> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Build validations reference

> All build-time validators, blocked patterns, and generated artifacts

## Validators

| Validator             | Command                    | What it checks                                                                                                                                           |
| --------------------- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Access control        | `validate:access-control`  | Forbidden code patterns in `src/server/`                                                                                                                 |
| Router structure      | `validate:router`          | `router.ts` contains only imports and sub-router registrations                                                                                           |
| Scopes                | `validate:scopes`          | `scopes.json` cross-referenced against Prisma schema                                                                                                     |
| Workflows             | `validate:workflows`       | Workflow definitions in `src/server/workflows/` — see the [Workflows Framework](/docs/platform-docs/workflows-framework/overview) for full validation details |
| PRD suite             | `prd:test` (build phase)   | Every PRD entry's test passes; a failing entry or child fails the build                                                                                  |
| PRD access matrix     | `validate:prd:access`      | Every procedure has an access entry; declared contracts cross-checked against the code's guards (both directions); derived scenario clauses all covered  |
| PRD calculation gates | part of `prd:test`         | Unit tests import the app's real implementation, and every assertion derives from an imported call (AST analysis)                                        |
| PRD prose             | `prd:render` (build phase) | Access descriptions regenerated from verified contracts, so prose can't drift from the code                                                              |

The PRD validators are covered in full in the [PRD reference](/docs/platform-docs/app-framework/reference/prd); the guarantees they enforce are summarized in [The trust model](/docs/platform-docs/app-framework/prd/trust-model).

## Blocked code patterns

| Pattern                      | Reason                           | Correct alternative                  |
| ---------------------------- | -------------------------------- | ------------------------------------ |
| `import { getUserScopes }`   | Bypasses declarative enforcement | `scopedProcedure(['scope'])`         |
| `import { _unscopedPrisma }` | Bypasses RLS                     | `ctx.db`                             |
| `ctx.userScopes`             | Enables conditional security     | Separate procedures per access level |
| `$executeRaw`                | Bypasses RLS policies            | Prisma query methods via `ctx.db`    |
| `$queryRaw`                  | Bypasses RLS policies            | Prisma query methods via `ctx.db`    |

## Scopes validation checks

| Check                | Description                                                                                     |
| -------------------- | ----------------------------------------------------------------------------------------------- |
| Scope references     | Every scope in roles, table policies, and service configs must be defined in the `scopes` array |
| Table existence      | Every table in `tables` must exist in `prisma/schema.prisma`                                    |
| Column existence     | Every `ownerColumn`, `orgColumn`, `groupAccess` column must exist on the referenced table       |
| Role uniqueness      | No duplicate role names                                                                         |
| Default role         | Exactly one role can be marked as default                                                       |
| Service clients      | Every service in `services` must have its `@synthetiq/services-*` package installed             |
| Group access columns | Group access membership tables must have a `userId` column                                      |

## ESLint rules

| Rule                       | Scope      | Effect                                                    |
| -------------------------- | ---------- | --------------------------------------------------------- |
| Service client imports     | `src/web/` | Error — service clients can only be used in `src/server/` |
| `no-unsafe-type-assertion` | All files  | Error — prevents unsafe type assertions                   |

## Generated artifacts

| Artifact          | Generator                   | Used by                                    |
| ----------------- | --------------------------- | ------------------------------------------ |
| `procedures.json` | `generate:manifests`        | AI agent, HTTP API, MCP server, docs pages |
| `db-schema.json`  | `generate:manifests`        | AI agent, docs pages                       |
| `pages.json`      | `generate:manifests`        | AI agent, docs pages                       |
| RLS policies      | `generate:rls`              | PostgreSQL production database             |
| Service mappings  | `generate:service-mappings` | Service client integrations                |

## Build commands

| Command                                   | Description                       |
| ----------------------------------------- | --------------------------------- |
| `synthetiq-app build`                     | Full pipeline (all phases)        |
| `synthetiq-app validate`                  | Run all validators                |
| `synthetiq-app validate:access-control`   | Check for security violations     |
| `synthetiq-app validate:router`           | Check router structure            |
| `synthetiq-app validate:scopes`           | Check scope configuration         |
| `synthetiq-app validate:workflows`        | Check workflow definitions        |
| `synthetiq-app generate:manifests`        | Generate API and schema manifests |
| `synthetiq-app generate:rls`              | Generate RLS policies             |
| `synthetiq-app generate:service-mappings` | Generate service mappings         |
| `synthetiq-app sync:scopes`               | Sync scopes to database           |
| `synthetiq-app register:schedules`        | Register scheduled jobs           |
| `synthetiq-app seed:publisher`            | Seed default roles                |