Skip to main content

:::warning AUTO-GENERATED — do not edit This page is generated from the MCP server snapshot content/guide-angular-mcp.json. Edit the source MCP server (not this file), then run npm run generate. :::

Guide (Angular) — Guardrails & Non-negotiables

These rules are enforced by the MCP server and must not be bypassed.

{
  "antiHallucinationPolicy": {
    "summary": "Never invent APIs, endpoints, types, fields, tables, columns, colors, component names, or package imports. Retrieve every fact from an MCP tool, a real schema, or an existing project file. If a tool/schema/file does not confirm it, STOP and ask — do not fabricate.",
    "rules": [
      "GROUND, DON'T GUESS: Every endpoint, field, table, column, type, color, or component MUST come from an MCP discovery tool or an existing project file. If you did not see it there, it does not exist.",
      "VALIDATE BEFORE USE: Run the relevant validate_* tool before writing code that depends on a discovered fact. A failed result means STOP — do not build on it.",
      "TYPES FROM SCHEMA/SOURCE: Type and validation schemas MUST mirror the real response/DB schema or documented contract. Include ONLY fields confirmed to exist — never add plausible-looking ones.",
      "IMPORTS FROM KNOWN MODULES: Only import symbols actually exported by installed dependencies or files that exist in the project. Do not import a package that is not declared in the project's manifest.",
      "CITE YOUR SOURCE: When you write an endpoint, type, field, color, or component, state which tool call, schema, or project file it came from. Unsourced facts are not allowed.",
      "FAIL CLOSED: If discovery is inconclusive (tool errors, empty result, ambiguous mapping), ask the user a specific question rather than proceeding on an assumption.",
      "COMPILER IS THE ORACLE: Run the project's verify gate before declaring done. A hallucinated fact becomes a type/build/lint error — fix the root cause, do not suppress it.",
      "GROUND VIA API-MCP: Resolve every endpoint path/method/param/response field from `get_endpoint_details` or `get_openapi_spec` (api-mcp), then confirm it with `validate_endpoint` before writing any HttpClient call. A red result means STOP.",
      "COLORS FROM TOKENS: Never write hex/rgb colors. Use the Rystad SCSS/CSS custom properties from `get_design_tokens`. Verify unknown colors with `validate_colors`.",
      "COMPONENTS FROM CATALOG: Only use component names returned by `get_component_template`. Do not invent component APIs.",
      "ALLOWED IMPORTS: Only import symbols exported by `@rystad/auth-angular`, `@tanstack/angular-query-experimental`, `@angular/*`, or files that exist in the project. Do not import packages absent from package.json.",
      "NO INVENTED DATA: Never hardcode fake/sample data to make a UI look done. Wire real data via HttpClient or leave a typed loading/empty state.",
      "VERIFY GATE: Run the verify gate (`ng lint && ng build && ng test`) before declaring done. A hallucinated API becomes a type/build error — fix it, never suppress it (no `any`, no `// @ts-ignore`)."
    ]
  },
  "nonNegotiables": [
    "All HTTP goes through Angular `HttpClient` in a typed service — never `fetch`/`XMLHttpRequest` directly. The `rystadAuthInterceptor` attaches session + CSRF automatically.",
    "Use TanStack Angular Query (`injectQuery`) for server state — never subscribe-and-store in an ngOnInit.",
    "Use standalone components (no NgModules) with `signal()`/`computed()` for state and `inject()` for dependencies.",
    "Use `interface` for data models (idiomatic Angular). [This intentionally differs from the React stack's `type`-only rule.]",
    "Auth only via `@rystad/auth-angular` — `rystadAuthInterceptor`, `rystadAuthGuard`, `injectRystadAuth()`. Never build a custom auth/token flow.",
    "No secrets in client code, .env commits, or localStorage. Never bind `[innerHTML]` to untrusted data; no direct DOM writes.",
    "One endpoint per chart/visual — never batch multiple visuals into a single response.",
    "Every component ships with a loading state, an error state, and a co-located `*.spec.ts` test."
  ],
  "enforcedBy": [
    "angular-eslint — flat config bans raw fetch, hardcoded hex colors, and non-allowlisted imports; enforces standalone + inject patterns.",
    "tsc strict mode — hallucinated fields/types fail to compile.",
    "`ng lint && ng build && ng test` — the verify gate; must pass before 'done'.",
    "core.gateway (runtime) — CSP/nonce, anti-forgery, and role gating cannot be bypassed from the client.",
    "@rystad/auth-angular — the interceptor refuses to send credentials cross-origin; the guard redirects unauthenticated users to hosted login."
  ]
}