReportInputSchema, permissionRiskReportInputSchema, releaseReadinessReportInputSchema, SYNTHESIS_DISCLOSURE, rankSeverity, sortFindings, coverageTrust, orgRiskReportHandler, fieldCleanupCandidatesHandler, automationRiskReportHandler, SYSTEM_PERMISSION_SEVERITY, PRIVILEGE_SCAN_CAP, ESCALATION_EXAMPLE_CAP, ROSTER_CAP, grantorFinding, analyzeOverPrivilege, permissionRiskReportHandler, releaseReadinessReportHandler;
 var init_synthesis_reports = __esm({
   "../mcp/dist/src/tools/synthesis-reports.js"() {
     "use strict";
     init_dist();
+    init_src();
     init_src2();
     init_coverage_trust();
     init_crud_fls_audit();
@@ -25569,8 +26253,8 @@ var init_synthesis_reports = __esm({
     init_tech_debt_score();
     init_unassigned_permission_sets();
     init_unused_fields_deep();
-    synthesisInputSchema = z99.object({
-      limit: z99.number().int().min(1).max(500).optional()
+    synthesisInputSchema = z100.object({
+      limit: z100.number().int().min(1).max(500).optional()
     });
     orgRiskReportInputSchema = synthesisInputSchema;
     fieldCleanupCandidatesInputSchema = synthesisInputSchema;
@@ -25724,9 +26408,209 @@ var init_synthesis_reports = __esm({
         }
       });
     };
+    SYSTEM_PERMISSION_SEVERITY = {
+      ModifyAllData: "critical",
+      ViewAllData: "critical",
+      AuthorApex: "high",
+      CustomizeApplication: "high",
+      ManageUsers: "high",
+      ManageInternalUsers: "high",
+      ManageProfilesPermissionsets: "high",
+      ModifyMetadata: "high",
+      ManageSharing: "high",
+      ManageRoles: "high",
+      ManagePasswordPolicies: "high",
+      ManageLoginAccessPolicies: "high",
+      ViewAllUsers: "medium",
+      ViewSetup: "medium",
+      PasswordNeverExpires: "medium"
+    };
+    PRIVILEGE_SCAN_CAP = 500;
+    ESCALATION_EXAMPLE_CAP = 5;
+    ROSTER_CAP = 100;
+    grantorFinding = (node, type, riskyPerms, modifyAllObjects, viewAllObjects, worst, examples) => {
+      if (riskyPerms.length === 0 && modifyAllObjects === 0 && viewAllObjects === 0) {
+        return null;
+      }
+      const parts = [];
+      if (riskyPerms.length > 0) {
+        parts.push(`system perms: ${[...riskyPerms].sort().join(", ")}`);
+      }
+      if (modifyAllObjects > 0) {
+        parts.push(`Modify All on ${modifyAllObjects} object(s)`);
+      }
+      if (viewAllObjects > 0) {
+        parts.push(`View All on ${viewAllObjects} object(s)`);
+      }
+      return {
+        rank: 0,
+        severity: worst ?? "medium",
+        category: "over-privilege",
+        summary: `${type} ${node.apiName} grants ${parts.join("; ")}`,
+        evidence: [node.id, ...examples],
+        confidence: "declared"
+      };
+    };
+    analyzeOverPrivilege = async (ctx, limit) => {
+      const findings = [];
+      const modifyAllDataGrantors = [];
+      const viewAllDataGrantors = [];
+      const scanned = { profiles: 0, permissionSets: 0, permissionSetGroups: 0 };
+      const permsetRisk = /* @__PURE__ */ new Map();
+      for (const type of ["Profile", "PermissionSet"]) {
+        const nodesResult = await listNodesByType(ctx.graph, type, {
+          limit: PRIVILEGE_SCAN_CAP
+        });
+        if (!nodesResult.ok)
+          continue;
+        for (const node of nodesResult.value) {
+          if (type === "Profile")
+            scanned.profiles += 1;
+          else
+            scanned.permissionSets += 1;
+          const riskyPerms = [];
+          let worst = null;
+          const ups = node.properties["userPermissions"];
+          if (Array.isArray(ups)) {
+            for (const perm of ups) {
+              if (typeof perm !== "string")
+                continue;
+              const sev = SYSTEM_PERMISSION_SEVERITY[perm];
+              if (sev === void 0)
+                continue;
+              riskyPerms.push(perm);
+              if (worst === null || rankSeverity(sev) > rankSeverity(worst)) {
+                worst = sev;
+              }
+              if (perm === "ModifyAllData" && modifyAllDataGrantors.length < ROSTER_CAP) {
+                modifyAllDataGrantors.push(node.id);
+              }
+              if (perm === "ViewAllData" && viewAllDataGrantors.length < ROSTER_CAP) {
+                viewAllDataGrantors.push(node.id);
+              }
+            }
+          }
+          let modifyAllObjects = 0;
+          let viewAllObjects = 0;
+          const examples = [];
+          const outResult = await listEdges(ctx.graph, node.id, {
+            direction: "out",
+            edgeType: "grantedBy"
+          });
+          if (outResult.ok) {
+            for (const edge of outResult.value) {
+              if (!edge.toId.startsWith("CustomObject:"))
+                continue;
+              if (edge.properties["modifyAllRecords"] === true) {
+                modifyAllObjects += 1;
+                if (examples.length < ESCALATION_EXAMPLE_CAP)
+                  examples.push(edge.toId);
+              } else if (edge.properties["viewAllRecords"] === true) {
+                viewAllObjects += 1;
+                if (examples.length < ESCALATION_EXAMPLE_CAP)
+                  examples.push(edge.toId);
+              }
+            }
+          }
+          if (modifyAllObjects > 0 && (worst === null || rankSeverity("high") > rankSeverity(worst))) {
+            worst = "high";
+          } else if (viewAllObjects > 0 && worst === null) {
+            worst = "medium";
+          }
+          if (type === "PermissionSet") {
+            permsetRisk.set(node.id, {
+              perms: riskyPerms,
+              modAll: modifyAllObjects,
+              viewAll: viewAllObjects
+            });
+          }
+          const finding = grantorFinding(node, type, riskyPerms, modifyAllObjects, viewAllObjects, worst, examples);
+          if (finding !== null)
+            findings.push(finding);
+        }
+      }
+      const psgResult = await listNodesByType(ctx.graph, "PermissionSetGroup", {
+        limit: PRIVILEGE_SCAN_CAP
+      });
+      if (psgResult.ok) {
+        for (const psg of psgResult.value) {
+          scanned.permissionSetGroups += 1;
+          const members = psg.properties["permissionSets"];
+          if (!Array.isArray(members))
+            continue;
+          const conferred = /* @__PURE__ */ new Set();
+          let aggModAll = 0;
+          let aggViewAll = 0;
+          const riskyMembers = [];
+          for (const member of members) {
+            if (typeof member !== "string")
+              continue;
+            const risk = permsetRisk.get(`PermissionSet:${member}`);
+            if (risk === void 0)
+              continue;
+            if (risk.perms.length === 0 && risk.modAll === 0 && risk.viewAll === 0) {
+              continue;
+            }
+            for (const perm of risk.perms)
+              conferred.add(perm);
+            aggModAll += risk.modAll;
+            aggViewAll += risk.viewAll;
+            if (riskyMembers.length < ESCALATION_EXAMPLE_CAP) {
+              riskyMembers.push(`PermissionSet:${member}`);
+            }
+          }
+          if (conferred.size === 0 && aggModAll === 0 && aggViewAll === 0)
+            continue;
+          let worst = "medium";
+          if (conferred.has("ModifyAllData") || conferred.has("ViewAllData")) {
+            worst = "critical";
+          } else if (aggModAll > 0 || [...conferred].some((p) => SYSTEM_PERMISSION_SEVERITY[p] === "high")) {
+            worst = "high";
+          }
+          if (conferred.has("ModifyAllData") && modifyAllDataGrantors.length < ROSTER_CAP) {
+            modifyAllDataGrantors.push(psg.id);
+          }
+          if (conferred.has("ViewAllData") && viewAllDataGrantors.length < ROSTER_CAP) {
+            viewAllDataGrantors.push(psg.id);
+          }
+          const muting = psg.properties["mutingPermissionSets"];
+          const hasMuting = Array.isArray(muting) && muting.length > 0;
+          const parts = [];
+          if (conferred.size > 0) {
+            parts.push(`system perms: ${[...conferred].sort().join(", ")}`);
+          }
+          if (aggModAll > 0) {
+            parts.push(`Modify All on ${aggModAll} object(s) (aggregate)`);
+          }
+          if (aggViewAll > 0) {
+            parts.push(`View All on ${aggViewAll} object(s) (aggregate)`);
+          }
+          findings.push({
+            rank: 0,
+            severity: worst,
+            category: "over-privilege",
+            summary: `PermissionSetGroup ${psg.apiName} confers via member permission set(s) ${parts.join("; ")}` + (hasMuting ? " (has a muting permission set \u2014 effective perms may be lower)" : ""),
+            evidence: [psg.id, ...riskyMembers],
+            confidence: "declared"
+          });
+        }
+      }
+      const ranked = [...findings].sort((a, b) => rankSeverity(b.severity) - rankSeverity(a.severity));
+      return {
+        findings: ranked.slice(0, limit),
+        privilege: {
+          modifyAllDataGrantors: [...modifyAllDataGrantors].sort(),
+          viewAllDataGrantors: [...viewAllDataGrantors].sort(),
+          overPrivilegedGrantorCount: findings.length,
+          scanned
+        }
+      };
+    };
     permissionRiskReportHandler = async (ctx, input2) => {
       const limit = input2.limit ?? 50;
       const findings = [];
+      const overPriv = await analyzeOverPrivilege(ctx, limit);
+      findings.push(...overPriv.findings);
       const unassigned = await unassignedPermissionSetsHandler(ctx, { limit });
       if (unassigned.ok) {
         for (const row of unassigned.value.data.unassigned.slice(0, limit)) {
@@ -25762,6 +26646,7 @@ var init_synthesis_reports = __esm({
         data: {
           findings: sortFindings(findings),
           auditTotals,
+          privilege: overPriv.privilege,
           trust: coverageTrust(ctx),
           disclosure: SYNTHESIS_DISCLOSURE
         },
@@ -25803,8 +26688,109 @@ var init_synthesis_reports = __esm({
   }
 });
 
+// ../mcp/dist/src/tools/synthesize-answer.js
+import { z as z101 } from "zod";
+var CANONICAL_ID_WHOLE, CANONICAL_ID_INLINE, CAVEAT_KEY, FACT_KEY, COUNT_ARRAY_KEY, MAX_CITATIONS, MAX_BULLETS, MAX_CAVEATS, DISCLOSURE8, synthesizeAnswerInputSchema, pushCapped, collect, parseCitation, synthesizeAnswerHandler;
+var init_synthesize_answer = __esm({
+  "../mcp/dist/src/tools/synthesize-answer.js"() {
+    "use strict";
+    init_dist();
+    CANONICAL_ID_WHOLE = /^[A-Z][A-Za-z0-9]+:[^\s]+$/;
+    CANONICAL_ID_INLINE = /\b[A-Z][A-Za-z0-9]+:[A-Za-z0-9_./-]*[A-Za-z0-9_]/g;
+    CAVEAT_KEY = /^(disclosure|caveat|caveats|note|notes|boundary|boundaries|limitation|limitations|notModeledNote|honesty|warning|warnings)$/i;
+    FACT_KEY = /^(count|total|totalCount|totalClassCount|totalFindingCount|totalGapsCount|verdict|disposition|status|coverageStatus|riskLevel|truncated|notModeled|plane|intent|confidence|matchKind|fieldLabel|fieldId|piiClassification|piiCategory)$/;
+    COUNT_ARRAY_KEY = /^(grants|findings|gaps|components|candidates|edges|nodes|reasoning|viaApexAccess|fields|matches|classes|tools)$/;
+    MAX_CITATIONS = 200;
+    MAX_BULLETS = 60;
+    MAX_CAVEATS = 40;
+    DISCLOSURE8 = "This answer skeleton is composed ONLY from the JSON supplied in `input`: every citation is an id that appears verbatim in that input, every caveat is carried from it, and no components, counts, or facts were invented. When a `draft` is supplied, `hallucinatedIds` lists canonical ids in the draft that are NOT in the source \u2014 remove or re-ground them before answering. Prose wording is the caller\u2019s job; this tool guarantees grounding, not sentences.";
+    synthesizeAnswerInputSchema = z101.object({
+      input: z101.unknown(),
+      question: z101.string().optional(),
+      draft: z101.string().optional()
+    });
+    pushCapped = (arr, s, cap) => {
+      if (arr.length < cap && !arr.includes(s))
+        arr.push(s);
+    };
+    collect = (value, key, out) => {
+      if (typeof value === "string") {
+        if (out.ids.size < MAX_CITATIONS && CANONICAL_ID_WHOLE.test(value)) {
+          out.ids.add(value);
+        }
+        if (key !== null && CAVEAT_KEY.test(key) && value.trim().length > 0) {
+          pushCapped(out.caveats, value, MAX_CAVEATS);
+        } else if (key !== null && FACT_KEY.test(key)) {
+          pushCapped(out.bullets, `${key}: ${value}`, MAX_BULLETS);
+        }
+        return;
+      }
+      if (typeof value === "number" || typeof value === "boolean") {
+        if (key !== null && FACT_KEY.test(key)) {
+          pushCapped(out.bullets, `${key}: ${String(value)}`, MAX_BULLETS);
+        }
+        return;
+      }
+      if (Array.isArray(value)) {
+        if (key !== null && CAVEAT_KEY.test(key)) {
+          for (const item of value) {
+            if (typeof item === "string" && item.trim().length > 0) {
+              pushCapped(out.caveats, item, MAX_CAVEATS);
+            }
+          }
+        } else if (key !== null && COUNT_ARRAY_KEY.test(key)) {
+          pushCapped(out.bullets, `${key}: ${value.length} item(s)`, MAX_BULLETS);
+        }
+        for (const item of value)
+          collect(item, null, out);
+        return;
+      }
+      if (value !== null && typeof value === "object") {
+        for (const [k, v] of Object.entries(value))
+          collect(v, k, out);
+      }
+    };
+    parseCitation = (id) => {
+      const colon = id.indexOf(":");
+      return {
+        id,
+        type: id.slice(0, colon),
+        apiName: id.slice(colon + 1)
+      };
+    };
+    synthesizeAnswerHandler = async (ctx, input2) => {
+      const out = { ids: /* @__PURE__ */ new Set(), caveats: [], bullets: [] };
+      collect(input2.input, null, out);
+      const citations = [...out.ids].sort().map(parseCitation);
+      let hallucinatedIds;
+      let groundedIds;
+      if (input2.draft !== void 0) {
+        const draftIds = [...new Set(input2.draft.match(CANONICAL_ID_INLINE) ?? [])];
+        groundedIds = draftIds.filter((id) => out.ids.has(id)).sort();
+        hallucinatedIds = draftIds.filter((id) => !out.ids.has(id)).sort();
+      }
+      const qPrefix = input2.question !== void 0 && input2.question.trim().length > 0 ? `Q: ${input2.question.trim()} \u2014 ` : "";
+      const summary = `${qPrefix}Grounded in the supplied tool output: ${citations.length} component(s) cited, ${out.bullets.length} key fact(s), ${out.caveats.length} caveat(s)` + (hallucinatedIds !== void 0 ? `, ${hallucinatedIds.length} ungrounded id(s) in the draft` : "") + ".";
+      return ok({
+        data: {
+          summary,
+          bullets: out.bullets,
+          citations,
+          caveats: out.caveats,
+          ...input2.draft !== void 0 ? { hallucinatedIds: hallucinatedIds ?? [], groundedIds: groundedIds ?? [] } : {},
+          disclosure: DISCLOSURE8
+        },
+        vaultState: {
+          sourceTreeHash: ctx.manifest.sourceTreeHash,
+          refreshedAt: ctx.manifest.refreshedAt
+        }
+      });
+    };
+  }
+});
+
 // ../mcp/dist/src/tools/test-coverage-for-method.js
-import { z as z100 } from "zod";
+import { z as z102 } from "zod";
 var COVERAGE_BFS_DEPTH, COVERAGE_EDGE_TYPES, APEX_CLASS_PREFIX7, APEX_TRIGGER_PREFIX5, COVERAGE_DISCLOSURE2, testCoverageForMethodInputSchema, isApexCallable4, isTestClass5, upstreamWalk2, testCoverageForMethodHandler;
 var init_test_coverage_for_method = __esm({
   "../mcp/dist/src/tools/test-coverage-for-method.js"() {
@@ -25820,9 +26806,9 @@ var init_test_coverage_for_method = __esm({
     APEX_CLASS_PREFIX7 = "ApexClass:";
     APEX_TRIGGER_PREFIX5 = "ApexTrigger:";
     COVERAGE_DISCLOSURE2 = "v2.7 test_coverage_for_method ships CLASS granularity (method-level promised in v2.7.1). The methodName input is echoed verbatim into the response but does NOT subset the upstream walk. The upstream walk follows both callsApex and dispatchesAsync incoming edges, so coverage exercised via async dispatch (Database.executeBatch, System.enqueueJob, System.schedule) is included. Dynamic dispatch (Type.forName) and reflective invocation are still invisible. BFS is capped at depth 3; coverage chains longer than 3 hops surface as uncovered even when they exist.";
-    testCoverageForMethodInputSchema = z100.object({
-      classApiName: z100.string().min(1),
-      methodName: z100.string().min(1).optional()
+    testCoverageForMethodInputSchema = z102.object({
+      classApiName: z102.string().min(1),
+      methodName: z102.string().min(1).optional()
     });
     isApexCallable4 = (id) => id.startsWith(APEX_CLASS_PREFIX7) || id.startsWith(APEX_TRIGGER_PREFIX5);
     isTestClass5 = (node) => node.properties["isTest"] === true;
@@ -25922,8 +26908,8 @@ var init_test_coverage_for_method = __esm({
 });
 
 // ../mcp/dist/src/tools/test-coverage-gaps.js
-import { z as z101 } from "zod";
-var LIST_PAGE_SIZE14, CLASS_FILTER_MAX_SIZE, MAX_COVERAGE_DEPTH, MEANINGFUL_ASSERTION_DISCLOSURE, DYNAMIC_DISPATCH_DISCLOSURE, DEPTH_CAP_DISCLOSURE, testCoverageGapsInputSchema, collectFakeAssertions2, isTestClass6, collectCoveringTestClasses, recommendationFor2, compareGapById, emptyByStatus, testCoverageGapsHandler;
+import { z as z103 } from "zod";
+var LIST_PAGE_SIZE14, CLASS_FILTER_MAX_SIZE, TEST_COVERAGE_GAPS_MAX_LIMIT, TEST_COVERAGE_GAPS_DEFAULT_LIMIT, TEST_COVERAGE_GAPS_PAYLOAD_BUDGET_BYTES, MAX_COVERAGE_DEPTH, MEANINGFUL_ASSERTION_DISCLOSURE, DYNAMIC_DISPATCH_DISCLOSURE, DEPTH_CAP_DISCLOSURE, testCoverageGapsInputSchema, fitGapsToBudget, collectFakeAssertions2, isTestClass6, collectCoveringTestClasses, recommendationFor2, compareGapById, emptyByStatus, testCoverageGapsHandler;
 var init_test_coverage_gaps = __esm({
   "../mcp/dist/src/tools/test-coverage-gaps.js"() {
     "use strict";
@@ -25931,13 +26917,31 @@ var init_test_coverage_gaps = __esm({
     init_src();
     LIST_PAGE_SIZE14 = 500;
     CLASS_FILTER_MAX_SIZE = 500;
+    TEST_COVERAGE_GAPS_MAX_LIMIT = 500;
+    TEST_COVERAGE_GAPS_DEFAULT_LIMIT = 200;
+    TEST_COVERAGE_GAPS_PAYLOAD_BUDGET_BYTES = 38e3;
     MAX_COVERAGE_DEPTH = 3;
     MEANINGFUL_ASSERTION_DISCLOSURE = "the meaningful-assertion heuristic recognizes System.assertEquals(expected, actual) patterns with distinct expected/actual tokens, plus System.assert(condition) with a non-literal condition. Assertions via helper methods or framework wrappers are invisible. A class flagged fake-coverage may actually have meaningful tests via a custom assertion helper.";
     DYNAMIC_DISPATCH_DISCLOSURE = "reachability via callsApex does NOT cover dynamic dispatch (Type.forName) or reflective invocation. A class genuinely tested via dynamic dispatch will surface as uncovered by this heuristic.";
     DEPTH_CAP_DISCLOSURE = `the coverage BFS is capped at depth ${MAX_COVERAGE_DEPTH}; coverage chains longer than ${MAX_COVERAGE_DEPTH} hops surface as uncovered even when they exist.`;
-    testCoverageGapsInputSchema = z101.object({
-      classFilter: z101.array(z101.string().min(1)).max(CLASS_FILTER_MAX_SIZE).optional()
+    testCoverageGapsInputSchema = z103.object({
+      classFilter: z103.array(z103.string().min(1)).max(CLASS_FILTER_MAX_SIZE).optional(),
+      limit: z103.number().int().min(1).max(TEST_COVERAGE_GAPS_MAX_LIMIT).optional(),
+      offset: z103.number().int().min(0).optional()
     });
+    fitGapsToBudget = (gaps, budgetBytes) => {
+      const kept = [];
+      let used = 0;
+      for (const gap of gaps) {
+        const size = Buffer.byteLength(JSON.stringify(gap), "utf8") + 1;
+        if (kept.length > 0 && used + size > budgetBytes) {
+          return { kept, trimmed: true };
+        }
+        kept.push(gap);
+        used += size;
+      }
+      return { kept, trimmed: false };
+    };
     collectFakeAssertions2 = (node) => {
       const raw = node.properties["qualityIssues"];
       if (!Array.isArray(raw))
@@ -26096,6 +27100,12 @@ var init_test_coverage_gaps = __esm({
       for (const g of sorted) {
         byStatus[g.coverageStatus] += 1;
       }
+      const limit = input2.limit ?? TEST_COVERAGE_GAPS_DEFAULT_LIMIT;
+      const offset = input2.offset ?? 0;
+      const page = sorted.slice(offset, offset + limit);
+      const { kept, trimmed } = fitGapsToBudget(page, TEST_COVERAGE_GAPS_PAYLOAD_BUDGET_BYTES);
+      const returnedEnd = offset + kept.length;
+      const truncated = returnedEnd < sorted.length;
       const boundaries = sorted.length === 0 ? [] : [
         MEANINGFUL_ASSERTION_DISCLOSURE,
         DYNAMIC_DISPATCH_DISCLOSURE,
@@ -26103,10 +27113,17 @@ var init_test_coverage_gaps = __esm({
       ];
       return ok({
         data: {
-          gaps: sorted,
+          gaps: kept,
           totalGapsCount: sorted.length,
           byStatus,
-          boundaries
+          boundaries,
+          limit,
+          offset,
+          truncated,
+          ...truncated ? { nextOffset: returnedEnd } : {},
+          ...trimmed ? {
+            note: `Response trimmed to ${kept.length} of ${page.length} gaps (${sorted.length} total) to stay under the ~45 KB MCP response limit. Advance with offset += ${kept.length} for the rest.`
+          } : {}
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -26118,7 +27135,7 @@ var init_test_coverage_gaps = __esm({
 });
 
 // ../mcp/dist/src/tools/tests-for-change.js
-import { z as z102 } from "zod";
+import { z as z104 } from "zod";
 var TESTS_FOR_CHANGE_BFS_DEPTH, COVERAGE_EDGE_TYPES2, APEX_CLASS_PREFIX8, APEX_TRIGGER_PREFIX6, MAX_CHANGED_ITEMS, TESTS_FOR_CHANGE_DISCLOSURE, testsForChangeInputSchema, isApexCallable5, isTestClass7, upstreamWalk3, sortIds, testsForChangeHandler;
 var init_tests_for_change = __esm({
   "../mcp/dist/src/tools/tests-for-change.js"() {
@@ -26132,8 +27149,8 @@ var init_tests_for_change = __esm({
     APEX_TRIGGER_PREFIX6 = "ApexTrigger:";
     MAX_CHANGED_ITEMS = 500;
     TESTS_FOR_CHANGE_DISCLOSURE = "tests_for_change selects at CLASS granularity (a changed method on a covered class still selects that class\u2019s tests; method-level resolution promised in v2.7.1). The upstream walk follows both callsApex and dispatchesAsync incoming edges, so coverage via async dispatch (Database.executeBatch, System.enqueueJob, System.schedule) is included. Dynamic dispatch (Type.forName) and reflective invocation are invisible \u2014 a test reaching the change only via reflection is missed. Managed-package test classes are invisible. BFS is capped at depth 3; coverage chains longer than 3 hops surface as uncovered even when they exist. A changed component in uncoveredChanges is UNGUARDED \u2014 running the selected set will NOT exercise it; run the full suite when any change is uncovered or you suspect a deep chain.";
-    testsForChangeInputSchema = z102.object({
-      changedComponents: z102.array(z102.string().min(1)).min(1).max(MAX_CHANGED_ITEMS)
+    testsForChangeInputSchema = z104.object({
+      changedComponents: z104.array(z104.string().min(1)).min(1).max(MAX_CHANGED_ITEMS)
     });
     isApexCallable5 = (id) => id.startsWith(APEX_CLASS_PREFIX8) || id.startsWith(APEX_TRIGGER_PREFIX6);
     isTestClass7 = (node) => node.properties["isTest"] === true;
@@ -26293,9 +27310,711 @@ var init_tests_for_change = __esm({
   }
 });
 
+// ../mcp/dist/src/tools/value-change-classification.js
+var CUSTOM_FIELD_PREFIX11, SEV_RANK, parseFieldId, leafName, DERIVED_DATA_TYPES, SYSTEM_AUDIT_FIELDS, classifyMutability, STANDARD_IDLOOKUP, classifyUpsertKey, IDENTITY_CATALOG, lookupIdentityCatalog, severityRank, maxSeverity, NAME_LEXICON, CONF_RANK, classifyRole, classifyField;
+var init_value_change_classification = __esm({
+  "../mcp/dist/src/tools/value-change-classification.js"() {
+    "use strict";
+    init_field_properties();
+    CUSTOM_FIELD_PREFIX11 = "CustomField:";
+    SEV_RANK = {
+      info: 0,
+      low: 1,
+      medium: 2,
+      high: 3,
+      critical: 4
+    };
+    parseFieldId = (id) => {
+      if (!id.startsWith(CUSTOM_FIELD_PREFIX11))
+        return null;
+      const rest = id.slice(CUSTOM_FIELD_PREFIX11.length);
+      const dot = rest.indexOf(".");
+      if (dot < 0)
+        return null;
+      return { object: rest.slice(0, dot), field: rest.slice(dot + 1) };
+    };
+    leafName = (apiName) => {
+      const i = apiName.lastIndexOf(".");
+      return i >= 0 ? apiName.slice(i + 1) : apiName;
+    };
+    DERIVED_DATA_TYPES = /* @__PURE__ */ new Set(["Summary", "AutoNumber"]);
+    SYSTEM_AUDIT_FIELDS = /* @__PURE__ */ new Set([
+      "Id",
+      "IsDeleted",
+      "CreatedDate",
+      "CreatedById",
+      "LastModifiedDate",
+      "LastModifiedById",
+      "SystemModstamp",
+      "LastActivityDate",
+      "LastViewedDate",
+      "LastReferencedDate"
+    ]);
+    classifyMutability = (node, fieldName) => {
+      const formula = node.properties["formula"];
+      if (typeof formula === "string" && formula.trim() !== "") {
+        const expr = formula.trim();
+        return {
+          mutability: "derived",
+          reason: `Formula field \u2014 value is computed from \`${expr}\`. Change the source field(s), not this one.`,
+          sourceFormula: expr
+        };
+      }
+      const dataType = readFieldDataType(node);
+      if (DERIVED_DATA_TYPES.has(dataType)) {
+        return {
+          mutability: "derived",
+          reason: `${dataType} field \u2014 value is system-computed, not directly editable.`
+        };
+      }
+      const name = fieldName ?? leafName(node.apiName);
+      if (SYSTEM_AUDIT_FIELDS.has(name)) {
+        return {
+          mutability: "derived",
+          reason: `${name} is a system audit field \u2014 not user-writable.`
+        };
+      }
+      return { mutability: "writable", reason: "Directly editable field." };
+    };
+    STANDARD_IDLOOKUP = {
+      "*": /* @__PURE__ */ new Set(["Id"]),
+      User: /* @__PURE__ */ new Set(["Username", "FederationIdentifier"])
+    };
+    classifyUpsertKey = (node, object, fieldName) => {
+      const signals = [];
+      if (node.properties["externalId"] === true)
+        signals.push("externalId");
+      if (node.properties["unique"] === true)
+        signals.push("unique");
+      const idLookup = (STANDARD_IDLOOKUP[object]?.has(fieldName) ?? false) || (STANDARD_IDLOOKUP["*"]?.has(fieldName) ?? false);
+      if (idLookup)
+        signals.push("idLookup");
+      return { isUpsertKey: signals.length > 0, signals };
+    };
+    IDENTITY_CATALOG = {
+      "User.Username": { role: "Login identity (global-unique)", severity: "critical" },
+      "User.FederationIdentifier": { role: "SSO / SAML federation subject", severity: "high" },
+      "User.EmployeeNumber": { role: "Employee number \u2014 common HRIS integration key", severity: "high" },
+      "User.CommunityNickname": { role: "Experience Cloud display (org-unique)", severity: "medium" },
+      "User.Alias": { role: "Short display name", severity: "low" },
+      "User.Email": { role: "User email \u2014 login & notifications", severity: "high" },
+      "Contact.Email": { role: "Contact email / common match key", severity: "medium" }
+    };
+    lookupIdentityCatalog = (object, field) => IDENTITY_CATALOG[`${object}.${field}`] ?? null;
+    severityRank = (s) => SEV_RANK[s];
+    maxSeverity = (a, b) => SEV_RANK[a] >= SEV_RANK[b] ? a : b;
+    NAME_LEXICON = [
+      { test: /(_SIS_ID|SIS_?Key|Comment_SIS_ID)__c$/i, role: "SIS integration key (name pattern)", severity: "high" },
+      { test: /(Marketo|Sparkroom|Pardot)/i, role: "Marketing-platform key (name pattern)", severity: "medium" },
+      { test: /(_uuid|_guid)__c$/i, role: "External UUID/GUID key (name pattern)", severity: "medium" },
+      { test: /Federation/i, role: "Federation / SSO identity (name pattern)", severity: "high" }
+    ];
+    CONF_RANK = { potential: 0, likely: 1, confirmed: 2 };
+    classifyRole = (upsert, mutability, object, fieldName) => {
+      if (mutability.mutability === "derived") {
+        return {
+          role: "Derived / computed \u2014 value not directly changeable",
+          severity: "low",
+          confidence: "confirmed",
+          signals: [mutability.reason]
+        };
+      }
+      const candidates = [];
+      const catalog = IDENTITY_CATALOG[`${object}.${fieldName}`];
+      if (catalog !== void 0) {
+        candidates.push({
+          role: catalog.role,
+          severity: catalog.severity,
+          // Corroborated by an upsert flag → confirmed; otherwise a known but
+          // org-config-dependent default → likely.
+          confidence: upsert.isUpsertKey ? "confirmed" : "likely",
+          signal: "standard-identity-field catalog"
+        });
+      }
+      if (upsert.isUpsertKey) {
+        candidates.push({
+          role: "Integration / upsert key",
+          severity: "high",
+          confidence: "confirmed",
+          signal: `upsert key (${upsert.signals.join(" + ")})`
+        });
+      }
+      const lex = NAME_LEXICON.find((r) => r.test.test(fieldName));
+      if (lex !== void 0) {
+        candidates.push({
+          role: lex.role,
+          severity: lex.severity,
+          confidence: "potential",
+          signal: "name pattern"
+        });
+      }
+      if (candidates.length === 0) {
+        return {
+          role: "Standard editable field",
+          severity: "low",
+          confidence: "confirmed",
+          signals: []
+        };
+      }
+      const top = candidates.reduce((best, c) => {
+        if (SEV_RANK[c.severity] !== SEV_RANK[best.severity]) {
+          return SEV_RANK[c.severity] > SEV_RANK[best.severity] ? c : best;
+        }
+        return CONF_RANK[c.confidence] > CONF_RANK[best.confidence] ? c : best;
+      });
+      return {
+        role: top.role,
+        severity: top.severity,
+        confidence: top.confidence,
+        signals: candidates.map((c) => c.signal)
+      };
+    };
+    classifyField = (node) => {
+      const parsed = parseFieldId(node.id);
+      const object = parsed?.object ?? "";
+      const field = parsed?.field ?? leafName(node.apiName);
+      const mutability = classifyMutability(node, field);
+      const upsertKey = classifyUpsertKey(node, object, field);
+      const role = classifyRole(upsertKey, mutability, object, field);
+      return { fieldId: node.id, object, field, mutability, upsertKey, role };
+    };
+  }
+});
+
+// ../mcp/dist/src/tools/value-change-risk.js
+var SOURCE_CATEGORY, EMPTY_EDGE_SUMMARY, buildBuckets, buildDisclosures, recommendedChecksFor, overallSeverityOf, summarizeIncomingEdges, gateFederationIdentifier, detectShadowJoin, extractQuotedLiterals, normalizeExpr, findValueCouplings, assessValueChange;
+var init_value_change_risk = __esm({
+  "../mcp/dist/src/tools/value-change-risk.js"() {
+    "use strict";
+    init_dist();
+    init_src();
+    init_value_change_classification();
+    SOURCE_CATEGORY = {
+      ValidationRule: "automation",
+      WorkflowRule: "automation",
+      Flow: "automation",
+      ApprovalProcess: "automation",
+      AssignmentRule: "automation",
+      EscalationRule: "automation",
+      AutoResponseRule: "automation",
+      DuplicateRule: "automation",
+      CustomField: "automation",
+      // a formula field referencing this one
+      ApexClass: "code",
+      ApexTrigger: "code",
+      LightningComponentBundle: "code",
+      AuraDefinitionBundle: "code",
+      VisualforcePage: "code",
+      VisualforceComponent: "code",
+      ExternalService: "integration",
+      ExternalDataSource: "integration",
+      NamedCredential: "integration",
+      Layout: "display",
+      QuickAction: "display",
+      FlexiPage: "display",
+      ListView: "display"
+    };
+    EMPTY_EDGE_SUMMARY = {
+      automation: [],
+      code: [],
+      integration: [],
+      display: []
+    };
+    buildBuckets = (classification, edges) => {
+      const { object, field, mutability, upsertKey } = classification;
+      if (mutability.mutability === "derived") {
+        return [
+          {
+            bucket: "save-pipeline",
+            severity: "info",
+            confidence: "confirmed",
+            summary: `Not directly changeable \u2014 ${mutability.reason}`,
+            evidence: []
+          }
+        ];
+      }
+      const buckets = [];
+      const identity = lookupIdentityCatalog(object, field);
+      if (identity !== null) {
+        buckets.push({
+          bucket: "identity",
+          severity: identity.severity,
+          confidence: upsertKey.isUpsertKey ? "confirmed" : "likely",
+          summary: `${identity.role} \u2014 changing the value alters how this record is identified/authenticated.`,
+          evidence: ["standard-identity-field catalog"]
+        });
+      }
+      const keySignals = upsertKey.signals.filter((s) => s === "externalId" || s === "idLookup");
+      if (keySignals.length > 0) {
+        const designedKey = keySignals.includes("externalId");
+        buckets.push({
+          bucket: "integration-key",
+          severity: designedKey ? "high" : "medium",
+          confidence: "confirmed",
+          summary: designedKey ? "Upsert / integration match key (External ID) \u2014 changing the value breaks inbound matching (next sync no-matches \u2192 duplicate or error) and desyncs external systems keyed on the old value." : "Upsert-capable key (idLookup) \u2014 an integration may upsert records by this field; changing the value could break that matching.",
+          evidence: [...keySignals.map((s) => `${s}=true`), ...edges.integration]
+        });
+      }
+      if (upsertKey.signals.includes("unique")) {
+        buckets.push({
+          bucket: "uniqueness",
+          severity: "medium",
+          confidence: "confirmed",
+          summary: "Unique field \u2014 a new value that collides with an existing record fails to save (DML error).",
+          evidence: ["unique=true"]
+        });
+      }
+      const automationRefs = [...edges.automation, ...edges.code];
+      if (automationRefs.length > 0) {
+        buckets.push({
+          bucket: "automation",
+          severity: edges.automation.length > 0 ? "medium" : "low",
+          confidence: "likely",
+          summary: `${automationRefs.length} automation/code component(s) reference this field; a value change may alter routing, validation, or sharing. Declarative value-couplings (where a rule compares this field to a literal) are surfaced when found; Apex literal comparisons remain invisible.`,
+          evidence: automationRefs.slice(0, 12)
+        });
+      }
+      const isDisplayIdentity = identity !== null && /display|nickname|alias/i.test(identity.role);
+      if (edges.display.length > 0 || isDisplayIdentity) {
+        buckets.push({
+          bucket: "display",
+          severity: "low",
+          confidence: "likely",
+          summary: "Appears on display surfaces (layouts / list views / UI); a value change is user-visible.",
+          evidence: edges.display.slice(0, 8)
+        });
+      }
+      buckets.push({
+        bucket: "save-pipeline",
+        severity: "info",
+        confidence: "likely",
+        summary: `Updating this field fires the save pipeline on ${object} (triggers / flows / rules) \u2014 relevant for bulk value changes.`,
+        evidence: []
+      });
+      return buckets;
+    };
+    buildDisclosures = (buckets) => {
+      const out = [];
+      const has = (b) => buckets.some((x) => x.bucket === b);
+      if (has("integration-key")) {
+        out.push("The metadata declares this an upsert key, but NOT which external system upserts on it \u2014 confirm the key in your middleware / ETL (Data Loader, MuleSoft, etc.) before bulk-changing values.");
+      }
+      if (has("identity")) {
+        out.push("If SSO maps users by this field, changing its value breaks login until the IdP is updated \u2014 verify with your IdP / My Domain SSO.");
+      }
+      if (has("automation")) {
+        out.push("Dynamic SOQL, reflective Apex field access, and managed-package code that compare this field to a value are invisible to the scanner \u2014 the listed automations are the visible subset.");
+      }
+      if (has("cross-object")) {
+        out.push("This key is replicated by name on other objects with no formal relationship \u2014 update the copies together, or they will silently desync.");
+      }
+      out.push("Reports, list-view filters, and manual processes may also key on this value.");
+      return out;
+    };
+    recommendedChecksFor = (buckets) => {
+      const checks = [];
+      const has = (b) => buckets.some((x) => x.bucket === b);
+      if (has("integration-key"))
+        checks.push("Confirm the external upsert key + whether the external system will re-match or duplicate on the new value.");
+      if (has("uniqueness"))
+        checks.push("Confirm the new value does not collide with an existing record (unique constraint).");
+      if (has("identity"))
+        checks.push("Confirm SSO/login impact with your IdP before changing identity values.");
+      if (has("automation"))
+        checks.push("Review the referencing automations for value-literal comparisons that the change would flip.");
+      if (has("cross-object"))
+        checks.push("Update the same-named copies on the other objects together \u2014 they are value-joined with no formal relationship.");
+      checks.push("For bulk changes, stage in a sandbox and watch the save pipeline (row locks, governor limits).");
+      return checks;
+    };
+    overallSeverityOf = (buckets) => buckets.reduce((acc, b) => maxSeverity(acc, b.severity), "info");
+    summarizeIncomingEdges = async (ctx, fieldId) => {
+      const edgesResult = await listEdges(ctx.graph, fieldId, { direction: "in" });
+      if (!edgesResult.ok) {
+        return err({ kind: "internal", message: `graph query failed: ${edgesResult.error.message}` });
+      }
+      const automation = [];
+      const code = [];
+      const integration = [];
+      const display = [];
+      for (const edge of edgesResult.value) {
+        if (edge.edgeType === "parentOf")
+          continue;
+        const fromResult = await getNodeById(ctx.graph, edge.fromId);
+        if (!fromResult.ok) {
+          return err({ kind: "internal", message: `graph query failed: ${fromResult.error.message}` });
+        }
+        const fromNode = fromResult.value;
+        if (fromNode === null)
+          continue;
+        const category = SOURCE_CATEGORY[fromNode.type];
+        if (category === "automation")
+          automation.push(fromNode.id);
+        else if (category === "code")
+          code.push(fromNode.id);
+        else if (category === "integration")
+          integration.push(fromNode.id);
+        else if (category === "display")
+          display.push(fromNode.id);
+      }
+      const dedupe = (xs) => [...new Set(xs)].sort();
+      return ok({
+        automation: dedupe(automation),
+        code: dedupe(code),
+        integration: dedupe(integration),
+        display: dedupe(display)
+      });
+    };
+    gateFederationIdentifier = async (ctx, buckets, codeRefs) => {
+      const samlRes = await listNodesByType(ctx.graph, "SamlSsoConfig", { limit: 200 });
+      if (!samlRes.ok)
+        return err({ kind: "internal", message: `graph query failed: ${samlRes.error.message}` });
+      const apRes = await listNodesByType(ctx.graph, "AuthProvider", { limit: 200 });
+      if (!apRes.ok)
+        return err({ kind: "internal", message: `graph query failed: ${apRes.error.message}` });
+      const configs = samlRes.value;
+      const mappings = configs.map((n) => String(n.properties["identityMapping"] ?? "Username"));
+      const fedConfigs = configs.filter((n) => n.properties["identityMapping"] === "FederationId");
+      const oidcLogin = apRes.value.filter((ap) => {
+        const rh = ap.properties["registrationHandler"];
+        return typeof rh === "string" && rh.length > 0 || ap.properties["providerType"] === "OpenIdConnect";
+      });
+      const others = buckets.filter((b) => b.bucket !== "identity");
+      let identity;
+      let disclosure;
+      if (fedConfigs.length > 0) {
+        identity = {
+          bucket: "identity",
+          severity: "critical",
+          confidence: "confirmed",
+          summary: `SAML SSO maps users by Federation ID (${fedConfigs.length} SamlSsoConfig) \u2014 changing this value breaks SSO login until the IdP is updated.`,
+          evidence: fedConfigs.map((c) => c.id)
+        };
+      } else if (oidcLogin.length > 0) {
+        const handlers = [...new Set(oidcLogin.map((a) => a.properties["registrationHandler"]).filter((s) => typeof s === "string" && s.length > 0))];
+        const handlersRefFed = handlers.filter((h) => codeRefs.includes(`ApexClass:${h}`));
+        if (handlersRefFed.length > 0) {
+          identity = {
+            bucket: "identity",
+            severity: "medium",
+            confidence: "likely",
+            summary: `OIDC / social SSO registration handler(s) ${handlersRefFed.join(", ")} reference FederationIdentifier (heuristic Apex scan) \u2014 it is part of the OIDC identity mapping; changing the value may break login.`,
+            evidence: [...oidcLogin.map((a) => a.id), ...handlersRefFed.map((h) => `ApexClass:${h}`)]
+          };
+          disclosure = "The handler-to-FederationIdentifier link is from the heuristic Apex scanner (token-level); cross-method dataflow, dynamic SOQL, and reflective field access are invisible \u2014 confirm in the handler source + ThirdPartyAccountLink.";
+        } else {
+          identity = {
+            bucket: "identity",
+            severity: "medium",
+            confidence: "likely",
+            summary: `OIDC / social SSO login provider(s) present (${oidcLogin.map((a) => a.apiName).slice(0, 3).join(", ")}); the mapping is in an Apex registration handler \u2014 the heuristic scan found no FederationIdentifier reference there, but it may map it dynamically.`,
+            evidence: oidcLogin.map((a) => a.id)
+          };
+          disclosure = `OIDC/social SSO maps identity in an Apex registration handler${handlers.length > 0 ? ` (${handlers.slice(0, 2).join(", ")})` : ""}; the scan saw no FederationIdentifier reference, but dynamic / reflective field access is invisible \u2014 verify the handler + ThirdPartyAccountLink before changing values.`;
+        }
+      } else if (configs.length > 0) {
+        identity = {
+          bucket: "identity",
+          severity: "low",
+          confidence: "confirmed",
+          summary: `SAML SSO maps by ${[...new Set(mappings)].join("/")}, not Federation ID, and no OIDC login provider is present \u2014 this field is not the SSO subject here.`,
+          evidence: configs.map((c) => c.id)
+        };
+      } else {
+        identity = {
+          bucket: "identity",
+          severity: "low",
+          confidence: "likely",
+          summary: "No SAML SSO config and no OIDC/social login provider in the vault \u2014 Federation ID is not in use for SSO here.",
+          evidence: []
+        };
+        disclosure = "No SamlSsoConfig or login-capable AuthProvider in the vault: if SSO is configured outside retrievable metadata, changing FederationIdentifier could still affect login \u2014 verify with your IdP.";
+      }
+      return ok({ buckets: [identity, ...others], ...disclosure !== void 0 ? { disclosure } : {} });
+    };
+    detectShadowJoin = async (ctx, classification) => {
+      const { object, field, upsertKey } = classification;
+      const keyish = upsertKey.isUpsertKey || /(_ID|_SIS_ID|Key|_uuid|_guid|Code)__c$/i.test(field);
+      if (!keyish)
+        return ok(null);
+      const all = [];
+      let offset = 0;
+      for (; ; ) {
+        const res = await listNodesByType(ctx.graph, "CustomField", { limit: 500, offset });
+        if (!res.ok)
+          return err({ kind: "internal", message: `graph query failed: ${res.error.message}` });
+        all.push(...res.value);
+        if (res.value.length < 500)
+          break;
+        offset += 500;
+      }
+      const objOf = (n) => parseFieldId(n.id)?.object ?? "?";
+      const sameName = all.filter((n) => parseFieldId(n.id)?.field === field);
+      if (sameName.length <= 1)
+        return ok(null);
+      const masters = sameName.filter((n) => n.properties["externalId"] === true);
+      if (masters.length === 0)
+        return ok(null);
+      const otherObjects = sameName.filter((n) => objOf(n) !== object);
+      if (otherObjects.length === 0)
+        return ok(null);
+      const masterObjs = [...new Set(masters.map(objOf))].sort();
+      const copyObjs = [...new Set(sameName.filter((n) => n.properties["externalId"] !== true).map(objOf))].sort();
+      const thisIsMaster = upsertKey.signals.includes("externalId");
+      return ok({
+        bucket: "cross-object",
+        severity: thisIsMaster ? "high" : "medium",
+        confidence: "likely",
+        summary: `'${field}' is replicated on ${sameName.length} objects \u2014 External-ID key on [${masterObjs.join(", ")}]${copyObjs.length > 0 ? `, plain copy on [${copyObjs.join(", ")}]` : ""}. These are value-joined with no formal relationship; changing the value here can silently desync the copies.`,
+        evidence: sameName.map((n) => n.id).sort()
+      });
+    };
+    extractQuotedLiterals = (expr) => {
+      const out = [];
+      const re = /["']([^"']{1,40})["']/g;
+      let m;
+      while ((m = re.exec(expr)) !== null)
+        out.push(m[1]);
+      return out;
+    };
+    normalizeExpr = (expr) => typeof expr === "string" ? expr.replace(/\s+/g, " ").trim().slice(0, 120) : "";
+    findValueCouplings = async (ctx, fieldId) => {
+      const leaf = parseFieldId(fieldId)?.field ?? fieldId;
+      const re = new RegExp(`\\b${leaf}\\b`);
+      const matched = [];
+      let offset = 0;
+      for (; ; ) {
+        const res = await listNodesByType(ctx.graph, "ConditionalContext", { limit: 500, offset });
+        if (!res.ok)
+          return err({ kind: "internal", message: `graph query failed: ${res.error.message}` });
+        for (const n of res.value) {
+          const refs = Array.isArray(n.properties["fieldRefs"]) ? n.properties["fieldRefs"] : [];
+          const expr = n.properties["expression"];
+          if (refs.includes(fieldId) || typeof expr === "string" && re.test(expr))
+            matched.push(n);
+        }
+        if (res.value.length < 500)
+          break;
+        offset += 500;
+      }
+      const expressions = [...new Set(matched.map((n) => normalizeExpr(n.properties["expression"])).filter((s) => s.length > 0))].slice(0, 8);
+      const literals = [...new Set(matched.flatMap((n) => extractQuotedLiterals(String(n.properties["expression"] ?? ""))))].slice(0, 12);
+      return ok({ expressions, literals });
+    };
+    assessValueChange = async (ctx, node) => {
+      const classification = classifyField(node);
+      const mutable = classification.mutability.mutability === "writable";
+      const edgesResult = mutable ? await summarizeIncomingEdges(ctx, node.id) : ok(EMPTY_EDGE_SUMMARY);
+      if (!edgesResult.ok)
+        return err(edgesResult.error);
+      let buckets = buildBuckets(classification, edgesResult.value);
+      const extraDisclosures = [];
+      if (mutable && classification.field === "FederationIdentifier") {
+        const gated = await gateFederationIdentifier(ctx, buckets, edgesResult.value.code);
+        if (!gated.ok)
+          return err(gated.error);
+        buckets = gated.value.buckets;
+        if (gated.value.disclosure !== void 0)
+          extraDisclosures.push(gated.value.disclosure);
+      }
+      if (mutable) {
+        const shadow = await detectShadowJoin(ctx, classification);
+        if (!shadow.ok)
+          return err(shadow.error);
+        if (shadow.value !== null)
+          buckets = [...buckets, shadow.value];
+      }
+      if (mutable) {
+        const cp = await findValueCouplings(ctx, node.id);
+        if (!cp.ok)
+          return err(cp.error);
+        if (cp.value.expressions.length > 0) {
+          const existing = buckets.find((b) => b.bucket === "automation");
+          const enriched = {
+            bucket: "automation",
+            severity: existing?.severity ?? "medium",
+            confidence: "confirmed",
+            summary: `Value-coupled in ${cp.value.expressions.length} declarative condition(s)${cp.value.literals.length > 0 ? ` (literals: ${cp.value.literals.slice(0, 6).join(", ")})` : ""} \u2014 changing the value may flip them. e.g. ${cp.value.expressions.slice(0, 3).join(" | ")}`,
+            evidence: [...existing?.evidence ?? [], ...cp.value.expressions.slice(0, 6)]
+          };
+          buckets = [...buckets.filter((b) => b.bucket !== "automation"), enriched];
+        }
+      }
+      return ok({
+        fieldId: node.id,
+        object: classification.object,
+        field: classification.field,
+        mutable,
+        overallSeverity: overallSeverityOf(buckets),
+        buckets,
+        disclosures: mutable ? [...buildDisclosures(buckets), ...extraDisclosures] : [],
+        recommendedChecks: mutable ? recommendedChecksFor(buckets) : ["Change the source field(s) instead \u2014 this value is derived."]
+      });
+    };
+  }
+});
+
+// ../mcp/dist/src/tools/value-change-audit.js
+import { z as z105 } from "zod";
+var VALUE_CHANGE_REQUIRED_COVERAGE, MAX_ROWS, PAGE, DISCLOSURE9, GLOBAL_DISCLOSURES, valueChangeAuditInputSchema, coverageCaveatFor3, listObjectFields, isCandidate, buildRow2, valueChangeAuditHandler;
+var init_value_change_audit = __esm({
+  "../mcp/dist/src/tools/value-change-audit.js"() {
+    "use strict";
+    init_dist();
+    init_src();
+    init_src2();
+    init_value_change_classification();
+    init_value_change_risk();
+    VALUE_CHANGE_REQUIRED_COVERAGE = [
+      "CustomField",
+      "ValidationRule",
+      "Flow",
+      "ApexClass",
+      "ApexTrigger",
+      "WorkflowRule",
+      "Layout",
+      "SharingRule",
+      "DuplicateRule"
+    ];
+    MAX_ROWS = 200;
+    PAGE = 500;
+    DISCLOSURE9 = "value_change_audit ranks fields by the impact of changing their stored VALUE (not schema). Auto-detect surfaces upsert keys (externalId/unique/idLookup), identity-catalog fields, and name-lexicon matches \u2014 it can miss a value-sensitive field that carries none of those signals, and the per-row blast radius inherits what_if_change_field_value\u2019s boundaries (external upsert systems, the IdP side of SSO, and dynamic/managed-package code are invisible).";
+    GLOBAL_DISCLOSURES = [
+      "External systems that upsert on these keys live outside org metadata \u2014 confirm them in your middleware / ETL.",
+      "SSO identity mapping (which field the IdP asserts) is read from SamlSsoConfig when present; verify your IdP.",
+      "Reports, list-view filters, and manual processes may key on these values."
+    ];
+    valueChangeAuditInputSchema = z105.object({
+      object: z105.string().min(1),
+      fields: z105.array(z105.string()).optional(),
+      verbosity: z105.enum(["summary", "detail"]).optional()
+    });
+    coverageCaveatFor3 = (ctx) => {
+      const coverage = summarizeCoverage(ctx.manifest, VALUE_CHANGE_REQUIRED_COVERAGE);
+      if (coverage.status === "complete")
+        return void 0;
+      const missingCoverage = coverage.missingCoverage.length > 0 ? coverage.missingCoverage : [...VALUE_CHANGE_REQUIRED_COVERAGE];
+      return {
+        status: coverage.status === "partial" ? "partial" : "unknown",
+        missingCoverage,
+        message: `Value-change audit is incomplete because the vault lacks coverage for: ${missingCoverage.join(", ")}.`
+      };
+    };
+    listObjectFields = async (ctx, objectId) => {
+      const all = [];
+      let offset = 0;
+      for (; ; ) {
+        const res = await listNodesByType(ctx.graph, "CustomField", { parentId: objectId, limit: PAGE, offset });
+        if (!res.ok)
+          return err({ kind: "internal", message: `graph query failed: ${res.error.message}` });
+        all.push(...res.value);
+        if (res.value.length < PAGE)
+          break;
+        offset += PAGE;
+      }
+      return ok(all);
+    };
+    isCandidate = (node) => {
+      const c = classifyField(node);
+      if (c.mutability.mutability === "derived")
+        return false;
+      return c.upsertKey.isUpsertKey || lookupIdentityCatalog(c.object, c.field) !== null || severityRank(c.role.severity) >= severityRank("medium");
+    };
+    buildRow2 = (assessment, node, verbosity) => {
+      const classification = classifyField(node);
+      const topReasons = [...assessment.buckets].filter((b) => b.severity !== "info").sort((a, b) => severityRank(b.severity) - severityRank(a.severity)).slice(0, 3).map((b) => `${b.bucket} (${b.severity})`);
+      return {
+        field: assessment.field,
+        fieldId: assessment.fieldId,
+        role: classification.role.role,
+        overallSeverity: assessment.overallSeverity,
+        mutable: assessment.mutable,
+        topReasons,
+        confidence: classification.role.confidence,
+        disclosureCount: assessment.disclosures.length,
+        ...verbosity === "detail" ? { buckets: assessment.buckets } : {}
+      };
+    };
+    valueChangeAuditHandler = async (ctx, input2) => {
+      const object = input2.object;
+      const objectId = `CustomObject:${object}`;
+      const verbosity = input2.verbosity ?? "summary";
+      let candidates = [];
+      let autoDetected;
+      let scannedFieldCount;
+      const notFound = [];
+      if (input2.fields !== void 0 && input2.fields.length > 0) {
+        autoDetected = false;
+        scannedFieldCount = input2.fields.length;
+        for (const f of input2.fields) {
+          const id = f.startsWith("CustomField:") ? f : `CustomField:${object}.${f}`;
+          const nodeResult = await getNodeById(ctx.graph, id);
+          if (!nodeResult.ok)
+            return err({ kind: "internal", message: `graph query failed: ${nodeResult.error.message}` });
+          if (nodeResult.value === null) {
+            notFound.push(f);
+            continue;
+          }
+          candidates.push(nodeResult.value);
+        }
+      } else {
+        autoDetected = true;
+        const fieldsResult = await listObjectFields(ctx, objectId);
+        if (!fieldsResult.ok)
+          return err(fieldsResult.error);
+        scannedFieldCount = fieldsResult.value.length;
+        candidates = fieldsResult.value.filter(isCandidate);
+      }
+      const rows = [];
+      for (const node of candidates) {
+        const assessmentResult = await assessValueChange(ctx, node);
+        if (!assessmentResult.ok)
+          return err(assessmentResult.error);
+        rows.push(buildRow2(assessmentResult.value, node, verbosity));
+      }
+      rows.sort((a, b) => severityRank(b.overallSeverity) - severityRank(a.overallSeverity) || (a.field < b.field ? -1 : a.field > b.field ? 1 : 0));
+      const truncated = rows.length > MAX_ROWS;
+      const shownRows = truncated ? rows.slice(0, MAX_ROWS) : rows;
+      const summary = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+      for (const r of rows)
+        summary[r.overallSeverity] += 1;
+      const coverageCaveat = coverageCaveatFor3(ctx);
+      const confidence = rows.some((r) => r.topReasons.some((t) => t.startsWith("automation"))) ? "heuristic" : "declared";
+      return ok({
+        data: {
+          object,
+          autoDetected,
+          scannedFieldCount,
+          rows: shownRows,
+          truncated,
+          summary,
+          globalDisclosures: GLOBAL_DISCLOSURES,
+          ...notFound.length > 0 ? { notFound } : {},
+          ...coverageCaveat !== void 0 ? { coverageCaveat } : {},
+          trust: {
+            provenance: "offline_snapshot",
+            confidence,
+            freshness: { snapshotRefreshedAt: ctx.manifest.refreshedAt },
+            completeness: {
+              status: coverageCaveat === void 0 ? "complete" : coverageCaveat.status,
+              ...coverageCaveat !== void 0 ? { missingCoverage: coverageCaveat.missingCoverage } : {}
+            },
+            limitations: [DISCLOSURE9, ...coverageCaveat !== void 0 ? [coverageCaveat.message] : []]
+          },
+          disclosure: DISCLOSURE9
+        },
+        vaultState: {
+          sourceTreeHash: ctx.manifest.sourceTreeHash,
+          refreshedAt: ctx.manifest.refreshedAt
+        }
+      });
+    };
+  }
+});
+
 // ../mcp/dist/src/tools/what-happens-on-save.js
-import { z as z103 } from "zod";
-var DISCLOSURE7, ALLOWED_EVENTS, whatHappensOnSaveInputSchema, workflowMatchesEvent2, flowMatchesEvent2, triggerMatchesEvent2, surfaceFirstCondition2, buildActions2, buildStep2, fetchParentedFirers2, fetchTriggersOnFirers2, buildAsyncSteps2, ASSIGNMENT_TYPES2, APPROVAL_TYPES2, VALIDATION_TYPES2, FLOW_TYPES2, TRIGGER_TYPES2, WORKFLOW_TYPES2, whatHappensOnSaveHandler;
+import { z as z106 } from "zod";
+var DISCLOSURE10, ALLOWED_EVENTS, whatHappensOnSaveInputSchema, workflowMatchesEvent2, flowMatchesEvent2, triggerMatchesEvent2, surfaceFirstCondition2, buildActions2, buildStep2, fetchParentedFirers2, fetchTriggersOnFirers2, buildAsyncSteps2, ASSIGNMENT_TYPES2, APPROVAL_TYPES2, VALIDATION_TYPES2, FLOW_TYPES2, TRIGGER_TYPES2, WORKFLOW_TYPES2, whatHappensOnSaveHandler;
 var init_what_happens_on_save = __esm({
   "../mcp/dist/src/tools/what-happens-on-save.js"() {
     "use strict";
@@ -26303,7 +28022,7 @@ var init_what_happens_on_save = __esm({
     init_src();
     init_soe_admission();
     init_soe_payload_bounds();
-    DISCLOSURE7 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
+    DISCLOSURE10 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
     ALLOWED_EVENTS = [
       "insert",
       "update",
@@ -26311,13 +28030,13 @@ var init_what_happens_on_save = __esm({
       "delete",
       "undelete"
     ];
-    whatHappensOnSaveInputSchema = z103.object({
-      objectApiName: z103.string().min(1),
+    whatHappensOnSaveInputSchema = z106.object({
+      objectApiName: z106.string().min(1),
       // Accept "after update" / "Before Insert" etc.: lower-case and drop the
       // before/after timing prefix so the bare DML event matches the enum. The
       // SOE walker models both timings internally; the event arg selects the row.
-      event: z103.preprocess((v) => typeof v === "string" ? v.trim().toLowerCase().replace(/^(?:before|after)\s+/, "") : v, z103.enum(ALLOWED_EVENTS)),
-      recordTypeId: z103.string().min(1).optional()
+      event: z106.preprocess((v) => typeof v === "string" ? v.trim().toLowerCase().replace(/^(?:before|after)\s+/, "") : v, z106.enum(ALLOWED_EVENTS)),
+      recordTypeId: z106.string().min(1).optional()
     });
     workflowMatchesEvent2 = (triggerType, event) => {
       if (typeof triggerType !== "string")
@@ -26683,7 +28402,7 @@ var init_what_happens_on_save = __esm({
           conditionalSteps: conditionalCount,
           asyncFanOut
         },
-        disclosure: composeSoeDisclosure(DISCLOSURE7, objectModeled)
+        disclosure: composeSoeDisclosure(DISCLOSURE10, objectModeled)
       };
       const budget = enforceSoeByteBudget(data, [soe]);
       if (budget.truncated) {
@@ -26701,26 +28420,111 @@ var init_what_happens_on_save = __esm({
   }
 });
 
-// ../mcp/dist/src/tools/phantom-node.js
-var phantomAwareNotFoundMessage;
-var init_phantom_node = __esm({
-  "../mcp/dist/src/tools/phantom-node.js"() {
+// ../mcp/dist/src/tools/what-if-change-field-value.js
+import { z as z107 } from "zod";
+var CUSTOM_FIELD_PREFIX12, VALUE_CHANGE_REQUIRED_COVERAGE2, DISCLOSURE11, whatIfChangeFieldValueInputSchema, coverageCaveatFor4, whatIfChangeFieldValueHandler;
+var init_what_if_change_field_value = __esm({
+  "../mcp/dist/src/tools/what-if-change-field-value.js"() {
     "use strict";
+    init_dist();
     init_src();
-    phantomAwareNotFoundMessage = async (ctx, id, kindLabel) => {
-      const inbound = await listEdges(ctx.graph, id, { direction: "in" });
-      const refs = inbound.ok ? inbound.value.length : 0;
-      if (refs === 0) {
-        return `no ${kindLabel} with id ${id}`;
+    init_src2();
+    init_value_change_risk();
+    CUSTOM_FIELD_PREFIX12 = "CustomField:";
+    VALUE_CHANGE_REQUIRED_COVERAGE2 = [
+      "CustomField",
+      "ValidationRule",
+      "Flow",
+      "ApexClass",
+      "ApexTrigger",
+      "WorkflowRule",
+      "Layout",
+      "SharingRule",
+      "DuplicateRule"
+    ];
+    DISCLOSURE11 = "Value-change impact analyzes what breaks if this field\u2019s stored VALUE changes (not its schema) \u2014 distinct from what_if_change_field_type, which walks references. Identity / integration-key / uniqueness verdicts come from the field\u2019s own metadata (externalId / unique / idLookup, identity catalog); automation buckets surface the declarative value-literal coupling (the value a rule compares this field to); Apex literal comparisons remain invisible. The vault cannot see external upsert systems, the IdP side of SSO, or dynamic / managed-package code \u2014 see disclosures.";
+    whatIfChangeFieldValueInputSchema = z107.object({
+      fieldId: z107.string().min(1),
+      newValue: z107.string().optional()
+    });
+    coverageCaveatFor4 = (ctx) => {
+      const coverage = summarizeCoverage(ctx.manifest, VALUE_CHANGE_REQUIRED_COVERAGE2);
+      if (coverage.status === "complete")
+        return void 0;
+      const missingCoverage = coverage.missingCoverage.length > 0 ? coverage.missingCoverage : [...VALUE_CHANGE_REQUIRED_COVERAGE2];
+      return {
+        status: coverage.status === "partial" ? "partial" : "unknown",
+        missingCoverage,
+        message: `Value-change impact is incomplete because the vault lacks coverage for: ${missingCoverage.join(", ")}. Absence of impacts in those families means "not checked", not "safe".`
+      };
+    };
+    whatIfChangeFieldValueHandler = async (ctx, input2) => {
+      if (!input2.fieldId.startsWith(CUSTOM_FIELD_PREFIX12)) {
+        return err({
+          kind: "invalid-query",
+          message: `fieldId must start with '${CUSTOM_FIELD_PREFIX12}'; got '${input2.fieldId}'`,
+          path: "fieldId"
+        });
       }
-      return `\`${id}\` is referenced by ${refs} other component(s) in this org (e.g. code, tests, or permission grants) but its own ${kindLabel} definition was never retrieved into the vault \u2014 typically a managed-package component or one outside the retrieve scope. Run \`sfi refresh\` if it should be retrievable; otherwise treat it as external.`;
+      const fieldId = input2.fieldId;
+      const nodeResult = await getNodeById(ctx.graph, fieldId);
+      if (!nodeResult.ok) {
+        return err({ kind: "internal", message: `graph query failed: ${nodeResult.error.message}` });
+      }
+      if (nodeResult.value === null) {
+        return err({ kind: "component-not-found", message: `no field with id ${fieldId}`, path: fieldId });
+      }
+      const assessmentResult = await assessValueChange(ctx, nodeResult.value);
+      if (!assessmentResult.ok)
+        return err(assessmentResult.error);
+      const a = assessmentResult.value;
+      const recommendedChecks = input2.newValue !== void 0 ? [
+        `Verify the proposed value "${input2.newValue}" does not collide on a unique/external-ID field and is accepted by referencing automation.`,
+        ...a.recommendedChecks
+      ] : a.recommendedChecks;
+      const coverageCaveat = coverageCaveatFor4(ctx);
+      const hasAutomation = a.buckets.some((b) => b.bucket === "automation");
+      const confidence = hasAutomation ? "heuristic" : "declared";
+      return ok({
+        data: {
+          fieldId,
+          object: a.object,
+          field: a.field,
+          mutable: a.mutable,
+          overallSeverity: a.overallSeverity,
+          buckets: a.buckets,
+          disclosures: a.disclosures,
+          recommendedChecks,
+          ...input2.newValue !== void 0 ? { newValue: input2.newValue } : {},
+          ...coverageCaveat !== void 0 ? { coverageCaveat } : {},
+          trust: {
+            provenance: "offline_snapshot",
+            confidence,
+            freshness: { snapshotRefreshedAt: ctx.manifest.refreshedAt },
+            completeness: {
+              status: coverageCaveat === void 0 ? "complete" : coverageCaveat.status,
+              ...coverageCaveat !== void 0 ? { missingCoverage: coverageCaveat.missingCoverage } : {}
+            },
+            limitations: [
+              DISCLOSURE11,
+              ...a.disclosures,
+              ...coverageCaveat !== void 0 ? [coverageCaveat.message] : []
+            ]
+          },
+          disclosure: DISCLOSURE11
+        },
+        vaultState: {
+          sourceTreeHash: ctx.manifest.sourceTreeHash,
+          refreshedAt: ctx.manifest.refreshedAt
+        }
+      });
     };
   }
 });
 
 // ../mcp/dist/src/tools/what-if-change-method-signature.js
-import { z as z104 } from "zod";
-var APEX_CLASS_PREFIX9, DISCLOSURE8, whatIfChangeMethodSignatureInputSchema, readMethodName, isTestClass8, buildExplanation2, classifyCaller, aggregateVerdict4, compareImpacts, compareIds, collectCallers, collectCoveringTests, whatIfChangeMethodSignatureHandler;
+import { z as z108 } from "zod";
+var APEX_CLASS_PREFIX9, DISCLOSURE12, whatIfChangeMethodSignatureInputSchema, readMethodName, isTestClass8, buildExplanation2, classifyCaller, aggregateVerdict4, compareImpacts, compareIds, collectCallers, collectCoveringTests, whatIfChangeMethodSignatureHandler;
 var init_what_if_change_method_signature = __esm({
   "../mcp/dist/src/tools/what-if-change-method-signature.js"() {
     "use strict";
@@ -26730,11 +28534,11 @@ var init_what_if_change_method_signature = __esm({
     init_coverage_trust();
     init_phantom_node();
     APEX_CLASS_PREFIX9 = "ApexClass:";
-    DISCLOSURE8 = "callers identified via the v1.4 apex-scanner are at heuristic confidence; dynamic dispatch via Type.forName + invoke is invisible. Test classes are identified by @isTest + naming convention (className + 'Test' suffix) and by coversTest edges; a test class that doesn't follow the naming convention and doesn't carry a @TestVisible-tagged covering reference may be missed.";
-    whatIfChangeMethodSignatureInputSchema = z104.object({
-      classApiName: z104.string().min(1),
-      methodName: z104.string().min(1),
-      newSignature: z104.string().optional()
+    DISCLOSURE12 = "callers identified via the v1.4 apex-scanner are at heuristic confidence; dynamic dispatch via Type.forName + invoke is invisible. Test classes are identified by @isTest + naming convention (className + 'Test' suffix) and by coversTest edges; a test class that doesn't follow the naming convention and doesn't carry a @TestVisible-tagged covering reference may be missed.";
+    whatIfChangeMethodSignatureInputSchema = z108.object({
+      classApiName: z108.string().min(1),
+      methodName: z108.string().min(1),
+      newSignature: z108.string().optional()
     });
     readMethodName = (edge) => {
       const raw = edge.properties["methodName"];
@@ -26915,7 +28719,7 @@ var init_what_if_change_method_signature = __esm({
           verdict: coverage.verdict,
           ...coverage.coverageCaveat !== void 0 ? { coverageCaveat: coverage.coverageCaveat } : {},
           trust: coverage.trust,
-          disclosure: DISCLOSURE8
+          disclosure: DISCLOSURE12
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -26927,8 +28731,8 @@ var init_what_if_change_method_signature = __esm({
 });
 
 // ../mcp/dist/src/tools/what-if-deactivate-flow.js
-import { z as z105 } from "zod";
-var FLOW_PREFIX3, DISCLOSURE9, whatIfDeactivateFlowInputSchema, stripPrefix2, readFlowStatus2, classifyOutgoingEdge, buildExplanation3, aggregateVerdict5, compareImpacts2, collectFiringConditions, whatIfDeactivateFlowHandler;
+import { z as z109 } from "zod";
+var FLOW_PREFIX3, DISCLOSURE13, whatIfDeactivateFlowInputSchema, stripPrefix2, readFlowStatus2, classifyOutgoingEdge, buildExplanation3, aggregateVerdict5, compareImpacts2, collectFiringConditions, whatIfDeactivateFlowHandler;
 var init_what_if_deactivate_flow = __esm({
   "../mcp/dist/src/tools/what-if-deactivate-flow.js"() {
     "use strict";
@@ -26937,9 +28741,9 @@ var init_what_if_deactivate_flow = __esm({
     init_coerce_id();
     init_coverage_trust();
     FLOW_PREFIX3 = "Flow:";
-    DISCLOSURE9 = "v2.3 what-if analysis is composition over the v2.2 vault state. Deactivating a Flow stops every action listed in impacts; the Flow's definition remains in the org and a later reactivation restores the effects. Apex code that conditionally invokes the Flow via Flow.Interview or @InvocableMethod chains is invisible to the heuristic walker; review callers via sfi.find_code_usages targeting the Flow id before relying on this finding.";
-    whatIfDeactivateFlowInputSchema = z105.object({
-      flowId: z105.string().min(1)
+    DISCLOSURE13 = "v2.3 what-if analysis is composition over the v2.2 vault state. Deactivating a Flow stops every action listed in impacts; the Flow's definition remains in the org and a later reactivation restores the effects. Apex code that conditionally invokes the Flow via Flow.Interview or @InvocableMethod chains is invisible to the heuristic walker; review callers via sfi.find_code_usages targeting the Flow id before relying on this finding.";
+    whatIfDeactivateFlowInputSchema = z109.object({
+      flowId: z109.string().min(1)
     });
     stripPrefix2 = (id) => {
       const colonIdx = id.indexOf(":");
@@ -27097,7 +28901,7 @@ var init_what_if_deactivate_flow = __esm({
           verdict: coverage.verdict,
           ...coverage.coverageCaveat !== void 0 ? { coverageCaveat: coverage.coverageCaveat } : {},
           trust: coverage.trust,
-          disclosure: DISCLOSURE9
+          disclosure: DISCLOSURE13
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -27109,8 +28913,8 @@ var init_what_if_deactivate_flow = __esm({
 });
 
 // ../mcp/dist/src/tools/what-if-disable-trigger.js
-import { z as z106 } from "zod";
-var APEX_TRIGGER_PREFIX7, DISCLOSURE10, whatIfDisableTriggerInputSchema, readTriggerStatus, readTriggerEvents, classifyOutgoingEdge2, buildExplanation4, aggregateVerdict6, compareImpacts3, findParentObject, whatIfDisableTriggerHandler;
+import { z as z110 } from "zod";
+var APEX_TRIGGER_PREFIX7, DISCLOSURE14, whatIfDisableTriggerInputSchema, readTriggerStatus, readTriggerEvents, classifyOutgoingEdge2, buildExplanation4, aggregateVerdict6, compareImpacts3, findParentObject, whatIfDisableTriggerHandler;
 var init_what_if_disable_trigger = __esm({
   "../mcp/dist/src/tools/what-if-disable-trigger.js"() {
     "use strict";
@@ -27118,9 +28922,9 @@ var init_what_if_disable_trigger = __esm({
     init_src();
     init_coverage_trust();
     APEX_TRIGGER_PREFIX7 = "ApexTrigger:";
-    DISCLOSURE10 = "v2.3 what-if analysis is composition over the v2.2 vault state. Disabling a trigger stops every action listed in impacts; the trigger definition remains in the org and a later re-enable restores the effects. The v0.3 apex-scanner's edge confidence is heuristic for most outgoing edges; spot-check the trigger body when a finding's confidence is heuristic. Indirect dispatch via trigger framework base classes (TriggerHandler, fflib) may be partially invisible to the recognizer.";
-    whatIfDisableTriggerInputSchema = z106.object({
-      triggerId: z106.string().min(1)
+    DISCLOSURE14 = "v2.3 what-if analysis is composition over the v2.2 vault state. Disabling a trigger stops every action listed in impacts; the trigger definition remains in the org and a later re-enable restores the effects. The v0.3 apex-scanner's edge confidence is heuristic for most outgoing edges; spot-check the trigger body when a finding's confidence is heuristic. Indirect dispatch via trigger framework base classes (TriggerHandler, fflib) may be partially invisible to the recognizer.";
+    whatIfDisableTriggerInputSchema = z110.object({
+      triggerId: z110.string().min(1)
     });
     readTriggerStatus = (node) => {
       const raw = node.properties["status"];
@@ -27271,7 +29075,7 @@ var init_what_if_disable_trigger = __esm({
           verdict: coverage.verdict,
           ...coverage.coverageCaveat !== void 0 ? { coverageCaveat: coverage.coverageCaveat } : {},
           trust: coverage.trust,
-          disclosure: DISCLOSURE10
+          disclosure: DISCLOSURE14
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -27283,22 +29087,22 @@ var init_what_if_disable_trigger = __esm({
 });
 
 // ../mcp/dist/src/tools/what-if-merge-profiles.js
-import { z as z107 } from "zod";
-var PROFILE_PREFIX, DISCLOSURE11, MERGE_DEFAULT_LIMIT, MERGE_MAX_LIMIT, whatIfMergeProfilesInputSchema, readUserPermissions, readTabVisibilities, readLayoutAssignments2, readRecordTypeVisibilities, classifyGrantTarget, stripPrefix3, fieldGrantToLevel, gatherGrants, gatherProfileSettings, objectFlagsEqual, recordTypeVisibilityEqual, compareScalarMaps, compareObjectPermissions, compareFieldPermissions, compareTabVisibilities, compareLayoutAssignments, compareRecordTypeVisibilities, fetchProfile, sortConflicts, whatIfMergeProfilesHandler;
+import { z as z111 } from "zod";
+var PROFILE_PREFIX, DISCLOSURE15, MERGE_DEFAULT_LIMIT, MERGE_MAX_LIMIT, whatIfMergeProfilesInputSchema, readUserPermissions, readTabVisibilities, readLayoutAssignments2, readRecordTypeVisibilities, classifyGrantTarget, stripPrefix3, fieldGrantToLevel, gatherGrants, gatherProfileSettings, objectFlagsEqual, recordTypeVisibilityEqual, compareScalarMaps, compareObjectPermissions, compareFieldPermissions, compareTabVisibilities, compareLayoutAssignments, compareRecordTypeVisibilities, fetchProfile, sortConflicts, whatIfMergeProfilesHandler;
 var init_what_if_merge_profiles = __esm({
   "../mcp/dist/src/tools/what-if-merge-profiles.js"() {
     "use strict";
     init_dist();
     init_src();
     PROFILE_PREFIX = "Profile:";
-    DISCLOSURE11 = "v2.3 surfaces conflicts but does NOT auto-resolve. Recommended policies are heuristic; manually verify each conflict before applying. Profile-edition rollup (e.g., admin-level overrides) is not modeled.";
+    DISCLOSURE15 = "v2.3 surfaces conflicts but does NOT auto-resolve. Recommended policies are heuristic; manually verify each conflict before applying. Profile-edition rollup (e.g., admin-level overrides) is not modeled.";
     MERGE_DEFAULT_LIMIT = 120;
     MERGE_MAX_LIMIT = 2e3;
-    whatIfMergeProfilesInputSchema = z107.object({
-      profileIdA: z107.string().min(1),
-      profileIdB: z107.string().min(1),
-      limit: z107.number().int().min(1).max(MERGE_MAX_LIMIT).optional(),
-      offset: z107.number().int().min(0).optional()
+    whatIfMergeProfilesInputSchema = z111.object({
+      profileIdA: z111.string().min(1),
+      profileIdB: z111.string().min(1),
+      limit: z111.number().int().min(1).max(MERGE_MAX_LIMIT).optional(),
+      offset: z111.number().int().min(0).optional()
     });
     readUserPermissions = (profile) => {
       const raw = profile.properties["userPermissions"];
@@ -27683,7 +29487,7 @@ var init_what_if_merge_profiles = __esm({
       const page = conflicts.slice(offset, offset + limit);
       const hasMore = offset + page.length < conflicts.length;
       const truncated = hasMore || offset > 0;
-      const disclosure = truncated ? `${DISCLOSURE11} Returning conflicts ${offset}\u2013${offset + page.length} of ${conflicts.length} (page size ${limit}); summary.byCategory / byPolicy hold the COMPLETE counts. Page through the rest with offset/limit.` : DISCLOSURE11;
+      const disclosure = truncated ? `${DISCLOSURE15} Returning conflicts ${offset}\u2013${offset + page.length} of ${conflicts.length} (page size ${limit}); summary.byCategory / byPolicy hold the COMPLETE counts. Page through the rest with offset/limit.` : DISCLOSURE15;
       return ok({
         data: {
           profileIdA,
@@ -27712,8 +29516,8 @@ var init_what_if_merge_profiles = __esm({
 });
 
 // ../mcp/dist/src/tools/what-if-remove-picklist-value.js
-import { z as z108 } from "zod";
-var CUSTOM_FIELD_PREFIX11, PICKLIST_TYPES2, PICKLIST_VALUE_COVERAGE, DISCLOSURE12, coverageCaveatFor3, whatIfRemovePicklistValueInputSchema, buildValueNeedles, containsAnyNeedle, extractHaystackTexts, classifyCategory2, buildExplanation5, findValueInConditionalContexts, aggregateVerdict7, whatIfRemovePicklistValueHandler;
+import { z as z112 } from "zod";
+var CUSTOM_FIELD_PREFIX13, PICKLIST_TYPES2, PICKLIST_VALUE_COVERAGE, DISCLOSURE16, coverageCaveatFor5, whatIfRemovePicklistValueInputSchema, buildValueNeedles, containsAnyNeedle, extractHaystackTexts, classifyCategory2, buildExplanation5, findValueInConditionalContexts, aggregateVerdict7, whatIfRemovePicklistValueHandler;
 var init_what_if_remove_picklist_value = __esm({
   "../mcp/dist/src/tools/what-if-remove-picklist-value.js"() {
     "use strict";
@@ -27721,7 +29525,7 @@ var init_what_if_remove_picklist_value = __esm({
     init_src();
     init_src2();
     init_field_properties();
-    CUSTOM_FIELD_PREFIX11 = "CustomField:";
+    CUSTOM_FIELD_PREFIX13 = "CustomField:";
     PICKLIST_TYPES2 = /* @__PURE__ */ new Set([
       "Picklist",
       "MultiselectPicklist"
@@ -27739,8 +29543,8 @@ var init_what_if_remove_picklist_value = __esm({
       "ListView",
       "FlexiPage"
     ];
-    DISCLOSURE12 = "Apex code referencing the picklist value as a string literal is recognized only for static literals. Variable-based picklist comparisons (`if (account.Industry__c == myVar)`), dynamic SOQL strings, and reflective field access via `obj.get('FieldName')` are invisible to the recognizer; review dynamic comparisons separately before removing the value.";
-    coverageCaveatFor3 = (ctx) => {
+    DISCLOSURE16 = "Apex code referencing the picklist value as a string literal is recognized only for static literals. Variable-based picklist comparisons (`if (account.Industry__c == myVar)`), dynamic SOQL strings, and reflective field access via `obj.get('FieldName')` are invisible to the recognizer; review dynamic comparisons separately before removing the value.";
+    coverageCaveatFor5 = (ctx) => {
       const coverage = summarizeCoverage(ctx.manifest, PICKLIST_VALUE_COVERAGE);
       if (coverage.status === "complete")
         return void 0;
@@ -27751,9 +29555,9 @@ var init_what_if_remove_picklist_value = __esm({
         message: `Picklist-value removal impact is incomplete because the vault lacks coverage for: ${missingCoverage.join(", ")}. Absence of references in those families means "not checked", not "safe".`
       };
     };
-    whatIfRemovePicklistValueInputSchema = z108.object({
-      fieldId: z108.string().min(1),
-      value: z108.string().min(1)
+    whatIfRemovePicklistValueInputSchema = z112.object({
+      fieldId: z112.string().min(1),
+      value: z112.string().min(1)
     });
     buildValueNeedles = (value) => [
       `'${value}'`,
@@ -27852,10 +29656,10 @@ var init_what_if_remove_picklist_value = __esm({
       return "risky";
     };
     whatIfRemovePicklistValueHandler = async (ctx, input2) => {
-      if (!input2.fieldId.startsWith(CUSTOM_FIELD_PREFIX11)) {
+      if (!input2.fieldId.startsWith(CUSTOM_FIELD_PREFIX13)) {
         return err({
           kind: "invalid-query",
-          message: `fieldId must start with '${CUSTOM_FIELD_PREFIX11}'; got '${input2.fieldId}'`,
+          message: `fieldId must start with '${CUSTOM_FIELD_PREFIX13}'; got '${input2.fieldId}'`,
           path: "fieldId"
         });
       }
@@ -27934,7 +29738,7 @@ var init_what_if_remove_picklist_value = __esm({
       }
       const sortedImpacts = [...impactsById.values()].sort((a, b) => a.componentId < b.componentId ? -1 : a.componentId > b.componentId ? 1 : 0);
       const compatibility = sortedImpacts.length === 0 ? "review" : "breaking";
-      const coverageCaveat = coverageCaveatFor3(ctx);
+      const coverageCaveat = coverageCaveatFor5(ctx);
       const rawVerdict = aggregateVerdict7(sortedImpacts);
       const verdict = rawVerdict === "safe" && coverageCaveat !== void 0 ? "review" : rawVerdict;
       return ok({
@@ -27955,11 +29759,11 @@ var init_what_if_remove_picklist_value = __esm({
               ...coverageCaveat !== void 0 ? { missingCoverage: coverageCaveat.missingCoverage } : {}
             },
             limitations: [
-              DISCLOSURE12,
+              DISCLOSURE16,
               ...coverageCaveat !== void 0 ? [coverageCaveat.message] : []
             ]
           },
-          disclosure: DISCLOSURE12
+          disclosure: DISCLOSURE16
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -27971,8 +29775,8 @@ var init_what_if_remove_picklist_value = __esm({
 });
 
 // ../mcp/dist/src/tools/what-if-split-profile.js
-import { z as z109 } from "zod";
-var PROFILE_PREFIX2, PERMISSION_SET_PREFIX, SPLIT_DEFAULT_LIMIT, SPLIT_MAX_LIMIT, DISCLOSURE13, whatIfSplitProfileInputSchema, tokenize4, makeCandidate, resolveTargets, overlapCount, keywordMatch, domainClusterMatch, assignGrant, splitGrants, fetchProfile2, sortAssignments, sortUnassigned, whatIfSplitProfileHandler;
+import { z as z113 } from "zod";
+var PROFILE_PREFIX2, PERMISSION_SET_PREFIX, SPLIT_DEFAULT_LIMIT, SPLIT_MAX_LIMIT, DISCLOSURE17, whatIfSplitProfileInputSchema, tokenize4, makeCandidate, resolveTargets, overlapCount, keywordMatch, domainClusterMatch, assignGrant, splitGrants, fetchProfile2, sortAssignments, sortUnassigned, whatIfSplitProfileHandler;
 var init_what_if_split_profile = __esm({
   "../mcp/dist/src/tools/what-if-split-profile.js"() {
     "use strict";
@@ -27982,12 +29786,12 @@ var init_what_if_split_profile = __esm({
     PERMISSION_SET_PREFIX = "PermissionSet:";
     SPLIT_DEFAULT_LIMIT = 120;
     SPLIT_MAX_LIMIT = 2e3;
-    DISCLOSURE13 = "v2.3 split clustering is approximate; the greedy keyword-match heuristic is fail-conservative. Review every assignment before applying \u2014 grants the heuristic could not place are surfaced in unassignedSettings rather than forced into an inappropriate target. Layout assignments, tab visibilities, and record-type visibilities are not split (Profile-only settings in the Salesforce metadata model).";
-    whatIfSplitProfileInputSchema = z109.object({
-      profileId: z109.string().min(1),
-      targetPermSets: z109.array(z109.string().min(1)).min(1),
-      limit: z109.number().int().min(1).max(SPLIT_MAX_LIMIT).optional(),
-      offset: z109.number().int().min(0).optional()
+    DISCLOSURE17 = "v2.3 split clustering is approximate; the greedy keyword-match heuristic is fail-conservative. Review every assignment before applying \u2014 grants the heuristic could not place are surfaced in unassignedSettings rather than forced into an inappropriate target. Layout assignments, tab visibilities, and record-type visibilities are not split (Profile-only settings in the Salesforce metadata model).";
+    whatIfSplitProfileInputSchema = z113.object({
+      profileId: z113.string().min(1),
+      targetPermSets: z113.array(z113.string().min(1)).min(1),
+      limit: z113.number().int().min(1).max(SPLIT_MAX_LIMIT).optional(),
+      offset: z113.number().int().min(0).optional()
     });
     tokenize4 = (raw) => {
       const spaced = raw.replace(/[._\-/]/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2");
@@ -28248,7 +30052,7 @@ var init_what_if_split_profile = __esm({
       const page = assignments.slice(offset, offset + limit);
       const hasMore = offset + page.length < assignments.length;
       const truncated = hasMore || offset > 0;
-      const disclosure = truncated ? `${DISCLOSURE13} Returning assignments ${offset}\u2013${offset + page.length} of ${assignments.length} (page size ${limit}); summary.byTarget holds the COMPLETE per-target counts. Page through the remaining grants with offset/limit.` : DISCLOSURE13;
+      const disclosure = truncated ? `${DISCLOSURE17} Returning assignments ${offset}\u2013${offset + page.length} of ${assignments.length} (page size ${limit}); summary.byTarget holds the COMPLETE per-target counts. Page through the remaining grants with offset/limit.` : DISCLOSURE17;
       return ok({
         data: {
           profileId,
@@ -28276,7 +30080,7 @@ var init_what_if_split_profile = __esm({
 });
 
 // ../mcp/dist/src/tools/why-cant-user-see-record.js
-import { z as z110 } from "zod";
+import { z as z114 } from "zod";
 var OWD_VISIBLE, OWD_RESTRICTED, ALL_INTERNAL_USERS_GROUP_ID, ROLE_HIERARCHY_MAX_DEPTH, whyCantUserSeeRecordInputSchema, step2, evaluateOWD, grantsReadOrBetter, evaluatePermissionGrants, walkRoleHierarchy, evaluateRoleHierarchy, buildUserMembership, fetchSharingRules, ownerRuleMatches, evaluateOwnerSharingRules, evaluateCriteriaSharingRules, listObjectChildRules, evaluateRestrictionRules, evaluateScopingRules, evaluatePermissionSetGroups, UNKNOWN_TAIL, aggregateVerdict8, PROFILE_PREFIX3, PERMISSION_SET_PREFIX2, ROLE_PREFIX, GROUP_PREFIX, QUEUE_PREFIX, coerceGroupId, coerceUserContext, whyCantUserSeeRecordHandler;
 var init_why_cant_user_see_record = __esm({
   "../mcp/dist/src/tools/why-cant-user-see-record.js"() {
@@ -28297,13 +30101,13 @@ var init_why_cant_user_see_record = __esm({
     ]);
     ALL_INTERNAL_USERS_GROUP_ID = "Group:AllInternalUsers";
     ROLE_HIERARCHY_MAX_DEPTH = 100;
-    whyCantUserSeeRecordInputSchema = z110.object({
-      componentId: z110.string().min(1),
-      userContext: z110.object({
-        profileId: z110.string().min(1).optional(),
-        permissionSetIds: z110.array(z110.string().min(1)).optional(),
-        roleId: z110.string().min(1).optional(),
-        groupIds: z110.array(z110.string().min(1)).optional()
+    whyCantUserSeeRecordInputSchema = z114.object({
+      componentId: z114.string().min(1),
+      userContext: z114.object({
+        profileId: z114.string().min(1).optional(),
+        permissionSetIds: z114.array(z114.string().min(1)).optional(),
+        roleId: z114.string().min(1).optional(),
+        groupIds: z114.array(z114.string().min(1)).optional()
       }).refine((uc) => uc.profileId !== void 0 || uc.permissionSetIds !== void 0 && uc.permissionSetIds.length > 0 || uc.roleId !== void 0 || uc.groupIds !== void 0 && uc.groupIds.length > 0, {
         message: "userContext must supply at least one of: profileId, permissionSetIds, roleId, groupIds"
       })
@@ -28673,17 +30477,17 @@ var init_why_cant_user_see_record = __esm({
 });
 
 // ../mcp/dist/src/tools/why-field-changed.js
-import { z as z111 } from "zod";
-var CUSTOM_FIELD_PREFIX12, DISCLOSURE14, whyFieldChangedInputSchema, surfaceFirstCondition3, surfaceTriggerEvent, buildWriter, whyFieldChangedHandler;
+import { z as z115 } from "zod";
+var CUSTOM_FIELD_PREFIX14, DISCLOSURE18, whyFieldChangedInputSchema, surfaceFirstCondition3, surfaceTriggerEvent, buildWriter, whyFieldChangedHandler;
 var init_why_field_changed = __esm({
   "../mcp/dist/src/tools/why-field-changed.js"() {
     "use strict";
     init_dist();
     init_src();
-    CUSTOM_FIELD_PREFIX12 = "CustomField:";
-    DISCLOSURE14 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
-    whyFieldChangedInputSchema = z111.object({
-      fieldId: z111.string().min(1)
+    CUSTOM_FIELD_PREFIX14 = "CustomField:";
+    DISCLOSURE18 = "v2.0e composes the documented Salesforce order-of-execution instantiated against THIS org's extracted automation. Conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether this particular record satisfies them at runtime. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.";
+    whyFieldChangedInputSchema = z115.object({
+      fieldId: z115.string().min(1)
     });
     surfaceFirstCondition3 = async (ctx, writerId) => {
       const edgesResult = await listEdges(ctx.graph, writerId, {
@@ -28733,10 +30537,10 @@ var init_why_field_changed = __esm({
       return ok(triggerEvent === void 0 ? withCondition : { ...withCondition, triggerEvent });
     };
     whyFieldChangedHandler = async (ctx, input2) => {
-      if (!input2.fieldId.startsWith(CUSTOM_FIELD_PREFIX12)) {
+      if (!input2.fieldId.startsWith(CUSTOM_FIELD_PREFIX14)) {
         return err({
           kind: "invalid-query",
-          message: `fieldId must start with '${CUSTOM_FIELD_PREFIX12}'; got '${input2.fieldId}'`,
+          message: `fieldId must start with '${CUSTOM_FIELD_PREFIX14}'; got '${input2.fieldId}'`,
           path: "fieldId"
         });
       }
@@ -28796,7 +30600,7 @@ var init_why_field_changed = __esm({
           fieldId,
           writers: sortedWriters,
           summary: { declaredCount, heuristicCount },
-          disclosure: DISCLOSURE14
+          disclosure: DISCLOSURE18
         },
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
@@ -28817,7 +30621,7 @@ __export(tools_exports, {
   registerTools: () => registerTools
 });
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-var SEARCH_COMPONENTS_INPUT_SCHEMA, CAPABILITIES_INPUT_SCHEMA, ORG_PULSE_INPUT_SCHEMA, FLEET_FIND_INPUT_SCHEMA, RESOLVE_INPUT_SCHEMA, GET_COMPONENT_INPUT_SCHEMA, GET_EDGES_INPUT_SCHEMA, LIST_COMPONENTS_INPUT_SCHEMA, GET_SUBGRAPH_INPUT_SCHEMA, SEARCH_APEX_SOURCE_INPUT_SCHEMA, SEARCH_FLOW_METADATA_INPUT_SCHEMA, NAMING_CONVENTION_REPORT_INPUT_SCHEMA, GET_MANIFEST_INPUT_SCHEMA, COVERAGE_REPORT_INPUT_SCHEMA, BASELINE_ACKNOWLEDGE_INPUT_SCHEMA, BASELINE_STATUS_INPUT_SCHEMA, TREND_INPUT_SCHEMA, CHURN_INPUT_SCHEMA, LIVE_ENABLED_PROPERTY, LIVE_DESCRIBE_INPUT_SCHEMA, LIVE_COUNT_INPUT_SCHEMA, LIVE_SAMPLE_INPUT_SCHEMA, LIVE_FIELD_POPULATION_INPUT_SCHEMA, LIVE_ORG_LIMITS_INPUT_SCHEMA, LIVE_INACTIVE_USERS_INPUT_SCHEMA, LIVE_LICENSE_USAGE_INPUT_SCHEMA, LIVE_GROUP_COUNT_INPUT_SCHEMA, LIVE_STALE_RECORDS_INPUT_SCHEMA, LIVE_RECENT_ACTIVITY_INPUT_SCHEMA, LIVE_AGGREGATE_INPUT_SCHEMA, LIVE_DUPLICATE_CHECK_INPUT_SCHEMA, LIVE_OWNER_BREAKDOWN_INPUT_SCHEMA, LIVE_STORAGE_BY_OBJECT_INPUT_SCHEMA, LIVE_REPORT_USAGE_INPUT_SCHEMA, LIVE_FOLDER_ACCESS_INPUT_SCHEMA, LIVE_EMAIL_TEMPLATE_USAGE_INPUT_SCHEMA, LIVE_ORG_HEALTH_INPUT_SCHEMA, LIVE_CONSENT_INPUT_SCHEMA, ROUTE_QUESTION_INPUT_SCHEMA, SYNTHESIS_INPUT_SCHEMA, HEALTH_CHECK_INPUT_SCHEMA, GET_IMPACT_INPUT_SCHEMA, FIND_FORMULA_REFERENCES_INPUT_SCHEMA, FIND_APEX_USAGES_INPUT_SCHEMA, FIND_CODE_USAGES_INPUT_SCHEMA, WHY_CANT_USER_SEE_RECORD_INPUT_SCHEMA, LAYOUT_FOR_USER_INPUT_SCHEMA, INTEGRATION_MAP_INPUT_SCHEMA, EVENT_SUBSCRIBERS_INPUT_SCHEMA, LOOKUP_RECORD_INPUT_SCHEMA, EXPLAIN_FIELD_INPUT_SCHEMA, SAFE_TO_DELETE_FIELD_INPUT_SCHEMA, UNUSED_COMPONENTS_INPUT_SCHEMA, DIFF_SNAPSHOTS_INPUT_SCHEMA, COMPARE_COMPONENTS_INPUT_SCHEMA, PII_INVENTORY_INPUT_SCHEMA, FIELD_ACCESS_AUDIT_INPUT_SCHEMA, FIELD_360_INPUT_SCHEMA, FIELD_LINEAGE_INPUT_SCHEMA, ORG_OVERVIEW_INPUT_SCHEMA, DOMAIN_CLUSTERS_INPUT_SCHEMA, CHANGED_SINCE_INPUT_SCHEMA, LAST_MODIFIED_INPUT_SCHEMA, WHAT_HAPPENS_ON_SAVE_INPUT_SCHEMA, WHY_FIELD_CHANGED_INPUT_SCHEMA, ORDER_OF_EXECUTION_INPUT_SCHEMA, EXPLAIN_FLOW_INPUT_SCHEMA, EXPLAIN_APEX_METHOD_INPUT_SCHEMA, EXPLAIN_FORMULA_INPUT_SCHEMA, UNUSED_FIELDS_DEEP_INPUT_SCHEMA, PROCESS_BUILDER_MIGRATION_CANDIDATES_INPUT_SCHEMA, UNASSIGNED_PERMISSION_SETS_INPUT_SCHEMA, EMPTY_QUEUES_AND_GROUPS_INPUT_SCHEMA, TECH_DEBT_SCORE_INPUT_SCHEMA, CODE_QUALITY_AUDIT_INPUT_SCHEMA, GOVERNOR_LIMIT_RISKS_INPUT_SCHEMA, FIND_HARDCODED_VALUES_INPUT_SCHEMA, CRUD_FLS_AUDIT_INPUT_SCHEMA, TEST_COVERAGE_GAPS_INPUT_SCHEMA, WHAT_IF_CHANGE_FIELD_TYPE_INPUT_SCHEMA, WHAT_IF_REMOVE_PICKLIST_VALUE_INPUT_SCHEMA, WHAT_IF_MAKE_FIELD_REQUIRED_INPUT_SCHEMA, WHAT_IF_DEACTIVATE_FLOW_INPUT_SCHEMA, WHAT_IF_DISABLE_TRIGGER_INPUT_SCHEMA, WHAT_IF_CHANGE_METHOD_SIGNATURE_INPUT_SCHEMA, WHAT_IF_MERGE_PROFILES_INPUT_SCHEMA, WHAT_IF_SPLIT_PROFILE_INPUT_SCHEMA, GENERATE_DATA_DICTIONARY_INPUT_SCHEMA, GENERATE_ADMIN_HANDBOOK_INPUT_SCHEMA, GENERATE_ARCHITECTURE_OVERVIEW_INPUT_SCHEMA, GENERATE_SHARING_SUMMARY_INPUT_SCHEMA, GENERATE_COMPLIANCE_REPORT_INPUT_SCHEMA, GENERATE_ONBOARDING_DOC_INPUT_SCHEMA, CALL_GRAPH_INPUT_SCHEMA, DOWNSTREAM_EFFECTS_INPUT_SCHEMA, TEST_COVERAGE_FOR_METHOD_INPUT_SCHEMA, MEANINGFUL_TEST_AUDIT_INPUT_SCHEMA, METHOD_REACHABILITY_INPUT_SCHEMA, TESTS_FOR_CHANGE_INPUT_SCHEMA, PACKAGE_IMPACT_INPUT_SCHEMA, CDC_SUBSCRIBERS_INPUT_SCHEMA, ASYNC_CHAIN_DEPTH_INPUT_SCHEMA, SCHEDULED_JOB_CATALOG_INPUT_SCHEMA, OUTBOUND_MESSAGE_CATALOG_INPUT_SCHEMA, ENDPOINT_CATALOG_INPUT_SCHEMA, FIELD_MEANING_INPUT_SCHEMA, DISAMBIGUATE_CONCEPTS_INPUT_SCHEMA, FIELD_PROVENANCE_INPUT_SCHEMA, FIND_FIELD_ANYWHERE_INPUT_SCHEMA, FIND_SEMANTIC_FIELD_INPUT_SCHEMA, FIND_HARDCODED_VALUES_ANYWHERE_INPUT_SCHEMA, FIND_CLONE_PATTERNS_INPUT_SCHEMA, FIND_DEAD_CODE_INPUT_SCHEMA, CPQ_RULE_CHAIN_INPUT_SCHEMA, CPQ_QUOTE_TEMPLATE_BREAKDOWN_INPUT_SCHEMA, CPQ_DEPENDENCY_MAP_INPUT_SCHEMA, COMPARE_VAULTS_INPUT_SCHEMA, COMPARE_OBJECT_ACROSS_VAULTS_INPUT_SCHEMA, COMPARE_PROFILE_ACROSS_VAULTS_INPUT_SCHEMA, FIELD_MAPPING_BETWEEN_OBJECTS_INPUT_SCHEMA, INTEGRATION_PROCEDURE_CHAIN_INPUT_SCHEMA, OMNISCRIPT_FLOW_INPUT_SCHEMA, OMNIUICARD_WIDGET_BREAKDOWN_INPUT_SCHEMA, DATATRANSFORM_FIELD_MAP_INPUT_SCHEMA, DECISION_TABLE_BROWSE_INPUT_SCHEMA, FIND_DEPENDENCY_CYCLES_INPUT_SCHEMA, APEX_TEST_COVERAGE_INPUT_SCHEMA, AUTOMATION_BUILD_ADVISOR_INPUT_SCHEMA, APEX_BUILD_ADVISOR_INPUT_SCHEMA, FIELD_CHANGE_ADVISOR_INPUT_SCHEMA, LIVE_DRIFT_CHECK_INPUT_SCHEMA, ORG_HISTORY_INPUT_SCHEMA, V01_TOOLS, KNOWN_TOOL_NAMES, dispatchTool, runTool, registerTools, MAX_RESPONSE_BYTES, jsonResult;
+var SEARCH_COMPONENTS_INPUT_SCHEMA, CAPABILITIES_INPUT_SCHEMA, SYNTHESIZE_ANSWER_INPUT_SCHEMA, ORG_PULSE_INPUT_SCHEMA, FLEET_FIND_INPUT_SCHEMA, RESOLVE_INPUT_SCHEMA, GET_COMPONENT_INPUT_SCHEMA, GET_EDGES_INPUT_SCHEMA, LIST_COMPONENTS_INPUT_SCHEMA, GET_SUBGRAPH_INPUT_SCHEMA, SEARCH_APEX_SOURCE_INPUT_SCHEMA, SEARCH_FLOW_METADATA_INPUT_SCHEMA, NAMING_CONVENTION_REPORT_INPUT_SCHEMA, GET_MANIFEST_INPUT_SCHEMA, COVERAGE_REPORT_INPUT_SCHEMA, BASELINE_ACKNOWLEDGE_INPUT_SCHEMA, BASELINE_STATUS_INPUT_SCHEMA, TREND_INPUT_SCHEMA, CHURN_INPUT_SCHEMA, LIVE_ENABLED_PROPERTY, LIVE_DESCRIBE_INPUT_SCHEMA, LIVE_COUNT_INPUT_SCHEMA, LIVE_SAMPLE_INPUT_SCHEMA, LIVE_FIELD_POPULATION_INPUT_SCHEMA, LIVE_ORG_LIMITS_INPUT_SCHEMA, LIVE_INACTIVE_USERS_INPUT_SCHEMA, LIVE_LICENSE_USAGE_INPUT_SCHEMA, LIVE_GROUP_COUNT_INPUT_SCHEMA, LIVE_STALE_RECORDS_INPUT_SCHEMA, LIVE_RECENT_ACTIVITY_INPUT_SCHEMA, LIVE_AGGREGATE_INPUT_SCHEMA, LIVE_DUPLICATE_CHECK_INPUT_SCHEMA, LIVE_OWNER_BREAKDOWN_INPUT_SCHEMA, LIVE_STORAGE_BY_OBJECT_INPUT_SCHEMA, LIVE_REPORT_USAGE_INPUT_SCHEMA, LIVE_FOLDER_ACCESS_INPUT_SCHEMA, LIVE_EMAIL_TEMPLATE_USAGE_INPUT_SCHEMA, LIVE_ORG_HEALTH_INPUT_SCHEMA, LIVE_CONSENT_INPUT_SCHEMA, ROUTE_QUESTION_INPUT_SCHEMA, SYNTHESIS_INPUT_SCHEMA, HEALTH_CHECK_INPUT_SCHEMA, GET_IMPACT_INPUT_SCHEMA, FIND_FORMULA_REFERENCES_INPUT_SCHEMA, FIND_APEX_USAGES_INPUT_SCHEMA, FIND_CODE_USAGES_INPUT_SCHEMA, WHY_CANT_USER_SEE_RECORD_INPUT_SCHEMA, LAYOUT_FOR_USER_INPUT_SCHEMA, INTEGRATION_MAP_INPUT_SCHEMA, EVENT_SUBSCRIBERS_INPUT_SCHEMA, LOOKUP_RECORD_INPUT_SCHEMA, GUIDANCE_INPUT_SCHEMA, EXPLAIN_FIELD_INPUT_SCHEMA, SAFE_TO_DELETE_FIELD_INPUT_SCHEMA, UNUSED_COMPONENTS_INPUT_SCHEMA, DIFF_SNAPSHOTS_INPUT_SCHEMA, COMPARE_COMPONENTS_INPUT_SCHEMA, PII_INVENTORY_INPUT_SCHEMA, FIELD_ACCESS_AUDIT_INPUT_SCHEMA, FIELD_360_INPUT_SCHEMA, FIELD_LINEAGE_INPUT_SCHEMA, ORG_OVERVIEW_INPUT_SCHEMA, DOMAIN_CLUSTERS_INPUT_SCHEMA, CHANGED_SINCE_INPUT_SCHEMA, LAST_MODIFIED_INPUT_SCHEMA, WHAT_HAPPENS_ON_SAVE_INPUT_SCHEMA, WHY_FIELD_CHANGED_INPUT_SCHEMA, ORDER_OF_EXECUTION_INPUT_SCHEMA, EXPLAIN_FLOW_INPUT_SCHEMA, EXPLAIN_APEX_METHOD_INPUT_SCHEMA, EXPLAIN_FORMULA_INPUT_SCHEMA, UNUSED_FIELDS_DEEP_INPUT_SCHEMA, PROCESS_BUILDER_MIGRATION_CANDIDATES_INPUT_SCHEMA, UNASSIGNED_PERMISSION_SETS_INPUT_SCHEMA, EMPTY_QUEUES_AND_GROUPS_INPUT_SCHEMA, TECH_DEBT_SCORE_INPUT_SCHEMA, CODE_QUALITY_AUDIT_INPUT_SCHEMA, GOVERNOR_LIMIT_RISKS_INPUT_SCHEMA, FIND_HARDCODED_VALUES_INPUT_SCHEMA, CRUD_FLS_AUDIT_INPUT_SCHEMA, TEST_COVERAGE_GAPS_INPUT_SCHEMA, WHAT_IF_CHANGE_FIELD_VALUE_INPUT_SCHEMA, VALUE_CHANGE_AUDIT_INPUT_SCHEMA, WHAT_IF_CHANGE_FIELD_TYPE_INPUT_SCHEMA, WHAT_IF_REMOVE_PICKLIST_VALUE_INPUT_SCHEMA, WHAT_IF_MAKE_FIELD_REQUIRED_INPUT_SCHEMA, WHAT_IF_DEACTIVATE_FLOW_INPUT_SCHEMA, WHAT_IF_DISABLE_TRIGGER_INPUT_SCHEMA, WHAT_IF_CHANGE_METHOD_SIGNATURE_INPUT_SCHEMA, WHAT_IF_MERGE_PROFILES_INPUT_SCHEMA, WHAT_IF_SPLIT_PROFILE_INPUT_SCHEMA, GENERATE_DATA_DICTIONARY_INPUT_SCHEMA, GENERATE_ADMIN_HANDBOOK_INPUT_SCHEMA, GENERATE_ARCHITECTURE_OVERVIEW_INPUT_SCHEMA, GENERATE_SHARING_SUMMARY_INPUT_SCHEMA, GENERATE_COMPLIANCE_REPORT_INPUT_SCHEMA, GENERATE_ONBOARDING_DOC_INPUT_SCHEMA, CALL_GRAPH_INPUT_SCHEMA, DOWNSTREAM_EFFECTS_INPUT_SCHEMA, TEST_COVERAGE_FOR_METHOD_INPUT_SCHEMA, MEANINGFUL_TEST_AUDIT_INPUT_SCHEMA, METHOD_REACHABILITY_INPUT_SCHEMA, TESTS_FOR_CHANGE_INPUT_SCHEMA, PACKAGE_IMPACT_INPUT_SCHEMA, CDC_SUBSCRIBERS_INPUT_SCHEMA, ASYNC_CHAIN_DEPTH_INPUT_SCHEMA, SCHEDULED_JOB_CATALOG_INPUT_SCHEMA, OUTBOUND_MESSAGE_CATALOG_INPUT_SCHEMA, ENDPOINT_CATALOG_INPUT_SCHEMA, FIELD_MEANING_INPUT_SCHEMA, DISAMBIGUATE_CONCEPTS_INPUT_SCHEMA, FIELD_PROVENANCE_INPUT_SCHEMA, FIND_FIELD_ANYWHERE_INPUT_SCHEMA, FIND_SEMANTIC_FIELD_INPUT_SCHEMA, FIND_HARDCODED_VALUES_ANYWHERE_INPUT_SCHEMA, FIND_CLONE_PATTERNS_INPUT_SCHEMA, FIND_DEAD_CODE_INPUT_SCHEMA, CPQ_RULE_CHAIN_INPUT_SCHEMA, CPQ_QUOTE_TEMPLATE_BREAKDOWN_INPUT_SCHEMA, CPQ_DEPENDENCY_MAP_INPUT_SCHEMA, COMPARE_VAULTS_INPUT_SCHEMA, COMPARE_OBJECT_ACROSS_VAULTS_INPUT_SCHEMA, COMPARE_PROFILE_ACROSS_VAULTS_INPUT_SCHEMA, FIELD_MAPPING_BETWEEN_OBJECTS_INPUT_SCHEMA, INTEGRATION_PROCEDURE_CHAIN_INPUT_SCHEMA, OMNISCRIPT_FLOW_INPUT_SCHEMA, OMNIUICARD_WIDGET_BREAKDOWN_INPUT_SCHEMA, DATATRANSFORM_FIELD_MAP_INPUT_SCHEMA, DECISION_TABLE_BROWSE_INPUT_SCHEMA, FIND_DEPENDENCY_CYCLES_INPUT_SCHEMA, APEX_TEST_COVERAGE_INPUT_SCHEMA, AUTOMATION_BUILD_ADVISOR_INPUT_SCHEMA, APEX_BUILD_ADVISOR_INPUT_SCHEMA, FIELD_CHANGE_ADVISOR_INPUT_SCHEMA, LIVE_DRIFT_CHECK_INPUT_SCHEMA, ORG_HISTORY_INPUT_SCHEMA, V01_TOOLS, KNOWN_TOOL_NAMES, dispatchTool, runTool, registerTools, MAX_RESPONSE_BYTES, jsonResult;
 var init_tools = __esm({
   "../mcp/dist/src/tools/index.js"() {
     "use strict";
@@ -28884,6 +30688,7 @@ var init_tools = __esm({
     init_get_impact();
     init_get_subgraph();
     init_governor_limit_risks();
+    init_guidance();
     init_health_check();
     init_integration_map();
     init_integration_procedure_chain();
@@ -28916,6 +30721,7 @@ var init_tools = __esm({
     init_search_flow_metadata();
     init_snapshot_trend();
     init_synthesis_reports();
+    init_synthesize_answer();
     init_tech_debt_score();
     init_test_coverage_for_method();
     init_test_coverage_gaps();
@@ -28923,8 +30729,10 @@ var init_tools = __esm({
     init_unassigned_permission_sets();
     init_unused_components();
     init_unused_fields_deep();
+    init_value_change_audit();
     init_what_happens_on_save();
     init_what_if_change_field_type();
+    init_what_if_change_field_value();
     init_what_if_change_method_signature();
     init_what_if_deactivate_flow();
     init_what_if_disable_trigger();
@@ -28947,6 +30755,14 @@ var init_tools = __esm({
       type: "object",
       properties: {}
     });
+    SYNTHESIZE_ANSWER_INPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        input: {},
+        question: { type: "string" },
+        draft: { type: "string" }
+      }
+    });
     ORG_PULSE_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
@@ -29467,8 +31283,7 @@ var init_tools = __esm({
       properties: {
         eventId: { type: "string", minLength: 1 },
         limit: { type: "integer", minimum: 1, maximum: 500 }
-      },
-      required: ["eventId"]
+      }
     });
     LOOKUP_RECORD_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -29477,6 +31292,12 @@ var init_tools = __esm({
       },
       required: ["recordId"]
     });
+    GUIDANCE_INPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        topic: { type: "string", minLength: 1 }
+      }
+    });
     EXPLAIN_FIELD_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
@@ -29584,7 +31405,8 @@ var init_tools = __esm({
           type: "string",
           enum: ["identifier", "contact", "financial", "health", "all"]
         },
-        limit: { type: "integer", minimum: 1, maximum: 500 }
+        limit: { type: "integer", minimum: 1, maximum: 500 },
+        offset: { type: "integer", minimum: 0 }
       }
     });
     FIELD_ACCESS_AUDIT_INPUT_SCHEMA = Object.freeze({
@@ -29874,7 +31696,8 @@ var init_tools = __esm({
     CRUD_FLS_AUDIT_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
-        limit: { type: "integer", minimum: 1, maximum: 500 }
+        limit: { type: "integer", minimum: 1, maximum: 500 },
+        offset: { type: "integer", minimum: 0 }
       }
     });
     TEST_COVERAGE_GAPS_INPUT_SCHEMA = Object.freeze({
@@ -29884,9 +31707,30 @@ var init_tools = __esm({
           type: "array",
           items: { type: "string", minLength: 1 },
           maxItems: 500
-        }
+        },
+        limit: { type: "integer", minimum: 1, maximum: 500 },
+        offset: { type: "integer", minimum: 0 }
       }
     });
+    WHAT_IF_CHANGE_FIELD_VALUE_INPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        fieldId: { type: "string", minLength: 1 },
+        newValue: { type: "string" }
+      },
+      required: ["fieldId"],
+      additionalProperties: false
+    });
+    VALUE_CHANGE_AUDIT_INPUT_SCHEMA = Object.freeze({
+      type: "object",
+      properties: {
+        object: { type: "string", minLength: 1 },
+        fields: { type: "array", items: { type: "string" } },
+        verbosity: { type: "string", enum: ["summary", "detail"] }
+      },
+      required: ["object"],
+      additionalProperties: false
+    });
     WHAT_IF_CHANGE_FIELD_TYPE_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
@@ -30369,9 +32213,14 @@ var init_tools = __esm({
         description: 'Product self-description: what this knowledge base can answer. Returns a categorized capability map (with example natural-language questions per area), the live registered-tool count, the recommended conversational pattern (call sfi.resolve first; ask a clarifying question on ambiguous; offer /sfi-refresh or stop on none), the three slash commands, and the v0.1 read-only/offline boundary. Takes no arguments. Call when the user asks "what can you do / what can I ask?" or to orient a fresh session.',
         inputSchema: CAPABILITIES_INPUT_SCHEMA
       },
+      {
+        name: "sfi.synthesize_answer",
+        description: "Answer-layer grounding pass: turns the JSON returned by prior sfi.* tool call(s) into a structured, citation-grounded answer skeleton \u2014 `summary`, `bullets` (headline facts extracted from the input), `citations` (ONLY canonical ids present in the input, parsed to type + apiName), and `caveats` (honesty/limitation strings carried verbatim). Pass the source tool output as `input` (any JSON), optionally the user `question` (echoed into the summary), and optionally a `draft` narrative \u2014 when given, `hallucinatedIds` lists canonical ids in the draft that do NOT appear in the source so they can be removed before answering. Pure transform: reads ONLY `input`, never the graph or live org, so it can never add a fact it was not handed. Prose wording stays with the caller; this guarantees grounding, not sentences.",
+        inputSchema: SYNTHESIZE_ANSWER_INPUT_SCHEMA
+      },
       {
         name: "sfi.route_question",
-        description: "Front-door router: map a plain-language question to the plane that answers it (vault | live | hybrid | unknown) and the ordered sfi.* tools to call \u2014 so the user never types a tool name. Read-only; it suggests a route, it does not answer. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap and logs it for the backlog instead of fabricating. Call this first on a vague/broad question to decide which tool(s) to run.",
+        description: "Front-door router: map a plain-language question to the plane that answers it (vault | live | hybrid | unknown) and the ordered sfi.* tools to call \u2014 so the user never types a tool name. Read-only; it suggests a route, it does not answer. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, surfaces `suggestedArgs` (heuristic per-intent hints \u2014 e.g. `event: 'update'` for a save-order question so you can call `what_happens_on_save` without guessing the DML event), and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap and logs it for the backlog instead of fabricating. Call this first on a vague/broad question to decide which tool(s) to run.",
         inputSchema: ROUTE_QUESTION_INPUT_SCHEMA
       },
       {
@@ -30556,7 +32405,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.permission_risk_report",
-        description: "Ranked permission risks: unassigned permission sets and CRUD/FLS audit totals.",
+        description: "Ranked permission-risk report, leading with OVER-PRIVILEGE read straight from the extracted profile / permission-set metadata: every Profile or PermissionSet that grants a god-mode or administrative system permission (Modify All Data / View All Data = critical; Author Apex, Customize Application, Manage Users, Manage Profiles/PermSets, Modify Metadata, Manage Sharing, Manage Roles, password/login policies = high) OR object-level View All / Modify All, surfaced as ONE aggregated finding per grantor (severity = the worst signal; system perms + a per-grantor count of objects escalated). PermissionSetGroups are analysed too: a PSG's effective god-mode is aggregated from its MEMBER permission sets (so a user who gets Modify All Data via a group is caught), with the muting permission set noted but not subtracted (v1 honesty boundary). A `privilege` block rosters the `modifyAllDataGrantors` / `viewAllDataGrantors` (profiles, permission sets, AND groups) and the `overPrivilegedGrantorCount`. Also rolls in unassigned permission sets and CRUD/FLS audit totals. Answers 'who has god mode / Modify All / View All / who is an admin / who is over-permissioned'. Read-only, declared confidence (literal metadata flags, not heuristics); `limit` (default 50) caps the findings.",
         inputSchema: SYNTHESIS_INPUT_SCHEMA
       },
       {
@@ -30596,9 +32445,14 @@ var init_tools = __esm({
       },
       {
         name: "sfi.event_subscribers",
-        description: "Given a Platform Event id (`CustomObject:{ApiName}__e`), list every subscriber (ApexTrigger, ApexClass, Flow) that emits an incoming `listensTo` edge into the event. Returns each subscriber's identity, the extractor that emitted the edge, and the edge-level subscription metadata. Honest empty list when no subscribers exist; `invalid-query` when the id is not a Platform Event canonical form.",
+        description: 'Given a Platform Event id (`CustomObject:{ApiName}__e`), list every subscriber (ApexTrigger, ApexClass, Flow) that emits an incoming `listensTo` edge into the event. OMIT `eventId` for CATALOG mode: every Platform Event in the org with its subscriber count (`events[]`) \u2014 answers "what platform events does this org publish?" (then `subscribers` is `[]` and `eventApiName` is `null`). Single-event mode returns each subscriber\'s identity, the emitting extractor, and edge-level subscription metadata. Honest empty list when no subscribers exist; `invalid-query` when a supplied id is not a Platform Event canonical form.',
         inputSchema: EVENT_SUBSCRIBERS_INPUT_SCHEMA
       },
+      {
+        name: "sfi.guidance",
+        description: "General Salesforce best-practice guidance \u2014 the `knowledge` plane for greenfield / New-Org questions that have NO org-specific answer (Flow vs Apex, order of execution, governor limits, async Apex, trigger frameworks, bulkification, Apex testing, callouts, SFDX, unlocked packages, profiles vs permission sets, OWD/sharing, standard vs custom objects, naming, sandboxes). With `topic` (a key like `flow-vs-apex`, or a phrase that loose-matches) it returns a curated summary plus links to official Salesforce docs; without `topic` it lists available topics. Explicitly NOT specific to this org (see `disclosure`) \u2014 it points to authoritative docs and never fabricates vault data.",
+        inputSchema: GUIDANCE_INPUT_SCHEMA
+      },
       {
         name: "sfi.find_code_usages",
         description: "List the code source files (ApexClass, ApexTrigger, LightningComponentBundle, AuraDefinitionBundle, VisualforcePage, VisualforceComponent) that read, write, call, or reference a component. Strict superset of `sfi.find_apex_usages`: same Apex-source coverage plus the v1.4 frontend tier. Filters incoming `readsFrom`/`writesTo`/`callsApex`/`references` edges to those originating from one of the six code node types; optional `nodeTypes` narrows to a single producer (e.g., `['LightningComponentBundle']` for LWC-only). LWC apex-import callsApex edges are `declared`; LWC field reads, Aura field accesses, and VF field touches are `heuristic`; VF controller/extension references are `declared`.",
@@ -30616,7 +32470,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.safe_to_delete_field",
-        description: "Given a CustomField canonical id (`CustomField:{Object}.{Field}`), composes every incoming dependency edge into a confidence-weighted deletion verdict: `safe` (no incoming edges), `risky` (heuristic-confidence Apex/LWC references that need spot-checking), `blocking` (declared Flow/ValidationRule/Layout/formula dependencies the platform will refuse to drop), or `unknown` (only unrecognised edges). Each category in the `reasoning` array carries its referrer count, up to 5 example referrers (full list via `sfi.get_impact`), and a per-category note explaining the honesty boundary. Does NOT consult the Tooling API for runtime dependency confirmation (deferred to v1.7+ `dependsOnFromApi` enrichment).",
+        description: "Given a CustomField canonical id (`CustomField:{Object}.{Field}`), composes every incoming dependency edge into a confidence-weighted deletion verdict: `safe` (no incoming edges), `risky` (heuristic-confidence Apex/LWC references that need spot-checking), `blocking` (declared Flow/ValidationRule/Layout/formula dependencies the platform will refuse to drop), `unknown` (only unrecognised edges), or `review` (NOT proven safe \u2014 incomplete coverage, OR a standard / managed-package field with no node of its own but referenced by edges: it is reviewed from those edges with a not-modeled caveat instead of returning component-not-found; B12). Each category in the `reasoning` array carries its referrer count, up to 5 example referrers (full list via `sfi.get_impact`), and a per-category note explaining the honesty boundary. Does NOT consult the Tooling API for runtime dependency confirmation (deferred to v1.7+ `dependsOnFromApi` enrichment).",
         inputSchema: SAFE_TO_DELETE_FIELD_INPUT_SCHEMA
       },
       {
@@ -30649,6 +32503,16 @@ var init_tools = __esm({
         description: "Decision-support tool: before changing a field, see the whole blast radius in one briefing. Given `fieldId`, synthesises `makeRequired` (verdict + create-path impact count from what_if_make_field_required), `deletion` (verdict + blocking/risky dependency counts from safe_to_delete_field), and \u2014 when `newType` is given \u2014 `changeType` (compatibility + verdict + reference count from what_if_change_field_type), plus combined `recommendations`. Does NOT change anything (backend knowledge layer). Honesty axis: inherits the composed tools' boundaries \u2014 dataflow into Apex insert/update and dynamic/reflective field access are invisible, so verdicts mean 'investigate', not guarantees. `component-not-found` when the fieldId is not a CustomField in the vault.",
         inputSchema: FIELD_CHANGE_ADVISOR_INPUT_SCHEMA
       },
+      {
+        name: "sfi.what_if_change_field_value",
+        description: "Value-change impact (Data Steward / Identity & Integration lens): given a CustomField `fieldId`, what breaks if its stored VALUE changes \u2014 NOT its schema (use what_if_change_field_type for type/required/delete). Returns impact buckets (identity / integration-key / uniqueness / automation / save-pipeline / display), an overall severity, honesty-surface disclosures, and recommended pre-change checks. Identity / key / uniqueness verdicts come from the field's own metadata (externalId / unique / idLookup, identity catalog) \u2014 so a value change is flagged even on a field with ZERO references (e.g. a SAML federation key). Derived fields (formula / roll-up / auto-number) return mutable:false and re-route to their source. Honesty axis: the vault cannot see external upsert systems, the IdP side of SSO, or dynamic / managed-package code; automation buckets surface declarative value-literal couplings (the value a rule compares this field to); Apex literal comparisons remain invisible. Optional `newValue` adds a targeted collision/acceptance check. `component-not-found` when the fieldId is not a CustomField in the vault.",
+        inputSchema: WHAT_IF_CHANGE_FIELD_VALUE_INPUT_SCHEMA
+      },
+      {
+        name: "sfi.value_change_audit",
+        description: "Batch value-change audit (Data Steward lens): given an `object` and optionally a list of `fields`, risk-ranks the impact of changing each field's stored VALUE \u2014 the portfolio version of what_if_change_field_value. WITHOUT `fields`, auto-detects the value-sensitive fields on the object (upsert keys via externalId/unique/idLookup, identity-catalog fields, name-lexicon matches). Each row carries an overall severity, role, top impact reasons, confidence, and disclosure count; `verbosity:'detail'` inlines full buckets. Returns a severity summary + global disclosures; unknown explicit fields come back in `notFound`. This answers 'tell me if changing any of these has an impact on {object}'. Honesty axis: auto-detect can miss a value-sensitive field carrying none of those signals; per-row blast radius inherits what_if_change_field_value's boundaries (external upsert systems, IdP side of SSO, dynamic/managed-package code invisible).",
+        inputSchema: VALUE_CHANGE_AUDIT_INPUT_SCHEMA
+      },
       {
         name: "sfi.live_drift_check",
         description: "Offline\u2194live contradiction detection (requires the opt-in live plane). For `objectApiName`, compares the fields the vault recorded at the last refresh against a LIVE read-only describe and reports `onlyInVault` (fields in the snapshot the live org no longer returns \u2014 deleted/renamed/permission-hidden since refresh; the high-signal STALE indicator), `onlyInLiveCustom` (custom fields added live since refresh, filtered to `__`-suffixed to avoid standard-field noise), `inSync`, and a plain-language `interpretation`. The only check that uses BOTH planes at once; never mutates the org. Honesty axis: the vault models extracted custom fields + standard object definitions (not standard fields), so onlyInVault is the trustworthy drift signal. Pass `liveEnabled:true` or set SFI_LIVE_PLANE_ENABLED.",
@@ -30681,12 +32545,12 @@ var init_tools = __esm({
       },
       {
         name: "sfi.pii_inventory",
-        description: "Enumerate every CustomField in the vault, classify each with the v2.0d `pii-detection` recognizer (which inspects API name, declared data type, and description text), then emit a structured inventory. Filter by `classification` (`'pii' | 'sensitive' | 'all'`) and/or `category` (`'identifier' | 'contact' | 'financial' | 'health' | 'all'`); both default to `'all'`. Each emitted field carries its classification, category, data type, description, and a plain-English `reason` naming the rule that fired. `summary` reports the full per-classification and per-category counts across the matched set; `truncated` flips true when the response slice was trimmed to `limit` (default 200, max 500). The recognizer is heuristic \u2014 a field with no name-token match and no description signal classifies as `public` even if it stores PII at runtime; `EncryptedText`-typed fields ALWAYS classify as `sensitive` because the encryption type IS the declaration.",
+        description: "Enumerate every CustomField in the vault, classify each with the v2.0d `pii-detection` recognizer (which inspects API name, declared data type, and description text), then emit a structured inventory. Filter by `classification` (`'pii' | 'sensitive' | 'all'`) and/or `category` (`'identifier' | 'contact' | 'financial' | 'health' | 'all'`); both default to `'all'`. Each emitted field carries its classification, category, data type, description, and a plain-English `reason` naming the rule that fired. `summary` reports the full per-classification and per-category counts across the matched set. The response is paginated: `limit` (default 200, max 500) and `offset` (default 0) page through the inventory, and a per-response ~38 KB byte budget trims the `fields` slice further when a page would exceed it, so the result never trips the global ~45 KB MCP response limit; `truncated` flips true when more matching fields remain, with `nextOffset` carrying the cursor to advance (plus a `note` when a page was byte-trimmed). The recognizer is heuristic \u2014 a field with no name-token match and no description signal classifies as `public` even if it stores PII at runtime; `EncryptedText`-typed fields ALWAYS classify as `sensitive` because the encryption type IS the declaration.",
         inputSchema: PII_INVENTORY_INPUT_SCHEMA
       },
       {
         name: "sfi.field_access_audit",
-        description: "Given a CustomField canonical id (`CustomField:{Object}.{Field}`), cross-walk every Profile and PermissionSet that grants access to the field via incoming `grantedBy` edges. `grants` carries one entry per (Profile or PermissionSet, permission level) pair where permission is `'read'` / `'edit'` / `'unknown'` (the last meaning the older extractor did not populate the per-flag axis). `summary` reports the unfiltered counts split four ways (profilesWithRead, profilesWithEdit, permSetsWithRead, permSetsWithEdit). `viaApexAccess` enumerates ApexClass / ApexTrigger nodes with incoming `readsFrom` / `writesTo` edges to the field \u2014 a user with execute permission on one of those classes may access the field through that code path even when the metadata-grant audit reports no direct grant. Optional `permissionType` (`'read' | 'edit' | 'all'`, default `'all'`) narrows the emitted `grants` array. Honesty axis: this is the v2.0d.0 permission-grant-level audit; criteria-based and account-team sharing rules are deferred to v2.0d.1. Invalid prefix surfaces as `invalid-query`; unknown ids surface as `component-not-found`.",
+        description: "Given a CustomField canonical id (`CustomField:{Object}.{Field}`), cross-walk every Profile and PermissionSet that grants access to the field via incoming `grantedBy` edges. `grants` carries one entry per (Profile or PermissionSet, permission level) pair where permission is `'read'` / `'edit'` / `'unknown'` (the last meaning the older extractor did not populate the per-flag axis). `summary` reports the unfiltered counts split four ways (profilesWithRead, profilesWithEdit, permSetsWithRead, permSetsWithEdit). `viaApexAccess` enumerates ApexClass / ApexTrigger nodes with incoming `readsFrom` / `writesTo` edges to the field \u2014 a user with execute permission on one of those classes may access the field through that code path even when the metadata-grant audit reports no direct grant. Optional `permissionType` (`'read' | 'edit' | 'all'`, default `'all'`) narrows the emitted `grants` array. A standard or managed-package field with no node of its own but referenced by fieldPermissions / Apex edges is still audited from those edges with `notModeled: true` + a `notModeledNote` (grants are accurate; data type / formula are unavailable and PII is inferred from the field name) \u2014 only an id with no node AND no inbound references is `component-not-found` (B12). Honesty axis: this is the v2.0d.0 permission-grant-level audit; criteria-based and account-team sharing rules are deferred to v2.0d.1. Invalid prefix surfaces as `invalid-query`.",
         inputSchema: FIELD_ACCESS_AUDIT_INPUT_SCHEMA
       },
       {
@@ -30781,12 +32645,12 @@ var init_tools = __esm({
       },
       {
         name: "sfi.crud_fls_audit",
-        description: "v2.1 R3 CRUD/FLS enforcement audit. Walks every ApexClass / ApexTrigger node's `properties.qualityIssues[]`, narrows to the two CRUD/FLS rules (`missing-crud-check`, `missing-fls-check`), groups findings by class, and surfaces the verbatim Q80 disclosure naming the HIGH false-positive rate inherited from ApexQualitySemantics.md \xA7\xA7 6-7. Each class entry carries its identity and a per-finding list (rule / severity / location / explanation). `totalFindingCount` / `byRule` report the FULL pre-slice counts. `limit` defaults to 100 (max 500); the slice is over CLASSES. Honesty axis (verbatim, surfaced in `boundaries[]` when at least one finding qualifies): the Q80 false-positive disclosure \u2014 'custom security utility methods are invisible to the recognizer; this finding may be a false positive if your org uses a helper like SecurityUtils.canCreate(account)' \u2014 is the load-bearing honesty surface for this tool. Also surfaced: cross-method dataflow is invisible; dynamic SOQL strings (Database.query) are stripped before pattern passes.",
+        description: "v2.1 R3 CRUD/FLS enforcement audit. Walks every ApexClass / ApexTrigger node's `properties.qualityIssues[]`, narrows to the two CRUD/FLS rules (`missing-crud-check`, `missing-fls-check`), groups findings by class, and surfaces the verbatim Q80 disclosure naming the HIGH false-positive rate inherited from ApexQualitySemantics.md \xA7\xA7 6-7. Each class entry carries its identity and a per-finding list (rule / severity / location / explanation). `totalFindingCount` / `byRule` report the FULL pre-slice counts. The class list is paginated: `limit` defaults to 100 (max 500) and `offset` (default 0) page over CLASSES, and a per-response ~36 KB byte budget trims the page further when a page would exceed it, so the result never trips the global ~45 KB MCP response limit; `truncated` flips true when more classes remain, with `nextOffset` to advance (plus a `note` when byte-trimmed, and a per-class `findingsTruncated` flag in the rare case one class's findings alone overflow). Honesty axis (verbatim, surfaced in `boundaries[]` when at least one finding qualifies): the Q80 false-positive disclosure \u2014 'custom security utility methods are invisible to the recognizer; this finding may be a false positive if your org uses a helper like SecurityUtils.canCreate(account)' \u2014 is the load-bearing honesty surface for this tool. Also surfaced: cross-method dataflow is invisible; dynamic SOQL strings (Database.query) are stripped before pattern passes.",
         inputSchema: CRUD_FLS_AUDIT_INPUT_SCHEMA
       },
       {
         name: "sfi.test_coverage_gaps",
-        description: "v2.1 R3 test-coverage-gap surface. Combines three signals: (1) `properties.isTest === true` identifies test classes (excluded from the scan), (2) BFS over incoming `callsApex` edges (capped at depth 3) collects the test classes reaching each non-test class, (3) `qualityIssues[]` `fake-assertion` findings on those test classes mark meaninglessly-covered classes. Classifies each non-test ApexClass into one of three coverage statuses \u2014 `uncovered` (no test reaches it within depth 3), `fake-coverage` (covered, but EVERY covering test has fake-assertion findings), `low-quality-coverage` (covered, but SOME covering test has fake-assertion findings). Each gap entry carries `componentId` / `apiName` / `coverageStatus` / `coveringTestClassIds[]` / `fakeAssertions[]` / `recommendedAction`. `byStatus` reports the per-status counts. Optional `classFilter[]` narrows the scan to specific ApexClass ids (capped at 500). Honesty axis (verbatim, surfaced in `boundaries[]` when at least one gap qualifies): the meaningful-assertion heuristic recognizes `System.assertEquals(expected, actual)` with distinct tokens; assertions via helper methods or framework wrappers are invisible. Reachability via `callsApex` does NOT cover dynamic dispatch. BFS is capped at depth 3.",
+        description: "v2.1 R3 test-coverage-gap surface. Combines three signals: (1) `properties.isTest === true` identifies test classes (excluded from the scan), (2) BFS over incoming `callsApex` edges (capped at depth 3) collects the test classes reaching each non-test class, (3) `qualityIssues[]` `fake-assertion` findings on those test classes mark meaninglessly-covered classes. Classifies each non-test ApexClass into one of three coverage statuses \u2014 `uncovered` (no test reaches it within depth 3), `fake-coverage` (covered, but EVERY covering test has fake-assertion findings), `low-quality-coverage` (covered, but SOME covering test has fake-assertion findings). Each gap entry carries `componentId` / `apiName` / `coverageStatus` / `coveringTestClassIds[]` / `fakeAssertions[]` / `recommendedAction`. `byStatus` reports the per-status counts. The gap list is paginated: `limit` (default 200, max 500) and `offset` (default 0) page over gap entries, and a per-response ~38 KB byte budget trims the page further when a page would exceed it, so the result never trips the global ~45 KB MCP response limit; `truncated` flips true when more gaps remain, with `nextOffset` to advance (plus a `note` when byte-trimmed). Optional `classFilter[]` narrows the scan to specific ApexClass ids (capped at 500). Honesty axis (verbatim, surfaced in `boundaries[]` when at least one gap qualifies): the meaningful-assertion heuristic recognizes `System.assertEquals(expected, actual)` with distinct tokens; assertions via helper methods or framework wrappers are invisible. Reachability via `callsApex` does NOT cover dynamic dispatch. BFS is capped at depth 3.",
         inputSchema: TEST_COVERAGE_GAPS_INPUT_SCHEMA
       },
       {
@@ -31116,6 +32980,10 @@ var init_tools = __esm({
           return runTool(ctx, args, resolveInputSchema, resolveHandler);
         case "sfi.capabilities":
           return runTool(ctx, args, capabilitiesInputSchema, capabilitiesHandler);
+        case "sfi.guidance":
+          return runTool(ctx, args, guidanceInputSchema, guidanceHandler);
+        case "sfi.synthesize_answer":
+          return runTool(ctx, args, synthesizeAnswerInputSchema, synthesizeAnswerHandler);
         case "sfi.org_pulse":
           return runTool(ctx, args, orgPulseInputSchema, orgPulseHandler);
         case "sfi.fleet_find":
@@ -31286,6 +33154,10 @@ var init_tools = __esm({
           return runTool(ctx, args, testCoverageGapsInputSchema, testCoverageGapsHandler);
         case "sfi.what_if_change_field_type":
           return runTool(ctx, args, whatIfChangeFieldTypeInputSchema, whatIfChangeFieldTypeHandler);
+        case "sfi.what_if_change_field_value":
+          return runTool(ctx, args, whatIfChangeFieldValueInputSchema, whatIfChangeFieldValueHandler);
+        case "sfi.value_change_audit":
+          return runTool(ctx, args, valueChangeAuditInputSchema, valueChangeAuditHandler);
         case "sfi.what_if_remove_picklist_value":
           return runTool(ctx, args, whatIfRemovePicklistValueInputSchema, whatIfRemovePicklistValueHandler);
         case "sfi.what_if_make_field_required":
@@ -37347,11 +39219,30 @@ var extractEnterpriseMetadata = async (path, config) => {
     apiName = deriveComponentApiName(path, config.suffix);
   }
   const fieldRefs = extractFieldRefs(text.value, parentObjectApiName);
+  const nodeId = `${config.type}:${apiName}`;
+  const childRefEdges = [];
+  const childRefSummary = {};
+  for (const spec of config.childRefs ?? []) {
+    const values = [...new Set(extractXmlValues(text.value, spec.element))].sort();
+    if (values.length > 0)
+      childRefSummary[spec.element] = values;
+    for (const value of values) {
+      childRefEdges.push({
+        fromId: nodeId,
+        toId: `${spec.toType}:${value}`,
+        edgeType: "references",
+        confidence: "declared",
+        source: EXTRACTOR_SOURCE10,
+        properties: { referenceKind: spec.referenceKind }
+      });
+    }
+  }
   const node = makeNode(config.type, apiName, path, parentObjectApiName === null ? null : `CustomObject:${parentObjectApiName}`, {
     fieldRefs,
-    rawReferenceCount: fieldRefs.length
+    rawReferenceCount: fieldRefs.length,
+    ...childRefSummary
   });
-  const edges = fieldRefs.map((fieldId) => ({
+  const fieldRefEdges = fieldRefs.map((fieldId) => ({
     fromId: node.id,
     toId: fieldId,
     edgeType: "references",
@@ -37359,7 +39250,7 @@ var extractEnterpriseMetadata = async (path, config) => {
     source: EXTRACTOR_SOURCE10,
     properties: { referenceKind: "fieldRef" }
   }));
-  return ok({ nodes: [node], edges });
+  return ok({ nodes: [node], edges: [...fieldRefEdges, ...childRefEdges] });
 };
 var extractReport = (path) => extractEnterpriseMetadata(path, { type: "Report", suffix: ".report-meta.xml" });
 var extractDashboard = (path) => extractEnterpriseMetadata(path, { type: "Dashboard", suffix: ".dashboard-meta.xml" });
@@ -37372,7 +39263,22 @@ var extractReportType = (path) => extractEnterpriseMetadata(path, { type: "Repor
 var extractFlexiPage = (path) => extractEnterpriseMetadata(path, { type: "FlexiPage", suffix: ".flexipage-meta.xml" });
 var extractPermissionSetGroup = (path) => extractEnterpriseMetadata(path, {
   type: "PermissionSetGroup",
-  suffix: ".permissionsetgroup-meta.xml"
+  suffix: ".permissionsetgroup-meta.xml",
+  // A PSG's effective permissions are the UNION of its member permission
+  // sets' grants, minus the muting permission set's. Capture both so the
+  // permission analysis can flow god-mode / object grants through the group.
+  childRefs: [
+    {
+      element: "permissionSets",
+      toType: "PermissionSet",
+      referenceKind: "permissionSetGroupMember"
+    },
+    {
+      element: "mutingPermissionSets",
+      toType: "MutingPermissionSet",
+      referenceKind: "mutingPermissionSet"
+    }
+  ]
 });
 var extractMutingPermissionSet = (path) => extractEnterpriseMetadata(path, {
   type: "MutingPermissionSet",
@@ -43257,10 +45163,14 @@ var extractRole = async (path) => {
   return ok({ nodes: [node], edges });
 };
 
+// ../extractors/dist/src/saml-sso-config.js
+init_dist();
+import { XMLParser as XMLParser53, XMLValidator as XMLValidator52 } from "fast-xml-parser";
+
 // ../extractors/dist/src/sharing-rules.js
 init_dist();
 import { readFile as readFile66 } from "node:fs/promises";
-import { XMLParser as XMLParser53, XMLValidator as XMLValidator52 } from "fast-xml-parser";
+import { XMLParser as XMLParser54, XMLValidator as XMLValidator53 } from "fast-xml-parser";
 var SHARING_RULES_FILE_SUFFIX = ".sharingRules-meta.xml";
 var ROOT_ELEMENT52 = "SharingRules";
 var EXTRACTOR_SOURCE28 = "sharing-rule-extractor";
@@ -43321,7 +45231,7 @@ var readAndValidateXml48 = async (path) => {
       cause
     });
   }
-  const validation = XMLValidator52.validate(xmlText);
+  const validation = XMLValidator53.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
@@ -43511,7 +45421,7 @@ var extractSharingRules = async (path) => {
   const xmlResult = await readAndValidateXml48(path);
   if (!xmlResult.ok)
     return xmlResult;
-  const parser = new XMLParser53({
+  const parser = new XMLParser54({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -43558,7 +45468,7 @@ var extractSharingRules = async (path) => {
 // ../extractors/dist/src/static-resource.js
 init_dist();
 import { readFile as readFile67 } from "node:fs/promises";
-import { XMLParser as XMLParser54, XMLValidator as XMLValidator53 } from "fast-xml-parser";
+import { XMLParser as XMLParser55, XMLValidator as XMLValidator54 } from "fast-xml-parser";
 var STATIC_RESOURCE_FILE_SUFFIX = ".resource-meta.xml";
 var ROOT_ELEMENT53 = "StaticResource";
 var REQUIRED_ELEMENTS24 = ["cacheControl"];
@@ -43583,7 +45493,7 @@ var readAndValidateXml49 = async (path) => {
       cause
     });
   }
-  const validation = XMLValidator53.validate(xmlText);
+  const validation = XMLValidator54.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
@@ -43614,7 +45524,7 @@ var extractStaticResource = async (path) => {
   const xmlResult = await readAndValidateXml49(path);
   if (!xmlResult.ok)
     return xmlResult;
-  const parser = new XMLParser54({
+  const parser = new XMLParser55({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -43668,7 +45578,7 @@ var extractStaticResource = async (path) => {
 init_dist();
 import { readFile as readFile68 } from "node:fs/promises";
 import { basename as basename10, dirname as dirname13 } from "node:path";
-import { XMLParser as XMLParser55, XMLValidator as XMLValidator54 } from "fast-xml-parser";
+import { XMLParser as XMLParser56, XMLValidator as XMLValidator55 } from "fast-xml-parser";
 var VALIDATION_RULE_FILE_SUFFIX = ".validationRule-meta.xml";
 var ROOT_ELEMENT54 = "ValidationRule";
 var VALIDATION_RULES_DIR_NAME = "validationRules";
@@ -43703,7 +45613,7 @@ var readAndValidateXml50 = async (path) => {
       cause
     });
   }
-  const validation = XMLValidator54.validate(xmlText);
+  const validation = XMLValidator55.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
@@ -43751,7 +45661,7 @@ var extractValidationRule = async (path) => {
   const xmlResult = await readAndValidateXml50(path);
   if (!xmlResult.ok)
     return xmlResult;
-  const parser = new XMLParser55({
+  const parser = new XMLParser56({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -43822,7 +45732,7 @@ var extractValidationRule = async (path) => {
 init_dist();
 init_src3();
 import { readFile as readFile69 } from "node:fs/promises";
-import { XMLParser as XMLParser56, XMLValidator as XMLValidator55 } from "fast-xml-parser";
+import { XMLParser as XMLParser57, XMLValidator as XMLValidator56 } from "fast-xml-parser";
 var COMPONENT_FILE_SUFFIX = ".component";
 var META_FILE_EXT3 = "-meta.xml";
 var ROOT_ELEMENT55 = "ApexComponent";
@@ -43848,14 +45758,14 @@ var readAndValidateXml51 = async (path, missingMessage) => {
       cause
     });
   }
-  const validation = XMLValidator55.validate(xmlText);
+  const validation = XMLValidator56.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
   return ok(xmlText);
 };
 var parseMetaXml5 = (xmlText, path) => {
-  const parser = new XMLParser56({
+  const parser = new XMLParser57({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -44063,7 +45973,7 @@ var extractVisualforceComponent = async (path) => {
 init_dist();
 init_src3();
 import { readFile as readFile70 } from "node:fs/promises";
-import { XMLParser as XMLParser57, XMLValidator as XMLValidator56 } from "fast-xml-parser";
+import { XMLParser as XMLParser58, XMLValidator as XMLValidator57 } from "fast-xml-parser";
 var PAGE_FILE_SUFFIX = ".page";
 var META_FILE_EXT4 = "-meta.xml";
 var ROOT_ELEMENT56 = "ApexPage";
@@ -44090,14 +46000,14 @@ var readAndValidateXml52 = async (path, missingMessage) => {
       cause
     });
   }
-  const validation = XMLValidator56.validate(xmlText);
+  const validation = XMLValidator57.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
   return ok(xmlText);
 };
 var parseMetaXml6 = (xmlText, path) => {
-  const parser = new XMLParser57({
+  const parser = new XMLParser58({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -44311,7 +46221,7 @@ var extractVisualforcePage = async (path) => {
 init_dist();
 import { readFile as readFile71 } from "node:fs/promises";
 import { basename as basename11, dirname as dirname14 } from "node:path";
-import { XMLParser as XMLParser58, XMLValidator as XMLValidator57 } from "fast-xml-parser";
+import { XMLParser as XMLParser59, XMLValidator as XMLValidator58 } from "fast-xml-parser";
 var FILE_SUFFIX5 = ".webLink-meta.xml";
 var ROOT_ELEMENT57 = "WebLink";
 var DIR_NAME4 = "webLinks";
@@ -44349,7 +46259,7 @@ var readAndValidateXml53 = async (path) => {
       cause
     });
   }
-  const validation = XMLValidator57.validate(xmlText);
+  const validation = XMLValidator58.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
@@ -44376,7 +46286,7 @@ var extractWebLink = async (path) => {
   const xmlResult = await readAndValidateXml53(path);
   if (!xmlResult.ok)
     return xmlResult;
-  const parser = new XMLParser58({
+  const parser = new XMLParser59({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -44451,7 +46361,7 @@ var extractWebLink = async (path) => {
 // ../extractors/dist/src/workflow-rule.js
 init_dist();
 import { readFile as readFile72 } from "node:fs/promises";
-import { XMLParser as XMLParser59, XMLValidator as XMLValidator58 } from "fast-xml-parser";
+import { XMLParser as XMLParser60, XMLValidator as XMLValidator59 } from "fast-xml-parser";
 var WORKFLOW_FILE_SUFFIX = ".workflow-meta.xml";
 var ROOT_ELEMENT58 = "Workflow";
 var EXTRACTOR_SOURCE29 = "workflow-rule-extractor";
@@ -44527,7 +46437,7 @@ var readAndValidateXml54 = async (path) => {
       cause
     });
   }
-  const validation = XMLValidator58.validate(xmlText);
+  const validation = XMLValidator59.validate(xmlText);
   if (validation !== true) {
     return err({ kind: "parse-error", path, message: validation.err.msg });
   }
@@ -44841,7 +46751,7 @@ var extractWorkflowRule = async (path) => {
   const xmlResult = await readAndValidateXml54(path);
   if (!xmlResult.ok)
     return xmlResult;
-  const parser = new XMLParser59({
+  const parser = new XMLParser60({
     ignoreAttributes: true,
     parseTagValue: false,
     trimValues: true,
@@ -46840,7 +48750,7 @@ var registerStatusCommand = (program) => {
 // dist/src/program.js
 var readVersion = () => {
   if (true)
-    return "0.1.4";
+    return "0.1.5";
   const pkgUrl = new URL("../../package.json", import.meta.url);
   const raw = readFileSync2(fileURLToPath(pkgUrl), "utf8");
   const parsed = JSON.parse(raw);