@adrata/adrata-mcp 1.0.0

package/toolsets/extensibility.js

@@ -0,0 +1,1131 @@
+/**
+ * Extensibility Toolset
+ *
+ * Surfaces the Adrata custom integration + extension catalog to Claude so it
+ * can inspect what's available, validate a draft manifest locally, and
+ * request a deployment without leaving the chat.
+ *
+ * Tools registered:
+ *   - inspect_provider_catalog
+ *   - get_provider_connect_plan
+ *   - list_provider_endpoints
+ *   - test_provider_credential
+ *   - request_provider_action_execution
+ *   - validate_integration_manifest
+ *   - validate_extension_manifest
+ *   - request_deployment
+ *   - submit_adrata_command
+ *
+ * Validation logic mirrors `packages/adrata-cli/src/manifests.js` and
+ * `code/api/src/services/platform/integrations/custom_integrations/validator.rs`.
+ * Keep the three implementations in sync — the backend is the truth gate.
+ */
+
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { z } from 'zod';
+import { md, mdError } from '../output-formatter.js';
+
+const VISIBILITY = new Set(['workspace_private', 'org_shared']);
+const AUTH_TYPES = new Set(['api_key', 'bearer_token', 'oauth2', 'none']);
+const FIELD_TYPES = new Set(['text', 'number', 'boolean', 'date', 'url', 'email', 'json']);
+const ENTITY_TYPES = new Set(['company', 'person', 'opportunity']);
+const TRIGGER_TYPES = new Set(['manual', 'webhook', 'schedule', 'record_change']);
+const WORKFLOW_TRIGGER_TYPES = new Set(['manual', 'provider_event', 'schedule', 'record_change']);
+const STEP_RISKS = new Set(['low', 'medium', 'high']);
+const ALLOWED_TARGETS = new Set(['adrata_hosted', 'customer_runner', 'hybrid_runner']);
+const COMMAND_MODES = new Set(['dry_run', 'execute']);
+
+export const HEADLESS_OPERATION_POLICY = {
+  inspect_provider_catalog: {
+    permission: 'providers.inspect',
+    auditEvent: 'provider.catalog.inspected',
+    risk: 'low',
+  },
+  list_provider_endpoints: {
+    permission: 'providers.inspect',
+    auditEvent: 'provider.endpoints.inspected',
+    risk: 'low',
+  },
+  test_provider_credential: {
+    permission: 'providers.credentials.test',
+    auditEvent: 'provider.credential.test.requested',
+    risk: 'medium',
+    dryRunDefault: true,
+  },
+  request_provider_action_execution: {
+    permission: 'providers.actions.execute.request',
+    auditEvent: 'provider.action.execution.requested',
+    risk: 'high',
+    dryRunDefault: true,
+    approvalRequired: true,
+  },
+  request_deployment: {
+    permission: 'extensions.deploy.request',
+    auditEvent: 'extension_or_integration.deploy.requested',
+    risk: 'high',
+    policyPassRequired: true,
+  },
+  draft_workflow: {
+    permission: 'workflows.write',
+    auditEvent: 'workflow.drafted',
+    risk: 'low',
+  },
+  validate_workflow_draft: {
+    permission: 'workflows.validate',
+    auditEvent: 'workflow.validated',
+    risk: 'low',
+  },
+  dry_run_workflow: {
+    permission: 'workflows.dry_run',
+    auditEvent: 'workflow.dry_run.requested',
+    risk: 'medium',
+  },
+  request_workflow_deployment: {
+    permission: 'workflows.deploy.request',
+    auditEvent: 'workflow.deploy.requested',
+    risk: 'high',
+    policyPassRequired: true,
+  },
+  replay_workflow_run: {
+    permission: 'workflows.replay',
+    auditEvent: 'workflow.replay.requested',
+    risk: 'high',
+    dryRunDefault: true,
+  },
+  submit_adrata_command: {
+    permission: 'commands.submit',
+    auditEvent: 'command.submitted',
+    risk: 'high',
+    dryRunDefault: true,
+    policyPassRequired: true,
+  },
+};
+
+export function register(server, api, AUTH) {
+  server.tool(
+    'inspect_provider_catalog',
+    'List the canonical integration provider catalog without loading provider endpoint tools into context. Use category/status/search to narrow before inspecting endpoints.',
+    {
+      includeCustom: z
+        .boolean()
+        .optional()
+        .describe('Deprecated compatibility flag; canonical catalog is returned by default'),
+      category: z.string().optional().describe('Optional category filter, for example Outbound'),
+      status: z.string().optional().describe('Optional status filter, for example CredentialOnly'),
+      search: z.string().optional().describe('Optional local search across provider name/id/category/runtime/auth'),
+    },
+    async (args) => {
+      try {
+        const result = await api('GET', '/api/v1/providers/catalog', {
+          params: {
+            category: args.category,
+            status: args.status,
+          },
+        });
+        let providers = Array.isArray(result?.data?.providers)
+          ? result.data.providers
+          : Array.isArray(result?.data)
+          ? result.data
+          : Array.isArray(result)
+            ? result
+            : [];
+        const needle = (args.search || '').toLowerCase();
+        if (needle) {
+          providers = providers.filter((p) =>
+            [p.id, p.name, p.category, p.status, p.runtime, p.auth]
+              .filter(Boolean)
+              .join(' ')
+              .toLowerCase()
+              .includes(needle),
+          );
+        }
+        if (providers.length === 0) {
+          return md('## Provider Catalog\n\nNo providers returned. Confirm your tier and workspace.\n');
+        }
+        let text = '## Provider Catalog\n\n| Slug | Name | Category | Status | Runtime | Auth | Headless | Risk | Approval |\n|------|------|----------|--------|---------|------|----------|------|----------|\n';
+        for (const p of providers) {
+          const policy = providerPolicySummary(p);
+          text += `| ${p.slug ?? p.id ?? '\u2014'} | ${p.name ?? '\u2014'} | ${p.category ?? '\u2014'} | ${p.status ?? '\u2014'} | ${p.runtime ?? '\u2014'} | ${p.auth ?? '\u2014'} | ${p.headless ? 'yes' : 'no'} | ${policy.risk} | ${policy.approval} |\n`;
+        }
+        text += `\n${providers.length} provider(s) listed. Use \`get_provider_connect_plan\` or \`list_provider_endpoints\` for one provider before connecting it.\n`;
+        return md(text);
+      } catch (err) {
+        return mdError('Could not fetch provider catalog', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'get_provider_connect_plan',
+    'Get the exact app/API/MCP/CLI connection plan for one integration provider without enabling the infrastructure toolset.',
+    {
+      provider: z.string().describe('Provider slug, for example heyreach, salesforce, or hubspot'),
+    },
+    async (args) => {
+      try {
+        const result = await api(
+          'GET',
+          `/api/v1/providers/catalog/${encodeURIComponent(args.provider)}/connect`,
+        );
+        const data = result?.data || result || {};
+        const provider = data.provider || {};
+        const connect = data.connect || {};
+        let text = `## Connect Plan: ${provider.name || args.provider}\n\n`;
+        text += `- **Status:** ${provider.status || '\u2014'}\n`;
+        text += `- **Runtime:** ${provider.runtime || '\u2014'}\n`;
+        text += `- **Auth:** ${provider.auth || '\u2014'}\n`;
+        text += `- **Headless:** ${data.headless ? 'yes' : 'no'}\n`;
+        if (connect.path) {
+          text += `- **Method:** ${connect.method || '\u2014'}\n`;
+          text += `- **Path:** \`${connect.path}\`\n`;
+          if (connect.body) text += `- **Body:** \`${JSON.stringify(connect.body)}\`\n`;
+        }
+        if (data.runtimePlan) {
+          text += `- **Credential test:** \`${data.runtimePlan.credentialTestEndpoint}\`\n`;
+          text += `- **Promotion state:** ${data.runtimePlan.promotionState}\n`;
+        }
+        const policy = providerPolicySummary(provider);
+        text += `- **Risk:** ${policy.risk}\n`;
+        text += `- **Billing:** ${provider.billing || data.billing || '\u2014'}\n`;
+        text += `- **Approval:** ${policy.approval}\n`;
+        if (data.warning) text += `\n> ${data.warning}\n`;
+        return md(text);
+      } catch (err) {
+        return mdError('Connect plan failed', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'list_provider_endpoints',
+    'Inspect a provider endpoint/action catalog before drafting a workflow. Returns available actions, auth mode, required scopes, rate-limit hints, and policy constraints when the registry exposes them.',
+    {
+      provider: z.string().describe('Provider slug, for example salesforce, hubspot, heyreach, or a custom provider slug'),
+      search: z.string().optional().describe('Optional endpoint search string'),
+    },
+    async (args) => {
+      try {
+        const result = await api(
+          'GET',
+          `/api/v1/providers/catalog/${encodeURIComponent(args.provider)}/endpoints`,
+        );
+        const data = result?.data || result || {};
+        const needle = (args.search || '').toLowerCase();
+        const endpoints = (data.endpoints || []).filter((endpoint) => {
+          if (!needle) return true;
+          return [
+            endpoint.method,
+            endpoint.path,
+            endpoint.slug,
+            endpoint.requiredScope,
+            endpoint.required_scope,
+            endpoint.description,
+            ...(endpoint.tags || []),
+          ]
+            .filter(Boolean)
+            .join(' ')
+            .toLowerCase()
+            .includes(needle);
+        });
+        let text = `## Provider Endpoints: ${data.provider?.name || args.provider} (${endpoints.length}/${data.total || 0})\n\n`;
+        if (data.runtimePlan) {
+          text += `Credential test: \`${data.runtimePlan.credentialTestEndpoint}\`\n`;
+          text += `Promotion state: \`${data.runtimePlan.promotionState}\`\n\n`;
+        }
+        if (endpoints.length === 0) {
+          text += 'No endpoints matched, or this provider exposes only a connection contract today.\n';
+          return md(text);
+        }
+        text += '| Method | Path | Slug | Scope | Auth | Runtime | Risk | Billing | Approval |\n|--------|------|------|-------|------|---------|------|---------|----------|\n';
+        for (const endpoint of endpoints) {
+          const policy = endpointPolicySummary(data.provider, endpoint);
+          text += `| ${endpoint.method} | ${endpoint.path} | ${endpoint.slug} | ${endpoint.requiredScope || endpoint.required_scope || '\u2014'} | ${endpoint.auth || data.provider?.auth || '\u2014'} | ${endpoint.runtimeState || data.provider?.runtime || '\u2014'} | ${policy.risk} | ${endpoint.billing || data.provider?.billing || '\u2014'} | ${policy.approval} |\n`;
+        }
+        return md(text);
+      } catch (err) {
+        return mdError('Could not fetch provider endpoints', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'test_provider_credential',
+    'Run a policy/audit-mapped credential test for a provider. Defaults to dry-run so Claude Code can check shape and policy before touching live credentials.',
+    {
+      provider: z.string().describe('Provider slug'),
+      credentialRef: z.string().optional().describe('Stored credential reference to test'),
+      manifest: z.record(z.any()).optional().describe('Inline custom integration manifest for local/provider test planning'),
+      dryRun: z.boolean().optional().describe('Defaults to true. Set false only for an authenticated live credential test.'),
+    },
+    async (args) => {
+      if (!args.credentialRef && !args.manifest) {
+        return mdError('Credential test requires credentialRef or manifest');
+      }
+      const payload = {
+        slug: args.provider,
+        credentialRef: args.credentialRef ?? null,
+        manifest: args.manifest ?? null,
+        dryRun: args.dryRun !== false,
+        policy: HEADLESS_OPERATION_POLICY.test_provider_credential,
+      };
+      if (payload.dryRun) {
+        return md(`## Credential Test Dry Run\n\n\`\`\`json\n${JSON.stringify(payload, null, 2)}\n\`\`\`\n`);
+      }
+      try {
+        // Real, mounted route: POST /api/v1/providers/test (providers_router,
+        // nested at /providers). The prior /platform/integrations/providers/
+        // {p}/credential-tests path was never routed server-side and 404'd.
+        const result = await api('POST', '/api/v1/providers/test', {
+          body: {
+            providerId: args.provider,
+            testData: {
+              credentialRef: args.credentialRef ?? null,
+              manifest: args.manifest ?? null,
+            },
+          },
+        });
+        return md(`## Credential Test Submitted\n\n\`\`\`json\n${JSON.stringify(result, null, 2)}\n\`\`\`\n`);
+      } catch (err) {
+        return mdError('Credential test rejected by control plane', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'request_provider_action_execution',
+    'Request a scoped provider action execution without registering every provider endpoint as a separate MCP tool. Defaults to dry-run and returns policy, scope, billing, risk, and approval requirements before any live request.',
+    {
+      provider: z.string().describe('Provider slug, for example heyreach, salesforce, hubspot, gmail, or a custom provider slug'),
+      action: z.string().describe('Endpoint/action slug to request, for example campaigns_get_all or salesforce_contacts_update'),
+      scope: z.string().optional().describe('Expected scope for the action. If omitted, the endpoint catalog scope is used when available.'),
+      inputs: z.record(z.any()).optional().describe('Action input payload. Secrets should be credential refs, never raw credentials.'),
+      reason: z.string().optional().describe('Business reason shown in audit logs and approval review'),
+      dryRun: z.boolean().optional().describe('Defaults to true. Set false only when the user has explicitly approved a live execution request.'),
+    },
+    async (args) => {
+      const dryRun = args.dryRun !== false;
+      const catalog = await loadProviderEndpointCatalog(api, args.provider);
+      const endpoint = catalog.endpoints.find((candidate) => candidate.slug === args.action) ?? null;
+      const policy = endpointPolicySummary(catalog.provider, endpoint, args.scope);
+      const payload = {
+        provider: args.provider,
+        action: args.action,
+        scope: args.scope || endpoint?.requiredScope || endpoint?.required_scope || null,
+        inputs: args.inputs ?? {},
+        reason: args.reason ?? null,
+        dryRun,
+        providerStatus: catalog.provider?.status ?? null,
+        providerRuntime: catalog.provider?.runtime ?? null,
+        auth: endpoint?.auth || catalog.provider?.auth || null,
+        billing: endpoint?.billing || catalog.provider?.billing || null,
+        policy: {
+          ...HEADLESS_OPERATION_POLICY.request_provider_action_execution,
+          risk: policy.risk,
+          approval: policy.approval,
+          requiredScope: args.scope || endpoint?.requiredScope || endpoint?.required_scope || null,
+        },
+      };
+      const plan = renderProviderActionExecutionPlan(payload, endpoint, catalog.provider);
+      if (dryRun) return md(plan);
+      if (payload.policy.approval !== 'required') {
+        payload.policy.approval = 'required';
+      }
+      try {
+        // Real, mounted route: POST /api/v1/integrations/{provider_id}/actions/
+        // {action_id} (actions_router merged into /integrations). It runs the
+        // governed fabric executor (approval gate + idempotency + audit). The
+        // prior .../providers/{p}/actions/{a}/execution-requests path did not
+        // exist server-side and 404'd. The handler treats the JSON body as the
+        // action payload and reads the idempotency key from the header.
+        const response = await api(
+          'POST',
+          `/api/v1/integrations/${encodeURIComponent(args.provider)}/actions/${encodeURIComponent(args.action)}`,
+          {
+            body: args.inputs ?? {},
+            headers: {
+              'Idempotency-Key': `mcp-${args.provider}-${args.action}-${Date.now()}`,
+            },
+          },
+        );
+        return md(`${plan}\n## Execution Request Submitted\n\n\`\`\`json\n${JSON.stringify(response, null, 2)}\n\`\`\`\n`);
+      } catch (err) {
+        return mdError('Provider action execution rejected by control plane', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'validate_integration_manifest',
+    'Validate a custom integration manifest against the Adrata safety gates (auth, scopes, rate limits, test endpoint, redaction, idempotency, PII fields, docs URL). Accepts either a file path or an inline manifest object.',
+    {
+      path: z.string().optional().describe('Path to adrata.integration.json on disk'),
+      manifest: z
+        .record(z.any())
+        .optional()
+        .describe('Inline manifest JSON; takes precedence over path'),
+    },
+    async (args) => {
+      const manifest = loadManifestInput(args);
+      if (manifest.error) return mdError('Manifest unreadable', manifest.error);
+      const report = validateIntegrationManifest(manifest.value);
+      return renderValidation('Integration', report);
+    },
+  );
+
+  server.tool(
+    'validate_extension_manifest',
+    'Validate a custom extension manifest (custom tables, fields, views, record cards, workflow nodes, provider actions, permissions, retention). Accepts either a file path or an inline manifest object.',
+    {
+      path: z.string().optional().describe('Path to adrata.extension.json on disk'),
+      manifest: z
+        .record(z.any())
+        .optional()
+        .describe('Inline manifest JSON; takes precedence over path'),
+    },
+    async (args) => {
+      const manifest = loadManifestInput(args);
+      if (manifest.error) return mdError('Manifest unreadable', manifest.error);
+      const report = validateExtensionManifest(manifest.value);
+      return renderValidation('Extension', report);
+    },
+  );
+
+  server.tool(
+    'request_deployment',
+    'Request that the Adrata control plane deploy a custom integration or extension. The manifest is validated locally first; the request is only sent if validation passes. Activation stays gated on policy review.',
+    {
+      kind: z.enum(['integration', 'extension']).describe('What is being deployed'),
+      path: z.string().optional().describe('Path to the manifest on disk'),
+      manifest: z
+        .record(z.any())
+        .optional()
+        .describe('Inline manifest JSON; takes precedence over path'),
+      target: z
+        .enum(['adrata_hosted', 'customer_runner', 'hybrid_runner'])
+        .optional()
+        .describe('Deployment target (default: adrata_hosted)'),
+      environment: z
+        .enum(['staging', 'production'])
+        .optional()
+        .describe('Deployment environment. Production requires customer_runner or hybrid_runner.'),
+      notes: z.string().optional().describe('Notes shown to the reviewer'),
+    },
+    async (args) => {
+      const target = args.target ?? 'adrata_hosted';
+      const environment = args.environment ?? 'staging';
+      if (!ALLOWED_TARGETS.has(target)) {
+        return mdError(`Unsupported target: ${target}`);
+      }
+      if (environment === 'production' && target === 'adrata_hosted') {
+        return mdError('Production deployments must target customer_runner or hybrid_runner');
+      }
+      const manifest = loadManifestInput(args);
+      if (manifest.error) return mdError('Manifest unreadable', manifest.error);
+      const report =
+        args.kind === 'integration'
+          ? validateIntegrationManifest(manifest.value)
+          : validateExtensionManifest(manifest.value);
+      if (!report.ok) {
+        return renderValidation(args.kind === 'integration' ? 'Integration' : 'Extension', report);
+      }
+      const payload = {
+        slug: manifest.value.slug,
+        target,
+        environment,
+        notes: args.notes ?? null,
+        manifest: manifest.value,
+        validation: report,
+        policy: HEADLESS_OPERATION_POLICY.request_deployment,
+      };
+      const route =
+        args.kind === 'integration'
+          ? '/api/v1/custom-integrations/deploy-requests'
+          : '/api/v1/extensions/deploy-requests';
+      try {
+        const response = await api('POST', route, { body: payload });
+        let text = `## Deploy request submitted\n\nSlug: \`${payload.slug}\`\nTarget: \`${target}\`\nEnvironment: \`${environment}\`\nKind: \`${args.kind}\`\n`;
+        if (response?.id) text += `Request ID: \`${response.id}\`\n`;
+        if (response?.status) text += `Status: \`${response.status}\`\n`;
+        text += '\nActivation requires policy/validation approval before runtime adapters mount the manifest.\n';
+        return md(text);
+      } catch (err) {
+        return mdError('Deploy request rejected by control plane', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'draft_workflow',
+    'Create an Adrata workflow draft manifest that can be saved as adrata.workflow.json, validated, dry-run, deployed, and replayed without opening the app.',
+    {
+      slug: z.string().describe('Workflow slug in kebab-case'),
+      provider: z.string().optional().describe('Provider slug to prefill in the starter step'),
+      action: z.string().optional().describe('Provider action to prefill in the starter step'),
+    },
+    async (args) => {
+      try {
+        const workflow = createWorkflowDraft(args.slug, {
+          provider: args.provider,
+          action: args.action,
+        });
+        return md(`## Workflow Draft\n\nSave this as \`adrata.workflow.json\`.\n\n\`\`\`json\n${JSON.stringify(workflow, null, 2)}\n\`\`\`\n`);
+      } catch (err) {
+        return mdError('Could not draft workflow', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'validate_workflow_draft',
+    'Validate an Adrata workflow draft. Ensures every step has permissions, audit event mapping, policy risk, and deploy requires a dry-run.',
+    {
+      path: z.string().optional().describe('Path to adrata.workflow.json on disk'),
+      workflow: z.record(z.any()).optional().describe('Inline workflow JSON; takes precedence over path'),
+    },
+    async (args) => {
+      const workflow = loadWorkflowInput(args);
+      if (workflow.error) return mdError('Workflow unreadable', workflow.error);
+      const report = validateWorkflowDraft(workflow.value);
+      return renderValidation('Workflow Draft', report);
+    },
+  );
+
+  server.tool(
+    'dry_run_workflow',
+    'Dry-run a workflow draft through the control plane. If the API is unavailable, returns a local policy/audit execution plan for review.',
+    {
+      path: z.string().optional().describe('Path to adrata.workflow.json on disk'),
+      workflow: z.record(z.any()).optional().describe('Inline workflow JSON; takes precedence over path'),
+      inputs: z.record(z.any()).optional().describe('Dry-run input fixture'),
+      notes: z.string().optional(),
+    },
+    async (args) => {
+      const workflow = loadWorkflowInput(args);
+      if (workflow.error) return mdError('Workflow unreadable', workflow.error);
+      const report = validateWorkflowDraft(workflow.value);
+      if (!report.ok) return renderValidation('Workflow Draft', report);
+      // The control-plane dry-run is the stateless graph linter on the
+      // workflow runtime: POST /api/v1/workflow-runtime/graphs/validate.
+      const graph = workflowGraphFromDraft(workflow.value);
+      try {
+        const response = await api('POST', '/api/v1/workflow-runtime/graphs/validate', {
+          body: { graph },
+        });
+        const serverReport = response?.data || response || {};
+        let text = `## Workflow Dry Run\n\nSlug: \`${workflow.value.slug || '—'}\`\n`;
+        text += `Server validation: ${serverReport.ok ? '✅ passed' : '❌ failed'}\n`;
+        if (serverReport.triggerNodeId) text += `Trigger node: \`${serverReport.triggerNodeId}\`\n`;
+        if (serverReport.nodeCount != null) text += `Nodes: ${serverReport.nodeCount} | Edges: ${serverReport.edgeCount ?? 0}\n`;
+        if (Array.isArray(serverReport.errors) && serverReport.errors.length > 0) {
+          text += '\n### Control-plane errors\n';
+          for (const e of serverReport.errors) text += `- ${e}\n`;
+        }
+        text += `\nInputs: \`${JSON.stringify(args.inputs || {})}\`\n`;
+        if (args.notes) text += `Notes: ${args.notes}\n`;
+        text += '\nThe graph linter checks structure only. Provider action existence and scope grants are enforced at deploy time.\n';
+        return md(text);
+      } catch (err) {
+        return mdError('Workflow dry-run rejected by control plane', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'request_workflow_deployment',
+    'Request hosted deployment for a workflow. Requires a prior dry-run id and keeps activation gated on policy pass and audit logging.',
+    {
+      path: z.string().optional().describe('Path to adrata.workflow.json on disk'),
+      workflow: z.record(z.any()).optional().describe('Inline workflow JSON; takes precedence over path'),
+      dryRunId: z.string().describe('Dry-run id returned by dry_run_workflow'),
+      target: z.enum(['adrata_hosted', 'customer_runner', 'hybrid_runner']).optional(),
+      notes: z.string().optional(),
+    },
+    async (args) => {
+      const workflow = loadWorkflowInput(args);
+      if (workflow.error) return mdError('Workflow unreadable', workflow.error);
+      const report = validateWorkflowDraft(workflow.value);
+      if (!report.ok) return renderValidation('Workflow Draft', report);
+      // Hosted deployment on the workflow runtime is definition -> version ->
+      // deploy. There is no single deploy-request route, so walk the chain.
+      const graph = workflowGraphFromDraft(workflow.value);
+      try {
+        const definitionResponse = await api('POST', '/api/v1/workflow-runtime/definitions', {
+          body: {
+            name: workflow.value.name || workflow.value.slug,
+            description: workflow.value.description ?? null,
+            triggerType: workflow.value.trigger?.type ?? 'manual',
+          },
+        });
+        const definitionId = (definitionResponse?.data || definitionResponse || {}).id;
+        if (!definitionId) {
+          return mdError('Deploy request rejected by control plane', 'The control plane did not return a workflow definition id.');
+        }
+
+        const versionResponse = await api(
+          'POST',
+          `/api/v1/workflow-runtime/definitions/${encodeURIComponent(definitionId)}/versions`,
+          { body: { graph } },
+        );
+        const version = versionResponse?.data || versionResponse || {};
+        const versionId = version.id;
+        if (!versionId) {
+          return mdError('Deploy request rejected by control plane', 'The control plane did not return a workflow version id.');
+        }
+        if (version.validation && version.validation.ok === false) {
+          let text = `## Workflow version not deployable\n\nDefinition: \`${definitionId}\`\nVersion: \`${versionId}\`\n\n### Control-plane errors\n`;
+          for (const e of version.validation.errors || []) text += `- ${e}\n`;
+          return md(text);
+        }
+
+        const deployResponse = await api(
+          'POST',
+          `/api/v1/workflow-runtime/definitions/${encodeURIComponent(definitionId)}/versions/${encodeURIComponent(versionId)}/deploy`,
+        );
+        const deployed = deployResponse?.data || deployResponse || {};
+        let text = `## Workflow deployment requested\n\n`;
+        text += `Slug: \`${workflow.value.slug || '—'}\`\n`;
+        text += `Definition: \`${definitionId}\`\n`;
+        text += `Version: \`${versionId}\`\n`;
+        text += `Status: \`${deployed.status || 'deployed'}\`\n`;
+        text += `Dry-run id: \`${args.dryRunId}\`\n`;
+        if (args.target) text += `Target: \`${args.target}\`\n`;
+        if (args.notes) text += `Notes: ${args.notes}\n`;
+        text += '\nActivation stays gated on policy pass and audit logging.\n';
+        return md(text);
+      } catch (err) {
+        return mdError('Deploy request rejected by control plane', err.message);
+      }
+    },
+  );
+
+  server.tool(
+    'replay_workflow_run',
+    'Replay or plan replay for a workflow run. Defaults to dry-run; live replay remains policy/audit gated.',
+    {
+      runId: z.string().describe('Workflow run id'),
+      reason: z.string().optional().describe('Why replay is being requested'),
+      dryRun: z.boolean().optional().describe('Defaults to true. Set false only for a live replay request.'),
+    },
+    async (args) => {
+      // No replay endpoint exists on the workflow runtime. Fail fast with the
+      // supported alternatives instead of issuing a request that cannot route.
+      return mdError(
+        'Workflow replay is not supported in this API version',
+        `The Adrata workflow runtime exposes no replay route (requested run: ${args.runId}). Runs are read-only: inspect with GET /api/v1/workflow-runtime/runs/${args.runId}, then start a fresh run via POST /api/v1/workflow-runtime/definitions/{definition_id}/runs.`
+      );
+    },
+  );
+
+  server.tool(
+    'submit_adrata_command',
+    'Submit a governed Adrata Cloud command through the same command plane used by the app and CLI. Defaults to dry-run preview. Use execute only when the user asked for a write and you have an idempotency key; high-risk writes require approval.',
+    {
+      commandType: z
+        .string()
+        .describe(
+          'Command type such as path_to_power, research_account, update_buyer_group, request_intro, move_person_to_lead, create_next_action, or sync_crm',
+        ),
+      mode: z.enum(['dry_run', 'execute']).optional().describe('Defaults to dry_run. execute queues the command if policy allows it.'),
+      payload: z.record(z.any()).optional().describe('Command-specific target, record ids, changes, and context.'),
+      commandId: z.string().optional().describe('Optional caller-provided command id.'),
+      idempotencyKey: z.string().optional().describe('Required for safe execute retries; generated by the API if omitted.'),
+      approvalId: z.string().optional().describe('Approval id for high-risk execute commands.'),
+      reason: z.string().optional().describe('Human-readable reason for audit and approval review.'),
+    },
+    async (args) => {
+      const command = buildCommandPayload(args);
+      if (command.error) return mdError('Command invalid', command.error);
+
+      try {
+        const result = await api('POST', '/api/v1/platform/commands', {
+          body: command.payload,
+        });
+        return md(`## Adrata Command Submitted\n\n\`\`\`json\n${JSON.stringify(result, null, 2)}\n\`\`\`\n`);
+      } catch (err) {
+        if (command.payload.mode === 'dry_run') {
+          return md(`## Adrata Command Local Preview\n\nThe command plane was unavailable, so this is a local dry-run preview. Re-run when connected to Adrata Cloud for policy, audit, rollback, and token usage metadata.\n\n\`\`\`json\n${JSON.stringify(localCommandPreview(command.payload), null, 2)}\n\`\`\`\n`);
+        }
+        return mdError('Adrata command rejected by control plane', err.message);
+      }
+    },
+  );
+}
+
+async function loadProviderEndpointCatalog(api, provider) {
+  try {
+    const result = await api(
+      'GET',
+      `/api/v1/providers/catalog/${encodeURIComponent(provider)}/endpoints`,
+    );
+    const data = result?.data || result || {};
+    return {
+      provider: data.provider || {},
+      endpoints: Array.isArray(data.endpoints) ? data.endpoints : [],
+      runtimePlan: data.runtimePlan || null,
+    };
+  } catch {
+    return { provider: {}, endpoints: [], runtimePlan: null };
+  }
+}
+
+function providerPolicySummary(provider = {}) {
+  const runtime = String(provider.runtime || provider.runtimeState || '').toLowerCase();
+  const status = String(provider.status || '').toLowerCase();
+  if (runtime.includes('customer') || status === 'live') {
+    return { risk: 'medium', approval: 'required for writes/external sends' };
+  }
+  if (runtime.includes('staged') || status === 'beta') {
+    return { risk: 'medium', approval: 'required; staged adapter review' };
+  }
+  return { risk: 'high', approval: 'blocked until provider promotion' };
+}
+
+function endpointPolicySummary(provider = {}, endpoint = {}, requestedScope = null) {
+  const scope = String(
+    requestedScope || endpoint?.requiredScope || endpoint?.required_scope || endpoint?.scope || '',
+  ).toLowerCase();
+  const runtime = String(endpoint?.runtimeState || provider?.runtime || '').toLowerCase();
+  if (runtime.includes('registry') || runtime.includes('roadmap')) {
+    return { risk: 'high', approval: 'blocked until provider promotion' };
+  }
+  if (
+    scope.includes('write') ||
+    scope.includes('send') ||
+    scope.includes('enroll') ||
+    scope.includes('webhook') ||
+    scope.includes('external')
+  ) {
+    return { risk: 'high', approval: 'required' };
+  }
+  return providerPolicySummary(provider);
+}
+
+function renderProviderActionExecutionPlan(payload, endpoint, provider) {
+  const providerName = provider?.name || payload.provider;
+  const actionLabel = endpoint?.slug || payload.action;
+  let text = `## Provider Action Execution ${payload.dryRun ? 'Dry Run' : 'Request'}\n\n`;
+  text += `- **Provider:** ${providerName} (\`${payload.provider}\`)\n`;
+  text += `- **Action:** \`${actionLabel}\`\n`;
+  text += `- **Scope:** ${payload.scope || '\u2014'}\n`;
+  text += `- **Auth:** ${payload.auth || '\u2014'}\n`;
+  text += `- **Runtime:** ${payload.providerRuntime || endpoint?.runtimeState || '\u2014'}\n`;
+  text += `- **Status:** ${payload.providerStatus || '\u2014'}\n`;
+  text += `- **Billing:** ${payload.billing || '\u2014'}\n`;
+  text += `- **Risk:** ${payload.policy.risk}\n`;
+  text += `- **Approval:** ${payload.policy.approval}\n`;
+  text += `- **Audit event:** ${payload.policy.auditEvent}\n`;
+  if (endpoint?.method || endpoint?.path) {
+    text += `- **Endpoint:** ${endpoint.method || '\u2014'} \`${endpoint.path || '\u2014'}\`\n`;
+  }
+  text += '\n```json\n';
+  text += `${JSON.stringify(payload, null, 2)}\n`;
+  text += '```\n';
+  if (payload.dryRun) {
+    text += '\nSet `dryRun: false` only after the user approves the scoped action and inputs.\n';
+  }
+  return text;
+}
+
+function loadManifestInput({ path, manifest }) {
+  if (manifest && typeof manifest === 'object') {
+    return { value: manifest };
+  }
+  if (typeof path === 'string' && path.length > 0) {
+    try {
+      const absolute = resolve(process.cwd(), path);
+      const text = readFileSync(absolute, 'utf8');
+      return { value: JSON.parse(text) };
+    } catch (err) {
+      return { error: err.message };
+    }
+  }
+  return { error: 'Provide either path or manifest' };
+}
+
+function renderValidation(label, report) {
+  if (report.ok) {
+    return md(`## ${label} Manifest \u2014 Valid\n\nNo violations. Manifest is ready for \`request_deployment\`.\n`);
+  }
+  let text = `## ${label} Manifest \u2014 ${report.errors.length} violation(s)\n\n`;
+  for (const err of report.errors) text += `- ${err}\n`;
+  text += '\nFix locally and re-run validation before requesting deployment.\n';
+  return md(text);
+}
+
+function loadWorkflowInput({ path, workflow }) {
+  return loadManifestInput({ path, manifest: workflow });
+}
+
+/**
+ * Project an adrata.workflow draft manifest onto the nodes/edges graph shape
+ * the workflow runtime validates (`{ nodes: [{ id, type }], edges: [{ from, to }] }`).
+ * A manifest that already carries an explicit graph is passed through.
+ */
+function workflowGraphFromDraft(workflow = {}) {
+  if (workflow.graph && Array.isArray(workflow.graph.nodes)) return workflow.graph;
+
+  const triggerType = workflow.trigger?.type || 'manual';
+  const triggerId = workflow.trigger?.id || '__trigger';
+  const nodes = [
+    {
+      id: triggerId,
+      type: `trigger.${triggerType}`,
+      config: workflow.trigger?.config || {},
+    },
+  ];
+  const edges = [];
+
+  let previousId = triggerId;
+  for (const step of Array.isArray(workflow.steps) ? workflow.steps : []) {
+    const [providerId, action] = String(step.uses || '').split('.');
+    nodes.push({
+      id: step.id,
+      type: step.type || 'provider.action',
+      providerId: providerId || undefined,
+      action: action || undefined,
+      config: step.input || {},
+    });
+    edges.push({ from: previousId, to: step.id });
+    previousId = step.id;
+  }
+
+  return { nodes, edges };
+}
+
+function createWorkflowDraft(slug, options = {}) {
+  if (!slug || !/^[a-z][a-z0-9-]*$/.test(slug)) {
+    throw new Error('slug must be kebab-case and start with a letter');
+  }
+  const provider = options.provider ?? 'replace-provider-slug';
+  const action = options.action ?? 'replace_action';
+  return {
+    schemaVersion: 1,
+    kind: 'adrata.workflow',
+    slug,
+    name: titleize(slug),
+    description: 'Describe the GTM outcome this workflow should produce.',
+    trigger: { type: 'manual' },
+    permissions: ['providers.inspect', 'workflows.dry_run', 'workflows.deploy.request'],
+    policy: {
+      dryRunRequired: true,
+      approvalRequired: true,
+      auditEventPrefix: `workflow.${slug}`,
+      maxEstimatedCostUsd: 5,
+    },
+    audit: {
+      redactFields: ['apiKey', 'token', 'authorization', 'emailBody'],
+      includeInputs: true,
+      includeOutputs: false,
+    },
+    replay: {
+      enabled: true,
+      retentionDays: 30,
+    },
+    steps: [
+      {
+        id: 'run_provider_action',
+        name: 'Run provider action',
+        uses: `${provider}.${action}`,
+        input: {},
+        permissions: ['providers.actions.execute'],
+        policy: {
+          risk: 'medium',
+          auditEvent: `workflow.${slug}.run_provider_action`,
+        },
+      },
+    ],
+  };
+}
+
+function validateWorkflowDraft(workflow) {
+  const errors = [];
+  if (!workflow || typeof workflow !== 'object') {
+    errors.push('workflow must be an object');
+    return { ok: false, errors };
+  }
+  if (workflow.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+  if (workflow.kind !== 'adrata.workflow') errors.push('kind must be adrata.workflow');
+  if (!workflow.slug || !/^[a-z][a-z0-9-]*$/.test(workflow.slug)) {
+    errors.push('slug must be kebab-case and start with a letter');
+  }
+  if (!workflow.name) errors.push('name is required');
+  if (!workflow.trigger || !WORKFLOW_TRIGGER_TYPES.has(workflow.trigger.type)) {
+    errors.push('trigger.type must be manual, provider_event, schedule, or record_change');
+  }
+  if (!Array.isArray(workflow.permissions) || workflow.permissions.length === 0) {
+    errors.push('permissions must contain at least one workflow permission');
+  }
+  if (workflow.policy?.dryRunRequired !== true) {
+    errors.push('policy.dryRunRequired must be true for deployable workflows');
+  }
+  if (typeof workflow.policy?.approvalRequired !== 'boolean') {
+    errors.push('policy.approvalRequired must be boolean');
+  }
+  if (!workflow.policy?.auditEventPrefix) errors.push('policy.auditEventPrefix is required');
+  if (!Array.isArray(workflow.audit?.redactFields)) {
+    errors.push('audit.redactFields must list sensitive input/output fields');
+  }
+  if (typeof workflow.audit?.includeInputs !== 'boolean') errors.push('audit.includeInputs must be boolean');
+  if (typeof workflow.audit?.includeOutputs !== 'boolean') errors.push('audit.includeOutputs must be boolean');
+  if (typeof workflow.replay?.enabled !== 'boolean' || !positiveInt(workflow.replay?.retentionDays)) {
+    errors.push('replay.enabled must be boolean and replay.retentionDays must be positive');
+  }
+  if (!Array.isArray(workflow.steps) || workflow.steps.length === 0) {
+    errors.push('steps must contain at least one step');
+  } else {
+    workflow.steps.forEach((step, i) => {
+      if (!step?.id || !/^[a-z][a-z0-9_]*$/.test(step.id)) errors.push(`steps[${i}].id must be snake_case`);
+      if (!step?.name) errors.push(`steps[${i}].name is required`);
+      if (!step?.uses && !step?.action) errors.push(`steps[${i}].uses or action is required`);
+      if (!Array.isArray(step?.permissions) || step.permissions.length === 0) {
+        errors.push(`steps[${i}].permissions must contain at least one permission`);
+      }
+      if (!step?.policy?.auditEvent) errors.push(`steps[${i}].policy.auditEvent is required`);
+      if (!STEP_RISKS.has(step?.policy?.risk)) errors.push(`steps[${i}].policy.risk must be low, medium, or high`);
+      if (step?.policy?.risk === 'high' && step.policy.approvalRequired !== true) {
+        errors.push(`steps[${i}].policy.approvalRequired must be true for high-risk steps`);
+      }
+    });
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+function buildCommandPayload(args) {
+  const commandType = normalizeCommandType(args.commandType);
+  if (!commandType) return { error: 'commandType is required' };
+  const mode = normalizeCommandMode(args.mode);
+  if (!mode) return { error: 'mode must be dry_run or execute' };
+  const payload = args.payload ?? {};
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+    return { error: 'payload must be a JSON object' };
+  }
+  return {
+    payload: {
+      commandType,
+      mode,
+      payload,
+      ...(cleanOptional(args.commandId) ? { commandId: cleanOptional(args.commandId) } : {}),
+      ...(cleanOptional(args.idempotencyKey) ? { idempotencyKey: cleanOptional(args.idempotencyKey) } : {}),
+      ...(cleanOptional(args.approvalId) ? { approvalId: cleanOptional(args.approvalId) } : {}),
+      ...(cleanOptional(args.reason) ? { reason: cleanOptional(args.reason) } : {}),
+    },
+  };
+}
+
+function normalizeCommandType(value) {
+  const normalized = cleanOptional(value)?.replaceAll('-', '_').replaceAll(' ', '_').toLowerCase();
+  if (!normalized || normalized.length > 96 || !/^[a-z0-9_.]+$/.test(normalized)) return null;
+  return normalized;
+}
+
+function normalizeCommandMode(value) {
+  const normalized = String(value ?? 'dry_run').replace('-', '_');
+  return COMMAND_MODES.has(normalized) ? normalized : null;
+}
+
+function localCommandPreview(payload) {
+  const risk = commandRisk(payload.commandType);
+  const requiresApproval = payload.mode === 'execute' && risk === 'high' && !payload.approvalId;
+  return {
+    success: true,
+    simulated: true,
+    data: {
+      commandType: payload.commandType,
+      mode: payload.mode,
+      dryRun: payload.mode === 'dry_run',
+      status: requiresApproval ? 'requires_approval' : 'planned',
+      policy: {
+        decision: requiresApproval ? 'requires_approval' : 'allow',
+        reason: requiresApproval
+          ? 'High-risk write commands require approval before execution'
+          : 'Local dry-run preview; Adrata Cloud will make the final policy decision',
+        requiredApproval: risk === 'high',
+        risk,
+      },
+      audit: {
+        auditEvent: HEADLESS_OPERATION_POLICY.submit_adrata_command.auditEvent,
+        idempotencyKey: payload.idempotencyKey ?? null,
+      },
+      rollback: {
+        supported: true,
+        strategy: payload.commandType.includes('delete')
+          ? 'restore_from_checkpoint'
+          : 'previous_value_checkpoint',
+      },
+      preview: {
+        summary: `Prepare ${payload.commandType}`,
+        payload: payload.payload,
+      },
+      usage: {
+        estimatedAdrataTokens: risk === 'high' ? 125 : risk === 'medium' ? 75 : 10,
+        metered: true,
+        billingEvent: `command.${payload.commandType}`,
+      },
+    },
+  };
+}
+
+function commandRisk(commandType) {
+  if (
+    commandType.includes('delete') ||
+    commandType.includes('sync_crm') ||
+    commandType.includes('move_') ||
+    commandType.includes('update_') ||
+    commandType.includes('create_') ||
+    commandType.includes('send_')
+  ) {
+    return 'high';
+  }
+  if (
+    commandType.includes('enrich') ||
+    commandType.includes('score') ||
+    commandType.includes('path') ||
+    commandType.includes('research')
+  ) {
+    return 'medium';
+  }
+  return 'low';
+}
+
+function cleanOptional(value) {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+}
+
+export function validateIntegrationManifest(manifest) {
+  const errors = [];
+  validateBase(manifest, 'adrata.integration', errors);
+  if (!VISIBILITY.has(manifest?.visibility)) {
+    errors.push('visibility must be workspace_private or org_shared');
+  }
+  if (!manifest?.auth || !AUTH_TYPES.has(manifest.auth.type)) {
+    errors.push('auth.type must be api_key, bearer_token, oauth2, or none');
+  }
+  if (!Array.isArray(manifest?.scopes) || manifest.scopes.length === 0) {
+    errors.push('scopes must contain at least one scope');
+  }
+  if (
+    !positiveInt(manifest?.rateLimits?.perSecond) ||
+    !positiveInt(manifest?.rateLimits?.perMinute)
+  ) {
+    errors.push('rateLimits.perSecond and rateLimits.perMinute must be positive integers');
+  }
+  if (!manifest?.testEndpoint?.method || !manifest?.testEndpoint?.path) {
+    errors.push('testEndpoint.method and testEndpoint.path are required');
+  }
+  if (!Array.isArray(manifest?.redaction?.secretFields)) {
+    errors.push('redaction.secretFields must list fields to redact');
+  }
+  if (typeof manifest?.idempotency?.supported !== 'boolean') {
+    errors.push('idempotency.supported must be boolean');
+  }
+  if (!Array.isArray(manifest?.piiFields)) {
+    errors.push('piiFields must be an array');
+  }
+  if (!isAbsoluteUrl(manifest?.docsUrl)) {
+    errors.push('docsUrl must be an absolute URL');
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+export function validateExtensionManifest(manifest) {
+  const errors = [];
+  validateBase(manifest, 'adrata.extension', errors);
+  if (!VISIBILITY.has(manifest?.visibility)) {
+    errors.push('visibility must be workspace_private or org_shared');
+  }
+  if (Array.isArray(manifest?.fields)) {
+    manifest.fields.forEach((field, i) => {
+      if (!ENTITY_TYPES.has(field?.entity)) errors.push(`fields[${i}].entity is unsupported`);
+      if (!isSnakeCase(field?.key)) errors.push(`fields[${i}].key must be snake_case`);
+      if (!field?.label) errors.push(`fields[${i}].label is required`);
+      if (!FIELD_TYPES.has(field?.type)) errors.push(`fields[${i}].type is unsupported`);
+    });
+  } else {
+    errors.push('fields must be an array');
+  }
+  if (Array.isArray(manifest?.customTables)) {
+    manifest.customTables.forEach((table, i) => {
+      if (!isSnakeCase(table?.key)) errors.push(`customTables[${i}].key must be snake_case`);
+      if (!table?.label) errors.push(`customTables[${i}].label is required`);
+      if (!Array.isArray(table?.fields) || table.fields.length === 0) {
+        errors.push(`customTables[${i}].fields must contain at least one field`);
+      } else {
+        table.fields.forEach((field, fieldIndex) => {
+          if (!isSnakeCase(field?.key)) {
+            errors.push(`customTables[${i}].fields[${fieldIndex}].key must be snake_case`);
+          }
+          if (!field?.label) {
+            errors.push(`customTables[${i}].fields[${fieldIndex}].label is required`);
+          }
+          if (!FIELD_TYPES.has(field?.type)) {
+            errors.push(`customTables[${i}].fields[${fieldIndex}].type is unsupported`);
+          }
+        });
+      }
+    });
+  } else {
+    errors.push('customTables must be an array');
+  }
+  for (const key of ['tableExtensions', 'views', 'recordCards', 'workflowNodes', 'providerActions', 'permissions']) {
+    if (!Array.isArray(manifest?.[key])) errors.push(`${key} must be an array`);
+  }
+  if (Array.isArray(manifest?.workflowNodes)) {
+    manifest.workflowNodes.forEach((n, i) => {
+      if (!isSnakeCase(n?.key)) errors.push(`workflowNodes[${i}].key must be snake_case`);
+      if (!n?.label) errors.push(`workflowNodes[${i}].label is required`);
+      if (!TRIGGER_TYPES.has(n?.trigger)) errors.push(`workflowNodes[${i}].trigger is unsupported`);
+    });
+  }
+  if (Array.isArray(manifest?.providerActions)) {
+    manifest.providerActions.forEach((action, i) => {
+      if (!action?.provider) errors.push(`providerActions[${i}].provider is required`);
+      if (!isSnakeCase(action?.action)) errors.push(`providerActions[${i}].action must be snake_case`);
+      if (!action?.scope) errors.push(`providerActions[${i}].scope is required`);
+    });
+  }
+  if (
+    typeof manifest?.retention?.pii !== 'boolean' ||
+    !positiveInt(manifest?.retention?.days)
+  ) {
+    errors.push('retention.pii must be boolean and retention.days must be positive');
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+function validateBase(manifest, kind, errors) {
+  if (!manifest || typeof manifest !== 'object') {
+    errors.push('manifest must be an object');
+    return;
+  }
+  if (manifest.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+  if (manifest.kind !== kind) errors.push(`kind must be ${kind}`);
+  if (!manifest.slug || !/^[a-z][a-z0-9-]*$/.test(manifest.slug)) {
+    errors.push('slug must be kebab-case and start with a letter');
+  }
+  if (!manifest.name) errors.push('name is required');
+}
+
+function isSnakeCase(key) {
+  return typeof key === 'string' && /^[a-z][a-z0-9_]*$/.test(key);
+}
+
+function positiveInt(value) {
+  return Number.isInteger(value) && value > 0;
+}
+
+function isAbsoluteUrl(value) {
+  if (typeof value !== 'string' || value.length === 0) return false;
+  try {
+    return Boolean(new URL(value));
+  } catch {
+    return false;
+  }
+}
+
+function titleize(slug) {
+  return slug
+    .split('-')
+    .map((part) => part.slice(0, 1).toUpperCase() + part.slice(1))
+    .join(' ');
+}