@crossdelta/pf-mcp 0.1.0

package/dist/cli.js

@@ -0,0 +1,2379 @@
+#!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/server.ts
+import {
+  collectExecutableToolSpecs,
+  createContext,
+  createContextFromWorkspace as createContextFromWorkspace5,
+  isElicitInputEffect as isElicitInputEffect4,
+  loadPlugins
+} from "@crossdelta/platform-sdk/facade";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  CompleteRequestSchema,
+  ListResourcesRequestSchema,
+  ListResourceTemplatesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// src/resources/contracts.ts
+import { createContextFromWorkspace } from "@crossdelta/platform-sdk/facade";
+var CONTRACTS_URI = "pf://contracts";
+var buildContractsMeta = (contracts) => ({
+  path: contracts.path,
+  packageName: contracts.packageName
+});
+var readContracts = async (workspaceRoot) => {
+  const context = await createContextFromWorkspace(workspaceRoot);
+  const meta = buildContractsMeta(context.workspace.contracts);
+  return {
+    uri: CONTRACTS_URI,
+    mimeType: "application/json",
+    text: JSON.stringify(meta, null, 2)
+  };
+};
+var createContractsResource = (workspaceRoot) => ({
+  resource: {
+    uri: CONTRACTS_URI,
+    name: "Contracts",
+    description: "Contracts package configuration (path and package name).",
+    mimeType: "application/json"
+  },
+  read: async () => readContracts(workspaceRoot)
+});
+
+// src/resources/generator-docs.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+import { getGeneratorDocsDir, listGeneratorDocs } from "@crossdelta/platform-sdk/facade";
+var createGeneratorDocResource = (docName) => ({
+  resource: {
+    uri: `docs://generators/${docName}`,
+    name: `${docName} Generator Guidelines`,
+    description: `AI instructions for ${docName} generation`,
+    mimeType: "text/markdown"
+  },
+  async read() {
+    const docsDir = getGeneratorDocsDir();
+    const docPath = join(docsDir, `${docName}.md`);
+    try {
+      const content = await readFile(docPath, "utf-8");
+      return {
+        uri: `docs://generators/${docName}`,
+        mimeType: "text/markdown",
+        text: content
+      };
+    } catch (error) {
+      throw new Error(
+        `Failed to read generator doc '${docName}': ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+});
+var createGeneratorDocsListResource = () => ({
+  resource: {
+    uri: "docs://generators",
+    name: "Available Generator Documentation",
+    description: "List of all available generator guidelines",
+    mimeType: "application/json"
+  },
+  async read() {
+    const docs = await listGeneratorDocs();
+    const docsInfo = docs.map((name) => ({
+      name,
+      uri: `docs://generators/${name}`
+    }));
+    return {
+      uri: "docs://generators",
+      mimeType: "application/json",
+      text: JSON.stringify(docsInfo, null, 2)
+    };
+  }
+});
+var createAllGeneratorDocResources = async () => {
+  const docNames = await listGeneratorDocs();
+  const docResources = docNames.map(createGeneratorDocResource);
+  const listResource = createGeneratorDocsListResource();
+  return [listResource, ...docResources];
+};
+
+// src/plan-cache.ts
+var planCache = /* @__PURE__ */ new Map();
+var reviewCache = /* @__PURE__ */ new Map();
+var cachePlan = (plan) => {
+  planCache.set(plan.planHash, plan);
+};
+var cacheReview = (review) => {
+  reviewCache.set(review.planHash, review);
+};
+
+// src/resources/services.ts
+import { createContextFromWorkspace as createContextFromWorkspace2 } from "@crossdelta/platform-sdk/facade";
+var SERVICES_URI = "pf://services";
+var readServices = async (workspaceRoot) => {
+  const context = await createContextFromWorkspace2(workspaceRoot);
+  const meta = {
+    services: context.workspace.availableServices,
+    count: context.workspace.availableServices.length
+  };
+  return {
+    uri: SERVICES_URI,
+    mimeType: "application/json",
+    text: JSON.stringify(meta, null, 2)
+  };
+};
+var createServicesResource = (workspaceRoot) => ({
+  resource: {
+    uri: SERVICES_URI,
+    name: "Services",
+    description: "List of discovered services in the workspace.",
+    mimeType: "application/json"
+  },
+  read: async () => readServices(workspaceRoot)
+});
+
+// src/resources/templates.ts
+import { readdir, readFile as readFile2, stat } from "fs/promises";
+import { join as join2 } from "path";
+var getTemplatesDir = () => {
+  const devPath = join2(process.cwd(), "packages/platform-sdk/bin/templates");
+  try {
+    const fs = __require("fs");
+    if (fs.existsSync(devPath)) {
+      return devPath;
+    }
+  } catch {
+  }
+  return join2(process.cwd(), "node_modules/@crossdelta/platform-sdk/bin/templates");
+};
+var getTemplateStructure = async (templateName) => {
+  const templateDir = join2(getTemplatesDir(), templateName);
+  const walk = async (dir, prefix = "") => {
+    try {
+      const entries = await readdir(dir, { withFileTypes: true });
+      const results = await Promise.all(
+        entries.map(async (entry) => {
+          const fullPath = join2(dir, entry.name);
+          const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+          if (entry.isDirectory()) {
+            const subFiles = await walk(fullPath, relativePath);
+            return [`${relativePath}/`, ...subFiles];
+          }
+          const stats = await stat(fullPath);
+          return [`${relativePath} (${stats.size} bytes)`];
+        })
+      );
+      return results.flat();
+    } catch {
+      return [];
+    }
+  };
+  return await walk(templateDir);
+};
+var listTemplates = async () => {
+  const templatesDir = getTemplatesDir();
+  try {
+    const entries = await readdir(templatesDir, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+};
+var listTemplateFiles = async (templateName) => {
+  const structure = await getTemplateStructure(templateName);
+  return structure.filter((entry) => !entry.endsWith("/")).map((entry) => entry.replace(/ \(\d+ bytes\)$/, ""));
+};
+var readTemplateFile = async (templateName, filePath) => {
+  const templateDir = join2(getTemplatesDir(), templateName);
+  const fullPath = join2(templateDir, filePath);
+  if (!fullPath.startsWith(templateDir)) {
+    throw new Error("Invalid file path");
+  }
+  return await readFile2(fullPath, "utf-8");
+};
+var readTemplateStructure = async (templateName) => {
+  const structure = await getTemplateStructure(templateName);
+  return JSON.stringify(
+    {
+      template: templateName,
+      files: structure,
+      totalFiles: structure.length
+    },
+    null,
+    2
+  );
+};
+var createTemplatesListResource = () => ({
+  resource: {
+    uri: "templates://list",
+    name: "Available Service Templates",
+    description: "List of all available service templates (hono-microservice, nest-microservice, workspace)",
+    mimeType: "application/json"
+  },
+  async read() {
+    const templates = await listTemplates();
+    const templatesInfo = await Promise.all(
+      templates.map(async (name) => ({
+        name,
+        uri: `templates://${name}`,
+        description: `${name} template structure`
+      }))
+    );
+    return {
+      uri: "templates://list",
+      mimeType: "application/json",
+      text: JSON.stringify(
+        {
+          templates: templatesInfo,
+          count: templatesInfo.length
+        },
+        null,
+        2
+      )
+    };
+  }
+});
+var createTemplateFileResourceTemplate = () => ({
+  uriTemplate: "templates://{template}/file/{path}",
+  name: "Template File",
+  description: "Read individual files from service templates",
+  mimeType: "text/plain"
+});
+
+// src/resources/workspace-summary.ts
+import { createContextFromWorkspace as createContextFromWorkspace3 } from "@crossdelta/platform-sdk/facade";
+var WORKSPACE_SUMMARY_URI = "pf://workspace/summary";
+var buildWorkspaceSummary = (context, pluginModules) => ({
+  workspaceRoot: context.workspace.workspaceRoot,
+  contracts: context.workspace.contracts,
+  availableServices: context.workspace.availableServices,
+  loadedPlugins: pluginModules
+});
+var readWorkspaceSummary = async (pluginModules = [], workspaceRoot) => {
+  const context = await createContextFromWorkspace3(workspaceRoot);
+  const summary = buildWorkspaceSummary(context, pluginModules);
+  return {
+    uri: WORKSPACE_SUMMARY_URI,
+    mimeType: "application/json",
+    text: JSON.stringify(summary, null, 2)
+  };
+};
+var createWorkspaceSummaryResource = (pluginModules = [], workspaceRoot) => ({
+  resource: {
+    uri: WORKSPACE_SUMMARY_URI,
+    name: "Workspace Summary",
+    description: "Read-only workspace metadata including root path, contracts config, available services, and loaded plugins.",
+    mimeType: "application/json"
+  },
+  read: async () => readWorkspaceSummary(pluginModules, workspaceRoot)
+});
+
+// src/response.ts
+import "@modelcontextprotocol/sdk/types.js";
+var formatArtifactsSummary = (artifacts) => {
+  if (artifacts.length === 0) return "";
+  const grouped = artifacts.reduce(
+    (acc, a) => {
+      const key = a.type;
+      if (!acc[key]) acc[key] = [];
+      acc[key].push(a);
+      return acc;
+    },
+    {}
+  );
+  const lines = [];
+  for (const [type, items] of Object.entries(grouped)) {
+    lines.push(`
+${type.toUpperCase()} (${items.length}):`);
+    for (const item of items) {
+      lines.push(`  - ${item.path}`);
+    }
+  }
+  return lines.join("\n");
+};
+var formatChangesSummary = (changes) => {
+  if (changes.length === 0) return "";
+  const grouped = changes.reduce(
+    (acc, c) => {
+      const key = c.kind;
+      if (!acc[key]) acc[key] = [];
+      acc[key].push(c);
+      return acc;
+    },
+    {}
+  );
+  const lines = [];
+  for (const [kind, items] of Object.entries(grouped)) {
+    lines.push(`
+${kind} (${items.length}):`);
+    for (const item of items) {
+      const path = "path" in item ? item.path : "";
+      lines.push(`  - ${path || kind}`);
+    }
+  }
+  return lines.join("\n");
+};
+var formatNextActionsSummary = (next) => {
+  if (!next || next.length === 0) return "";
+  return `
+
+NEXT STEPS:
+${next.map((n) => `  $ ${n.command}
+    ${n.description}`).join("\n")}`;
+};
+var formatDiagnosticsSummary = (diagnostics) => {
+  if (diagnostics.length === 0) return "";
+  return `
+
+DIAGNOSTICS:
+${diagnostics.map((d) => `  [${d.level.toUpperCase()}] ${d.message}`).join("\n")}`;
+};
+var formatDependenciesSummary = (dependencies) => {
+  if (!dependencies || dependencies.length === 0) return "";
+  const lines = ["\n## Dependencies"];
+  for (const dep of dependencies) {
+    const version = dep.version || "latest";
+    const devTag = dep.dev ? " (dev)" : "";
+    lines.push(`  - ${dep.name}@${version}${devTag}`);
+  }
+  return lines.join("\n");
+};
+var formatEnvVarsSummary = (envVars) => {
+  if (!envVars || envVars.length === 0) return "";
+  const lines = ["\n## Environment Variables"];
+  for (const ev of envVars) {
+    const reqTag = ev.required ? " (required)" : "";
+    lines.push(`  - ${ev.key}${reqTag}: ${ev.description}`);
+  }
+  return lines.join("\n");
+};
+var formatFilesToGenerateSummary = (files) => {
+  if (!files || files.length === 0) return "";
+  const lines = ["\n## Files for AI to Generate"];
+  for (const file of files) {
+    const tags = [file.layer, file.kind].filter(Boolean).join("/");
+    lines.push(`  - ${file.path} [${tags}]`);
+    lines.push(`    Intent: ${file.intent}`);
+  }
+  return lines.join("\n");
+};
+var formatOperationResultAsMcpResponse = (result) => {
+  const extResult = result;
+  const textParts = [`# ${result.operation}`, "", result.ok ? "\u2713 Success" : "\u2717 Failed", "", result.summary];
+  if (result.artifacts.length > 0) {
+    textParts.push("\n## Artifacts");
+    textParts.push(formatArtifactsSummary(result.artifacts));
+  }
+  if (result.changes.length > 0) {
+    textParts.push("\n## Changes (Plan)");
+    textParts.push(formatChangesSummary(result.changes));
+  }
+  textParts.push(formatFilesToGenerateSummary(extResult.files));
+  textParts.push(formatDependenciesSummary(extResult.dependencies));
+  textParts.push(formatEnvVarsSummary(extResult.envVars));
+  if (extResult.postCommands && extResult.postCommands.length > 0) {
+    textParts.push("\n## Post Commands");
+    for (const cmd of extResult.postCommands) {
+      textParts.push(`  $ ${cmd}`);
+    }
+  }
+  textParts.push(formatDiagnosticsSummary(result.diagnostics));
+  textParts.push(formatNextActionsSummary(result.next));
+  textParts.push("\n\n---\n## Raw Result (JSON)");
+  textParts.push("```json");
+  textParts.push(JSON.stringify(result, null, 2));
+  textParts.push("```");
+  return {
+    content: [
+      {
+        type: "text",
+        text: textParts.join("\n")
+      }
+    ],
+    structuredContent: result,
+    isError: !result.ok
+  };
+};
+var formatErrorAsMcpResponse = (error, operation) => {
+  return {
+    content: [
+      {
+        type: "text",
+        text: `# ${operation}
+
+\u2717 Error: ${error.message}`
+      }
+    ],
+    structuredContent: {
+      ok: false,
+      operation,
+      summary: error.message,
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "error", message: error.message }]
+    },
+    isError: true
+  };
+};
+var formatElicitationAsMcpResponse = (elicitEffect, operation) => {
+  const fieldNames = elicitEffect.fields.map((f) => f.name);
+  const fieldDetails = elicitEffect.fields.map((f) => {
+    const parts = [`- **${f.name}**`];
+    if (f.required) parts.push(" (required)");
+    parts.push(`: ${f.prompt}`);
+    if (f.enum) parts.push(` [${f.enum.join(", ")}]`);
+    if (f.description) parts.push(`
+  ${f.description}`);
+    return parts.join("");
+  }).join("\n");
+  const textParts = [
+    `# ${operation}`,
+    "",
+    "\u23F3 Missing Required Inputs",
+    "",
+    elicitEffect.message,
+    "",
+    "## Please provide:",
+    fieldDetails,
+    "",
+    "---",
+    "Re-run the tool with these parameters."
+  ];
+  return {
+    content: [
+      {
+        type: "text",
+        text: textParts.join("\n")
+      }
+    ],
+    structuredContent: {
+      ok: false,
+      operation,
+      summary: elicitEffect.message,
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "info", message: "Awaiting user input" }],
+      elicitation: {
+        fields: elicitEffect.fields,
+        missingInputs: fieldNames
+      }
+    },
+    isError: false
+    // Not an error, just needs more input
+  };
+};
+
+// src/tools/apply-changes.ts
+import {
+  findWorkspaceRoot,
+  isElicitInputEffect as isElicitInputEffect2
+} from "@crossdelta/platform-sdk/facade";
+
+// src/audit.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { dirname, join as join3 } from "path";
+var AUDIT_DIR = ".pf/audit";
+var generateAuditFilename = (planHash, appliedAt) => {
+  const safeTimestamp = appliedAt.replace(/:/g, "-").replace(/\./g, "-");
+  return `${planHash.slice(0, 16)}-${safeTimestamp}.json`;
+};
+var writeAuditArtifact = (audit, workspaceRoot) => {
+  const auditDir = join3(workspaceRoot, AUDIT_DIR);
+  const filename = generateAuditFilename(audit.planHash, audit.appliedAt);
+  const filePath = join3(auditDir, filename);
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(audit, null, 2), "utf-8");
+  return filePath;
+};
+var createAuditArtifact = (planHash, policyVersion, effects, result, options = {}) => ({
+  planHash,
+  reviewToken: options.reviewToken,
+  policyVersion,
+  appliedAt: (/* @__PURE__ */ new Date()).toISOString(),
+  reviewedAt: options.reviewedAt,
+  dryRun: result.dryRun,
+  summary: result.summary,
+  counts: result.counts,
+  effects,
+  results: result.results
+});
+
+// src/effects/executors/deps-add.ts
+import { existsSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
+
+// src/types/plan.ts
+var DEFAULT_DEPENDENCY_POLICY = {
+  denyPatterns: ["file:", "git+", "git://", "github:", "https://", "http://"],
+  pinningStrategy: "caret"
+};
+
+// src/effects/types.ts
+var ErrorCodes = {
+  PATH_OUTSIDE_ROOT: "PATH_OUTSIDE_ROOT",
+  REQUIRES_ELICITATION: "REQUIRES_ELICITATION",
+  UNSUPPORTED_EFFECT: "UNSUPPORTED_EFFECT",
+  WRITE_FAILED: "WRITE_FAILED",
+  ATOMIC_RENAME_FAILED: "ATOMIC_RENAME_FAILED",
+  PLAN_HASH_MISMATCH: "PLAN_HASH_MISMATCH",
+  // M10: Review gate error codes
+  REVIEW_REQUIRED: "REVIEW_REQUIRED",
+  REVIEW_TOKEN_INVALID: "REVIEW_TOKEN_INVALID",
+  REVIEW_TOKEN_MISMATCH: "REVIEW_TOKEN_MISMATCH",
+  POLICY_VERSION_MISMATCH: "POLICY_VERSION_MISMATCH",
+  // Policy validation error codes
+  POLICY_VIOLATION: "POLICY_VIOLATION",
+  FORBIDDEN_DIR: "FORBIDDEN_DIR",
+  CONSOLE_IN_DOMAIN: "CONSOLE_IN_DOMAIN",
+  PROCESS_ENV_IN_DOMAIN: "PROCESS_ENV_IN_DOMAIN",
+  FETCH_IN_DOMAIN: "FETCH_IN_DOMAIN"
+};
+
+// src/effects/executors/deps-add.ts
+var validateDependency = (name, version, policy) => {
+  for (const pattern of policy.denyPatterns) {
+    if (name.startsWith(pattern)) {
+      return { valid: false, reason: `Package name matches denied pattern: ${pattern}` };
+    }
+  }
+  if (version) {
+    for (const pattern of policy.denyPatterns) {
+      if (version.startsWith(pattern)) {
+        return { valid: false, reason: `Version matches denied pattern: ${pattern}` };
+      }
+    }
+  }
+  return { valid: true };
+};
+var resolveVersion = (version, policy) => {
+  if (!version || version === "latest") {
+    return "*";
+  }
+  if (/^\d/.test(version)) {
+    switch (policy.pinningStrategy) {
+      case "exact":
+        return version;
+      case "tilde":
+        return `~${version}`;
+      default:
+        return `^${version}`;
+    }
+  }
+  return version;
+};
+var createSkipResult = (effect, packageJsonPath, existingVersion, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_skip" : "skipped",
+  message: dryRun ? `Would skip: ${effect.name}@${existingVersion} already exists` : `Dependency ${effect.name}@${existingVersion} already exists`,
+  path: packageJsonPath,
+  target: effect.name,
+  reason: "dependency exists"
+});
+var createAddResult = (effect, packageJsonPath, version, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_create" : "created",
+  message: dryRun ? `Would add dependency: ${effect.name}@${version}` : `Added dependency: ${effect.name}@${version}`,
+  path: packageJsonPath,
+  target: effect.name
+});
+var createPolicyViolationResult = (effect, reason) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Policy violation: ${reason}`,
+  target: effect.name,
+  code: ErrorCodes.POLICY_VIOLATION,
+  reason
+});
+var createErrorResult = (effect, packageJsonPath, error) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Failed to add dependency ${effect.name}: ${error instanceof Error ? error.message : String(error)}`,
+  path: packageJsonPath,
+  target: effect.name,
+  code: ErrorCodes.WRITE_FAILED
+});
+var createMissingPackageJsonResult = (effect, packageJsonPath) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `package.json not found at ${packageJsonPath}`,
+  path: packageJsonPath,
+  target: effect.name,
+  code: ErrorCodes.WRITE_FAILED
+});
+var executeDepsAdd = (effect, workspaceRoot, options, policy = DEFAULT_DEPENDENCY_POLICY) => {
+  const { name, version, dev = false, targetDir } = effect;
+  const { dryRun = false } = options;
+  const baseDir = targetDir ? join4(workspaceRoot, targetDir) : workspaceRoot;
+  const packageJsonPath = join4(baseDir, "package.json");
+  const validation = validateDependency(name, version, policy);
+  if (!validation.valid) {
+    return createPolicyViolationResult(effect, validation.reason);
+  }
+  if (!existsSync(packageJsonPath)) {
+    return createMissingPackageJsonResult(effect, packageJsonPath);
+  }
+  try {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+    const depsKey = dev ? "devDependencies" : "dependencies";
+    const deps = packageJson[depsKey] ?? {};
+    if (name in deps) {
+      return createSkipResult(effect, packageJsonPath, deps[name], dryRun);
+    }
+    const resolvedVersion = resolveVersion(version, policy);
+    if (!dryRun) {
+      packageJson[depsKey] = {
+        ...deps,
+        [name]: resolvedVersion
+      };
+      packageJson[depsKey] = Object.keys(packageJson[depsKey]).sort().reduce(
+        (acc, key) => {
+          acc[key] = packageJson[depsKey][key];
+          return acc;
+        },
+        {}
+      );
+      writeFileSync2(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}
+`, "utf-8");
+    }
+    return createAddResult(effect, packageJsonPath, resolvedVersion, dryRun);
+  } catch (error) {
+    return createErrorResult(effect, packageJsonPath, error);
+  }
+};
+
+// src/effects/utils.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, join as join5, resolve } from "path";
+var normalizeLineEndings = (content) => content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+var resolveSafePath = (targetPath, workspaceRoot) => {
+  const resolvedRoot = resolve(workspaceRoot);
+  const absolutePath = targetPath.startsWith("/") ? resolve(targetPath) : resolve(workspaceRoot, targetPath);
+  const isWithinRoot = absolutePath.startsWith(`${resolvedRoot}/`) || absolutePath === resolvedRoot;
+  return isWithinRoot ? { safe: true, absolutePath } : { safe: false, reason: `Path "${targetPath}" resolves outside workspace root` };
+};
+var readFileSafe = (absolutePath) => existsSync2(absolutePath) ? readFileSync2(absolutePath, "utf-8") : void 0;
+var atomicWriteFile = (absolutePath, content) => {
+  const dir = dirname2(absolutePath);
+  mkdirSync2(dir, { recursive: true });
+  const tempPath = join5(dir, `.tmp-${randomUUID()}`);
+  try {
+    writeFileSync3(tempPath, content, "utf-8");
+    renameSync(tempPath, absolutePath);
+  } catch (error) {
+    cleanupTempFile(tempPath);
+    throw error;
+  }
+};
+var cleanupTempFile = (tempPath) => {
+  try {
+    if (existsSync2(tempPath)) {
+      unlinkSync(tempPath);
+    }
+  } catch {
+  }
+};
+
+// src/effects/executors/env-add.ts
+var createSkipResult2 = (effect, key, envPath, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_skip" : "skipped",
+  message: dryRun ? `Would skip: ${key} already exists` : `Env var ${key} already exists`,
+  path: envPath,
+  target: key,
+  reason: "key exists"
+});
+var createAddResult2 = (effect, key, envPath, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_create" : "created",
+  message: dryRun ? `Would add env var: ${key}` : `Added env var: ${key}`,
+  path: envPath,
+  target: key
+});
+var createErrorResult2 = (effect, key, envPath, error) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Failed to add env var ${key}: ${error instanceof Error ? error.message : String(error)}`,
+  path: envPath,
+  target: key,
+  code: ErrorCodes.WRITE_FAILED
+});
+var keyExists = (content, key) => {
+  const keyRegex = new RegExp(`^${key}=`, "m");
+  return keyRegex.test(content);
+};
+var buildNewContent = (existingContent, key, value) => {
+  const normalized = normalizeLineEndings(existingContent);
+  const needsNewline = normalized.length > 0 && !normalized.endsWith("\n");
+  const prefix = needsNewline ? "\n" : "";
+  return `${normalized}${prefix}${key}=${value}
+`;
+};
+var executeEnvAdd = (effect, workspaceRoot, options) => {
+  const { key, value } = effect;
+  const { dryRun = false } = options;
+  const envPath = `${workspaceRoot}/.env.local`;
+  try {
+    const existingContent = readFileSafe(envPath) ?? "";
+    if (keyExists(existingContent, key)) {
+      return createSkipResult2(effect, key, envPath, dryRun);
+    }
+    if (!dryRun) {
+      const newContent = buildNewContent(existingContent, key, value);
+      atomicWriteFile(envPath, newContent);
+    }
+    return createAddResult2(effect, key, envPath, dryRun);
+  } catch (error) {
+    return createErrorResult2(effect, key, envPath, error);
+  }
+};
+
+// src/plan-hash.ts
+import { createHash } from "crypto";
+var stableStringify = (value) => {
+  if (value === null || value === void 0) {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const sortedKeys = Object.keys(obj).sort();
+    const pairs = sortedKeys.map((key) => `${JSON.stringify(key)}:${stableStringify(obj[key])}`);
+    return `{${pairs.join(",")}}`;
+  }
+  return JSON.stringify(value);
+};
+var computePlanHash = (changes) => {
+  const normalized = stableStringify(changes);
+  return createHash("sha256").update(normalized, "utf-8").digest("hex");
+};
+var computeContentHash = (content) => createHash("sha256").update(content, "utf-8").digest("hex");
+
+// src/effects/executors/file-write.ts
+var createPathSafetyError = (effect, relativePath, reason) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: reason,
+  target: relativePath,
+  code: ErrorCodes.PATH_OUTSIDE_ROOT
+});
+var createSkipResult3 = (effect, relativePath, absolutePath, dryRun, existingContent, newContent) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_skip" : "skipped",
+  message: dryRun ? `Would skip (unchanged): ${relativePath}` : `File unchanged: ${relativePath}`,
+  path: absolutePath,
+  target: relativePath,
+  reason: "content identical",
+  preview: {
+    oldBytes: existingContent.length,
+    newBytes: newContent.length,
+    oldHash: computeContentHash(existingContent),
+    newHash: computeContentHash(newContent),
+    wouldOverwrite: false,
+    existingLength: existingContent.length,
+    newLength: newContent.length
+  }
+});
+var createUpdateResult = (effect, relativePath, absolutePath, dryRun, existingContent, newContent) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_update" : "updated",
+  message: dryRun ? `Would update: ${relativePath}` : `Updated: ${relativePath}`,
+  path: absolutePath,
+  target: relativePath,
+  reason: "content differs",
+  preview: {
+    oldBytes: existingContent.length,
+    newBytes: newContent.length,
+    oldHash: computeContentHash(existingContent),
+    newHash: computeContentHash(newContent),
+    wouldOverwrite: true,
+    existingLength: existingContent.length,
+    newLength: newContent.length
+  }
+});
+var createCreateResult = (effect, relativePath, absolutePath, dryRun, newContent) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_create" : "created",
+  message: dryRun ? `Would create: ${relativePath}` : `Created: ${relativePath}`,
+  path: absolutePath,
+  target: relativePath,
+  preview: {
+    newBytes: newContent.length,
+    newHash: computeContentHash(newContent),
+    wouldOverwrite: false,
+    newLength: newContent.length
+  }
+});
+var createWriteError = (effect, relativePath, absolutePath, error) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Failed to write ${relativePath}: ${error instanceof Error ? error.message : String(error)}`,
+  path: absolutePath,
+  target: relativePath,
+  code: ErrorCodes.WRITE_FAILED
+});
+var decideWriteAction = (absolutePath, normalizedContent) => {
+  const existing = readFileSafe(absolutePath);
+  if (existing === void 0) {
+    return { action: "create" };
+  }
+  const normalizedExisting = normalizeLineEndings(existing);
+  return normalizedExisting === normalizedContent ? { action: "skip", existingContent: normalizedExisting } : { action: "update", existingContent: normalizedExisting };
+};
+var executeFileWrite = (effect, workspaceRoot, options) => {
+  const { path: relativePath, content } = effect;
+  const { dryRun = false } = options;
+  const pathResult = resolveSafePath(relativePath, workspaceRoot);
+  if (!pathResult.safe) {
+    return createPathSafetyError(effect, relativePath, pathResult.reason);
+  }
+  const { absolutePath } = pathResult;
+  const normalizedContent = normalizeLineEndings(content);
+  try {
+    const decision = decideWriteAction(absolutePath, normalizedContent);
+    switch (decision.action) {
+      case "skip":
+        return createSkipResult3(effect, relativePath, absolutePath, dryRun, decision.existingContent, normalizedContent);
+      case "update":
+        if (!dryRun) {
+          atomicWriteFile(absolutePath, normalizedContent);
+        }
+        return createUpdateResult(
+          effect,
+          relativePath,
+          absolutePath,
+          dryRun,
+          decision.existingContent,
+          normalizedContent
+        );
+      case "create":
+        if (!dryRun) {
+          atomicWriteFile(absolutePath, normalizedContent);
+        }
+        return createCreateResult(effect, relativePath, absolutePath, dryRun, normalizedContent);
+    }
+  } catch (error) {
+    return createWriteError(effect, relativePath, absolutePath, error);
+  }
+};
+
+// src/effects/executors/infra-add.ts
+var createPathSafetyError2 = (effect, relativePath, reason) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: reason,
+  target: relativePath,
+  code: ErrorCodes.PATH_OUTSIDE_ROOT
+});
+var createSkipResult4 = (effect, serviceName, absolutePath, relativePath, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_skip" : "skipped",
+  message: dryRun ? `Would skip (unchanged): ${serviceName}` : `Infra config unchanged: ${serviceName}`,
+  path: absolutePath,
+  target: relativePath,
+  reason: "content identical"
+});
+var createUpdateResult2 = (effect, serviceName, absolutePath, relativePath, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_update" : "updated",
+  message: dryRun ? `Would update infra config: ${serviceName}` : `Updated infra config: ${serviceName}`,
+  path: absolutePath,
+  target: relativePath
+});
+var createCreateResult2 = (effect, serviceName, absolutePath, relativePath, dryRun) => ({
+  effect,
+  success: true,
+  status: dryRun ? "would_create" : "created",
+  message: dryRun ? `Would create infra config: ${serviceName}` : `Created infra config: ${serviceName}`,
+  path: absolutePath,
+  target: relativePath
+});
+var createErrorResult3 = (effect, serviceName, absolutePath, relativePath, error) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Failed to create infra config for ${serviceName}: ${error instanceof Error ? error.message : String(error)}`,
+  path: absolutePath,
+  target: relativePath,
+  code: ErrorCodes.WRITE_FAILED
+});
+var generateInfraContent = (serviceName, port) => `import { ports, type K8sServiceConfig } from '@crossdelta/infrastructure'
+
+const config: K8sServiceConfig = {
+  name: '${serviceName}',
+  ports: ports().http(${port}).build(),
+  replicas: 1,
+  healthCheck: { httpPath: '/health' },
+  resources: {
+    requests: { cpu: '50m', memory: '64Mi' },
+    limits: { cpu: '150m', memory: '128Mi' },
+  },
+}
+
+export default config
+`;
+var decideInfraAction = (absolutePath, normalizedContent) => {
+  const existing = readFileSafe(absolutePath);
+  if (existing === void 0) {
+    return { action: "create" };
+  }
+  const normalizedExisting = normalizeLineEndings(existing);
+  return normalizedExisting === normalizedContent ? { action: "skip" } : { action: "update" };
+};
+var executeInfraAdd = (effect, workspaceRoot, options) => {
+  const { serviceName, port } = effect;
+  const { dryRun = false } = options;
+  const relativePath = `infra/services/${serviceName}.ts`;
+  const pathResult = resolveSafePath(relativePath, workspaceRoot);
+  if (!pathResult.safe) {
+    return createPathSafetyError2(effect, relativePath, pathResult.reason);
+  }
+  const { absolutePath } = pathResult;
+  const content = generateInfraContent(serviceName, port);
+  const normalizedContent = normalizeLineEndings(content);
+  try {
+    const decision = decideInfraAction(absolutePath, normalizedContent);
+    switch (decision.action) {
+      case "skip":
+        return createSkipResult4(effect, serviceName, absolutePath, relativePath, dryRun);
+      case "update":
+        if (!dryRun) {
+          atomicWriteFile(absolutePath, content);
+        }
+        return createUpdateResult2(effect, serviceName, absolutePath, relativePath, dryRun);
+      case "create":
+        if (!dryRun) {
+          atomicWriteFile(absolutePath, content);
+        }
+        return createCreateResult2(effect, serviceName, absolutePath, relativePath, dryRun);
+    }
+  } catch (error) {
+    return createErrorResult3(effect, serviceName, absolutePath, relativePath, error);
+  }
+};
+
+// src/effects/summary.ts
+var statusCountMap = {
+  created: "created",
+  updated: "updated",
+  skipped: "skipped",
+  error: "error",
+  would_create: "wouldCreate",
+  would_update: "wouldUpdate",
+  would_skip: "wouldSkip"
+};
+var initialCounts = {
+  created: 0,
+  updated: 0,
+  skipped: 0,
+  error: 0,
+  wouldCreate: 0,
+  wouldUpdate: 0,
+  wouldSkip: 0
+};
+var initialKindCounts = { total: 0, created: 0, updated: 0, skipped: 0, error: 0 };
+var createInitialCounts = () => ({ ...initialCounts });
+var incrementCount = (counts, key) => ({
+  ...counts,
+  [key]: counts[key] + 1
+});
+var aggregateCounts = (results) => results.reduce((acc, r) => {
+  const key = statusCountMap[r.status];
+  return key ? incrementCount(acc, key) : acc;
+}, createInitialCounts());
+var dryRunSummaryParts = (counts) => [
+  counts.wouldCreate > 0 ? `${counts.wouldCreate} would be created` : "",
+  counts.wouldUpdate > 0 ? `${counts.wouldUpdate} would be updated` : "",
+  counts.wouldSkip > 0 ? `${counts.wouldSkip} would be skipped` : ""
+].filter(Boolean);
+var normalSummaryParts = (counts) => [
+  counts.created > 0 ? `${counts.created} created` : "",
+  counts.updated > 0 ? `${counts.updated} updated` : "",
+  counts.skipped > 0 ? `${counts.skipped} skipped` : ""
+].filter(Boolean);
+var buildSummary = (counts, dryRun) => {
+  const modeParts = dryRun ? dryRunSummaryParts(counts) : normalSummaryParts(counts);
+  const errorPart = counts.error > 0 ? [`${counts.error} errors`] : [];
+  const parts = [...modeParts, ...errorPart];
+  return parts.length > 0 ? parts.join(", ") : "No effects to apply";
+};
+var statusToKindKey = (status) => {
+  switch (status) {
+    case "created":
+    case "would_create":
+      return "created";
+    case "updated":
+    case "would_update":
+      return "updated";
+    case "skipped":
+    case "would_skip":
+      return "skipped";
+    case "error":
+      return "error";
+    default:
+      return null;
+  }
+};
+var incrementKindCounts = (counts, status) => {
+  const key = statusToKindKey(status);
+  return key ? { ...counts, total: counts.total + 1, [key]: counts[key] + 1 } : { ...counts, total: counts.total + 1 };
+};
+var updateByKind = (byKind, kind, status) => ({
+  ...byKind,
+  [kind]: incrementKindCounts(byKind[kind] ?? { ...initialKindCounts }, status)
+});
+var buildStructuredSummary = (results) => results.reduce(
+  (acc, r) => ({
+    byKind: updateByKind(acc.byKind, r.effect.kind, r.status),
+    totalNewBytes: acc.totalNewBytes + (r.preview?.newBytes ?? 0),
+    totalOldBytes: acc.totalOldBytes + (r.preview?.oldBytes ?? 0)
+  }),
+  { byKind: {}, totalNewBytes: 0, totalOldBytes: 0 }
+);
+
+// src/effects/validation.ts
+import { validateGeneratedFiles } from "@crossdelta/platform-sdk/facade";
+var extractPlannedFiles = (effects) => effects.filter((e) => e.kind === "file:write").map((e) => ({ path: e.path, content: e.content }));
+var detectFramework = (effects) => {
+  const infraEffect = effects.find((e) => e.kind === "infra:add");
+  if (!infraEffect) return void 0;
+  const frameworkMap = {
+    hono: "hono",
+    nest: "nestjs",
+    nestjs: "nestjs"
+  };
+  return frameworkMap[infraEffect.framework];
+};
+var createPolicyViolationResult2 = (violations, dryRun) => ({
+  ok: false,
+  summary: `Policy violations: ${violations.length} issue(s) found`,
+  results: violations.map((v) => ({
+    effect: { kind: "file:write", path: v.path, content: "" },
+    success: false,
+    status: "error",
+    message: v.message,
+    path: v.path,
+    target: v.path,
+    code: v.code
+  })),
+  counts: {
+    created: 0,
+    updated: 0,
+    skipped: 0,
+    error: violations.length,
+    wouldCreate: 0,
+    wouldUpdate: 0,
+    wouldSkip: 0
+  },
+  dryRun,
+  code: ErrorCodes.POLICY_VIOLATION,
+  policyViolations: [...violations]
+});
+var validateEffects = (effects, framework, dryRun) => {
+  if (!framework) {
+    return { valid: true };
+  }
+  const plannedFiles = extractPlannedFiles(effects);
+  const validationResult = validateGeneratedFiles(framework, plannedFiles);
+  if (validationResult.valid) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    result: createPolicyViolationResult2(validationResult.violations, dryRun)
+  };
+};
+
+// src/effects/index.ts
+var effectExecutors = {
+  "file:write": executeFileWrite,
+  "env:add": executeEnvAdd,
+  "infra:add": executeInfraAdd,
+  "deps:add": executeDepsAdd
+};
+var isElicitInputEffect = (effect) => effect.kind === "elicit:input";
+var createElicitationRejection = (elicitEffects, dryRun) => ({
+  ok: false,
+  summary: "Cannot apply: Plan requires user input (elicitation pending)",
+  results: elicitEffects.map((effect) => ({
+    effect,
+    success: false,
+    status: "error",
+    message: "ElicitInputEffect cannot be applied - requires host interaction",
+    code: ErrorCodes.REQUIRES_ELICITATION
+  })),
+  counts: {
+    ...createInitialCounts(),
+    error: elicitEffects.length
+  },
+  dryRun
+});
+var createUnsupportedEffectResult = (effect) => ({
+  effect,
+  success: false,
+  status: "error",
+  message: `Unsupported effect kind: ${effect.kind}`,
+  code: ErrorCodes.UNSUPPORTED_EFFECT
+});
+var applyEffects = (effects, workspaceRoot, options = {}) => {
+  const { dryRun = false, framework: explicitFramework } = options;
+  const elicitEffects = effects.filter(isElicitInputEffect);
+  if (elicitEffects.length > 0) {
+    return createElicitationRejection(elicitEffects, dryRun);
+  }
+  const framework = explicitFramework ?? detectFramework(effects);
+  const validation = validateEffects(effects, framework, dryRun);
+  if (!validation.valid) {
+    return validation.result;
+  }
+  const executeEffect = (effect) => {
+    const executor = effectExecutors[effect.kind];
+    return executor ? executor(effect, workspaceRoot, options) : createUnsupportedEffectResult(effect);
+  };
+  const results = effects.map(executeEffect);
+  const counts = aggregateCounts(results);
+  return {
+    ok: counts.error === 0,
+    summary: buildSummary(counts, dryRun),
+    results,
+    counts,
+    dryRun,
+    structuredSummary: buildStructuredSummary(results)
+  };
+};
+var isEffectSupported = (kind) => kind in effectExecutors;
+
+// src/policy.ts
+var POLICY_VERSION = "2025-01-03";
+var generateReviewToken = (planHash, policyVersion = POLICY_VERSION) => `${planHash}.${policyVersion}`;
+var parseReviewToken = (token) => {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1) return null;
+  const planHash = token.slice(0, dotIndex);
+  const policyVersion = token.slice(dotIndex + 1);
+  if (planHash.length !== 64 || !/^[a-f0-9]+$/i.test(planHash)) return null;
+  if (!policyVersion || policyVersion.length === 0) return null;
+  return { planHash, policyVersion };
+};
+var validateReviewToken = (token, expectedPlanHash, expectedPolicyVersion = POLICY_VERSION) => {
+  const parsed = parseReviewToken(token);
+  if (!parsed) {
+    return {
+      valid: false,
+      code: "REVIEW_TOKEN_INVALID",
+      message: "Invalid review token format (expected: planHash.policyVersion)"
+    };
+  }
+  if (parsed.planHash !== expectedPlanHash) {
+    return {
+      valid: false,
+      code: "REVIEW_TOKEN_MISMATCH",
+      message: `Plan hash mismatch: token has ${parsed.planHash.slice(0, 8)}..., expected ${expectedPlanHash.slice(0, 8)}...`,
+      parsed
+    };
+  }
+  if (parsed.policyVersion !== expectedPolicyVersion) {
+    return {
+      valid: false,
+      code: "POLICY_VERSION_MISMATCH",
+      message: `Policy version mismatch: token has ${parsed.policyVersion}, expected ${expectedPolicyVersion}`,
+      parsed
+    };
+  }
+  return { valid: true, parsed };
+};
+
+// src/tools/apply-changes.ts
+var validateChanges = (changes) => {
+  if (!Array.isArray(changes)) return false;
+  return changes.every((c) => typeof c === "object" && c !== null && "kind" in c && typeof c.kind === "string");
+};
+var createFailure = (summary, errorMsg, infoMsg, code) => ({
+  ok: false,
+  operation: "apply_changes",
+  summary,
+  artifacts: [],
+  changes: [],
+  diagnostics: [
+    { level: "error", message: errorMsg },
+    ...infoMsg ? [{ level: "info", message: infoMsg }] : []
+  ],
+  data: code ? {
+    ok: false,
+    dryRun: false,
+    summary,
+    results: [],
+    counts: { created: 0, updated: 0, skipped: 0, error: 1, wouldCreate: 0, wouldUpdate: 0, wouldSkip: 0 },
+    code: ErrorCodes[code]
+  } : void 0
+});
+var checkReviewGate = (requireReview, reviewToken, actualHash, policyVer) => {
+  if (requireReview !== true) return null;
+  if (typeof reviewToken !== "string") {
+    return createFailure(
+      "Review required but no reviewToken provided",
+      "requireReview is enabled but reviewToken was not provided",
+      "Run plan_review first to get a reviewToken, then pass it to apply_changes",
+      "REVIEW_REQUIRED"
+    );
+  }
+  const validation = validateReviewToken(reviewToken, actualHash, policyVer);
+  if (!validation.valid) {
+    const info = validation.code === "POLICY_VERSION_MISMATCH" ? "Policy version has changed. Re-run plan_review to get a new reviewToken." : "Re-run plan_review to get a valid reviewToken for the current plan";
+    return createFailure(
+      `Review token validation failed: ${validation.message}`,
+      validation.message ?? "Review token validation failed",
+      info,
+      validation.code
+    );
+  }
+  return null;
+};
+var checkPlanHash = (expectedHash, actualHash) => {
+  if (typeof expectedHash !== "string") return null;
+  if (actualHash === expectedHash) return null;
+  return createFailure(
+    "Plan hash mismatch: changes have been modified since review",
+    `Expected hash: ${expectedHash}, got: ${actualHash}`,
+    "Re-run plan_review to get the updated hash, or remove expectedPlanHash to skip verification",
+    "PLAN_HASH_MISMATCH"
+  );
+};
+var writeAuditAndGetInfo = (planHash, policyVersion, changes, result, reviewToken, workspaceRoot) => {
+  if (!result.ok || result.dryRun) return null;
+  const audit = createAuditArtifact(planHash, policyVersion, changes, result, {
+    reviewToken: typeof reviewToken === "string" ? reviewToken : void 0
+  });
+  const auditArtifactPath = writeAuditArtifact(audit, workspaceRoot);
+  return { auditArtifactPath, appliedAt: audit.appliedAt };
+};
+var execute = async (args2) => {
+  const {
+    changes,
+    workspaceRoot: workspaceRootArg,
+    expectedPlanHash,
+    requireReview,
+    reviewToken,
+    expectedPolicyVersion
+  } = args2;
+  if (!changes) {
+    return createFailure("Missing required input: changes", "changes array is required");
+  }
+  if (!validateChanges(changes)) {
+    return createFailure(
+      "Invalid changes format: expected array of effects with kind property",
+      'Each change must have a "kind" property'
+    );
+  }
+  const actualPlanHash = computePlanHash(changes);
+  const policyVersion = typeof expectedPolicyVersion === "string" ? expectedPolicyVersion : POLICY_VERSION;
+  const reviewGateError = checkReviewGate(requireReview, reviewToken, actualPlanHash, policyVersion);
+  if (reviewGateError) return reviewGateError;
+  const hashMismatchError = checkPlanHash(expectedPlanHash, actualPlanHash);
+  if (hashMismatchError) return hashMismatchError;
+  const elicitEffects = changes.filter(isElicitInputEffect2);
+  if (elicitEffects.length > 0) {
+    const fieldNames = elicitEffects.flatMap((e) => {
+      if ("fields" in e && Array.isArray(e.fields)) {
+        return e.fields.map((f) => f.name);
+      }
+      return [];
+    }).join(", ");
+    return {
+      ok: false,
+      operation: "apply_changes",
+      summary: "Cannot apply: Plan requires user input",
+      artifacts: [],
+      changes: elicitEffects,
+      diagnostics: [
+        {
+          level: "error",
+          message: `Elicitation required for: ${fieldNames || "unknown fields"}`
+        },
+        {
+          level: "info",
+          message: "Use generate_service with required inputs first, then apply the resulting changes"
+        }
+      ]
+    };
+  }
+  const workspaceRoot = typeof workspaceRootArg === "string" ? workspaceRootArg : findWorkspaceRoot();
+  if (!workspaceRoot) {
+    return {
+      ok: false,
+      operation: "apply_changes",
+      summary: "Could not determine workspace root",
+      artifacts: [],
+      changes: [],
+      diagnostics: [
+        { level: "error", message: "Workspace root not found" },
+        { level: "info", message: "Provide workspaceRoot parameter or run from within a workspace" }
+      ]
+    };
+  }
+  const result = applyEffects(changes, workspaceRoot);
+  const artifacts = result.results.filter((r) => r.success && r.path).map((r) => ({
+    type: "file",
+    path: r.path,
+    description: r.message
+  }));
+  const diagnostics = result.results.map((r) => ({
+    level: r.success ? "info" : "error",
+    message: r.message,
+    location: r.path
+  }));
+  const auditInfo = writeAuditAndGetInfo(actualPlanHash, policyVersion, changes, result, reviewToken, workspaceRoot);
+  if (auditInfo) {
+    artifacts.push({
+      type: "file",
+      path: auditInfo.auditArtifactPath,
+      description: "Audit artifact"
+    });
+    diagnostics.push({
+      level: "info",
+      message: `Audit artifact written to: ${auditInfo.auditArtifactPath}`,
+      location: auditInfo.auditArtifactPath
+    });
+  }
+  const extendedResult = {
+    ...result,
+    planHash: actualPlanHash,
+    policyVersion,
+    appliedAt: auditInfo?.appliedAt,
+    auditArtifactPath: auditInfo?.auditArtifactPath,
+    reviewTokenUsed: typeof reviewToken === "string" ? reviewToken : void 0
+  };
+  return {
+    ok: result.ok,
+    operation: "apply_changes",
+    summary: result.summary,
+    artifacts,
+    changes: [],
+    // Effects already applied
+    diagnostics,
+    data: extendedResult
+  };
+};
+var applyChangesTool = {
+  name: "apply_changes",
+  description: "Apply changes (effects) from a generate_service plan. Writes files, adds env vars, and creates infra configs. Non-interactive, idempotent - safe to run multiple times. Rejects plans that require user input (elicitation). Supports requireReview gate and expectedPlanHash for drift detection.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      changes: {
+        type: "array",
+        description: 'Array of effects to apply. Get this from the "changes" field of a generate_service result.',
+        items: {
+          type: "object",
+          properties: {
+            kind: {
+              type: "string",
+              description: 'Effect type: "file:write", "env:add", "infra:add"'
+            }
+          },
+          required: ["kind"]
+        }
+      },
+      workspaceRoot: {
+        type: "string",
+        description: "Optional workspace root path. Auto-detected if omitted."
+      },
+      expectedPlanHash: {
+        type: "string",
+        description: "Optional: SHA-256 hash from generate_service or plan_review. If provided, apply_changes will verify the plan has not been modified before execution."
+      },
+      requireReview: {
+        type: "boolean",
+        description: "Optional: If true, requires a valid reviewToken from plan_review before applying. Enforces review workflow."
+      },
+      reviewToken: {
+        type: "string",
+        description: "Optional: Review token from plan_review (format: planHash.policyVersion). Required if requireReview is true."
+      },
+      expectedPolicyVersion: {
+        type: "string",
+        description: "Optional: Expected policy version for reviewToken validation. Defaults to current POLICY_VERSION."
+      }
+    },
+    required: ["changes"]
+  },
+  execute
+};
+
+// src/tools/plan-review.ts
+import {
+  findWorkspaceRoot as findWorkspaceRoot2,
+  isElicitInputEffect as isElicitInputEffect3
+} from "@crossdelta/platform-sdk/facade";
+var validateChanges2 = (changes) => {
+  if (!Array.isArray(changes)) return false;
+  return changes.every((c) => typeof c === "object" && c !== null && "kind" in c && typeof c.kind === "string");
+};
+var getEffectTarget = (effect) => {
+  if ("path" in effect && typeof effect.path === "string") {
+    return effect.path;
+  }
+  if ("key" in effect && typeof effect.key === "string") {
+    return `.env.local:${effect.key}`;
+  }
+  if ("serviceName" in effect && typeof effect.serviceName === "string") {
+    return `infra/services/${effect.serviceName}.ts`;
+  }
+  return void 0;
+};
+var checkElicitation = (effects) => {
+  const elicitEffects = effects.filter(isElicitInputEffect3);
+  if (elicitEffects.length === 0) return [];
+  const fieldNames = elicitEffects.flatMap((e) => {
+    if ("fields" in e && Array.isArray(e.fields)) {
+      return e.fields.map((f) => f.name);
+    }
+    return [];
+  }).join(", ");
+  return [
+    {
+      severity: "error",
+      code: "REQUIRES_ELICITATION",
+      message: `Plan requires user input for: ${fieldNames || "unknown fields"}`
+    }
+  ];
+};
+var checkUnsupportedEffects = (effects) => effects.filter((e) => !isEffectSupported(e.kind) && !isElicitInputEffect3(e)).map((e) => ({
+  severity: "error",
+  code: "UNSUPPORTED_EFFECT",
+  message: `Unsupported effect kind: ${e.kind}`,
+  target: getEffectTarget(e)
+}));
+var checkDuplicateTargets = (effects) => {
+  const targets = effects.map(getEffectTarget).filter((t) => t !== void 0);
+  const seen = /* @__PURE__ */ new Set();
+  const duplicates = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    if (seen.has(target)) {
+      duplicates.add(target);
+    }
+    seen.add(target);
+  }
+  return Array.from(duplicates).map((target) => ({
+    severity: "warning",
+    code: "DUPLICATE_TARGET",
+    message: `Multiple effects target the same path: ${target}`,
+    target
+  }));
+};
+var extractTargets = (effects) => effects.map((e) => {
+  const path = getEffectTarget(e);
+  return path ? { path, kind: e.kind } : null;
+}).filter((t) => t !== null);
+var execute2 = async (args2) => {
+  const { changes, workspaceRoot: workspaceRootArg } = args2;
+  if (!changes) {
+    return {
+      ok: false,
+      operation: "plan_review",
+      summary: "Missing required input: changes",
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "error", message: "changes array is required" }]
+    };
+  }
+  if (!validateChanges2(changes)) {
+    return {
+      ok: false,
+      operation: "plan_review",
+      summary: "Invalid changes format: expected array of effects with kind property",
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "error", message: 'Each change must have a "kind" property' }]
+    };
+  }
+  const workspaceRoot = typeof workspaceRootArg === "string" ? workspaceRootArg : findWorkspaceRoot2();
+  if (!workspaceRoot) {
+    return {
+      ok: false,
+      operation: "plan_review",
+      summary: "Could not determine workspace root",
+      artifacts: [],
+      changes: [],
+      diagnostics: [
+        { level: "error", message: "Workspace root not found" },
+        { level: "info", message: "Provide workspaceRoot parameter or run from within a workspace" }
+      ]
+    };
+  }
+  const issues = [
+    ...checkElicitation(changes),
+    ...checkUnsupportedEffects(changes),
+    ...checkDuplicateTargets(changes)
+  ];
+  const dryRunResult = applyEffects(changes, workspaceRoot, { dryRun: true });
+  for (const result of dryRunResult.results) {
+    if (!result.success && result.code) {
+      issues.push({
+        severity: "error",
+        code: result.code,
+        message: result.message,
+        target: result.target
+      });
+    }
+  }
+  const hasErrors = issues.some((i) => i.severity === "error");
+  const targets = extractTargets(changes);
+  const planHash = computePlanHash(changes);
+  const reviewToken = generateReviewToken(planHash, POLICY_VERSION);
+  const reviewedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const reviewResult = {
+    valid: !hasErrors,
+    canApply: !hasErrors && issues.every((i) => i.severity !== "error"),
+    issues,
+    preview: {
+      wouldCreate: dryRunResult.counts.wouldCreate,
+      wouldUpdate: dryRunResult.counts.wouldUpdate,
+      wouldSkip: dryRunResult.counts.wouldSkip,
+      errors: dryRunResult.counts.error
+    },
+    targets,
+    planHash,
+    policyVersion: POLICY_VERSION,
+    reviewToken,
+    reviewedAt
+  };
+  cacheReview({
+    planHash,
+    policyVersion: POLICY_VERSION,
+    reviewToken,
+    reviewedAt,
+    valid: reviewResult.valid,
+    canApply: reviewResult.canApply,
+    preview: reviewResult.preview,
+    issues: reviewResult.issues
+  });
+  const diagnostics = issues.map((issue) => ({
+    level: issue.severity === "error" ? "error" : issue.severity === "warning" ? "warning" : "info",
+    message: `[${issue.code}] ${issue.message}`,
+    location: issue.target
+  }));
+  if (reviewResult.canApply) {
+    diagnostics.push({
+      level: "info",
+      message: dryRunResult.summary,
+      location: void 0
+    });
+  }
+  return {
+    ok: reviewResult.valid,
+    operation: "plan_review",
+    summary: reviewResult.valid ? `Plan is valid: ${dryRunResult.summary}` : `Plan has ${issues.filter((i) => i.severity === "error").length} errors`,
+    artifacts: [],
+    changes: [],
+    // No changes - this is review only
+    diagnostics,
+    data: reviewResult
+  };
+};
+var planReviewTool = {
+  name: "plan_review",
+  description: "Review and validate a plan (effects array) without executing it. Checks for path safety issues, duplicate targets, unsupported effects, and elicitation requirements. Shows preview of what would be created/updated/skipped.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      changes: {
+        type: "array",
+        description: 'Array of effects to review. Get this from the "changes" field of a generate_service result.',
+        items: {
+          type: "object",
+          properties: {
+            kind: {
+              type: "string",
+              description: 'Effect type: "file:write", "env:add", "infra:add"'
+            }
+          },
+          required: ["kind"]
+        }
+      },
+      workspaceRoot: {
+        type: "string",
+        description: "Optional workspace root path. Auto-detected if omitted."
+      }
+    },
+    required: ["changes"]
+  },
+  execute: execute2
+};
+
+// src/tools/services-generate/index.ts
+import { findWorkspaceRoot as findWorkspaceRoot3 } from "@crossdelta/platform-sdk/facade";
+
+// src/tools/services-generate/mode-explicit.ts
+import { planServiceGeneration } from "@crossdelta/platform-sdk/facade";
+
+// src/tools/services-generate/review.ts
+var runInlineReview = (changes, workspaceRoot) => {
+  const issues = [];
+  for (const effect of changes) {
+    if (!isEffectSupported(effect.kind)) {
+      issues.push({
+        severity: "error",
+        code: "UNSUPPORTED_EFFECT",
+        message: `Unsupported effect kind: ${effect.kind}`
+      });
+    }
+  }
+  const dryRunResult = applyEffects(changes, workspaceRoot, { dryRun: true });
+  for (const result of dryRunResult.results) {
+    if (!result.success && result.code) {
+      issues.push({
+        severity: "error",
+        code: result.code,
+        message: result.message
+      });
+    }
+  }
+  const hasErrors = issues.some((i) => i.severity === "error");
+  return {
+    valid: !hasErrors,
+    canApply: !hasErrors,
+    issues,
+    preview: {
+      wouldCreate: dryRunResult.counts.wouldCreate,
+      wouldUpdate: dryRunResult.counts.wouldUpdate,
+      wouldSkip: dryRunResult.counts.wouldSkip,
+      errors: dryRunResult.counts.error
+    }
+  };
+};
+var applyPlanEffects = (result, workspaceRoot) => {
+  const applyResult = applyEffects(result.changes, workspaceRoot, { dryRun: false });
+  return {
+    ...result,
+    summary: `${result.summary} - ${applyResult.summary}`,
+    diagnostics: [
+      ...result.diagnostics ?? [],
+      ...applyResult.results.filter((r) => r.message).map((r) => ({
+        level: r.success ? "info" : "error",
+        message: r.message,
+        location: r.path
+      }))
+    ]
+  };
+};
+
+// src/tools/services-generate/validation.ts
+var VALID_TEMPLATES = ["hono-bun", "nest"];
+var getMissingFields = (args2) => {
+  const { template, name } = args2;
+  const missing = [];
+  if (!template || typeof template !== "string") {
+    missing.push({
+      name: "template",
+      prompt: "Which service template would you like to use?",
+      required: true,
+      description: "Service template type for scaffolding",
+      type: "string",
+      enum: [...VALID_TEMPLATES]
+    });
+  }
+  if (!name || typeof name !== "string") {
+    missing.push({
+      name: "name",
+      prompt: "What should the service be named?",
+      required: true,
+      description: 'Service name in kebab-case (e.g., "order-processing")',
+      type: "string"
+    });
+  }
+  return missing;
+};
+var isValidTemplate = (template) => VALID_TEMPLATES.includes(template);
+var createElicitResult = (message, fields) => {
+  const elicitEffect = {
+    kind: "elicit:input",
+    message,
+    fields
+  };
+  return {
+    ok: false,
+    operation: "generate_service",
+    summary: message,
+    artifacts: [],
+    changes: [elicitEffect],
+    diagnostics: [{ level: "info", message: "Awaiting user input" }]
+  };
+};
+var toMcpElicitFields = (fields) => fields.map((f) => ({
+  name: f.path,
+  prompt: f.prompt,
+  required: f.required,
+  description: f.prompt,
+  type: f.type === "enum" ? "string" : "string",
+  enum: f.options
+}));
+
+// src/tools/services-generate/mode-explicit.ts
+var executeExplicitMode = (args2, workspaceRoot, _options) => {
+  const { template, name, port, events, dryRun, autoReview } = args2;
+  const missingFields = getMissingFields(args2);
+  if (missingFields.length > 0) {
+    return createElicitResult("Missing required inputs for service generation", missingFields);
+  }
+  if (!isValidTemplate(template)) {
+    return createElicitResult(`Invalid template: ${template}. Please select a valid template.`, [
+      {
+        name: "template",
+        prompt: "Which service template would you like to use?",
+        required: true,
+        description: "Service template type for scaffolding",
+        type: "string",
+        enum: ["hono-bun", "nest"]
+      }
+    ]);
+  }
+  const eventsList = Array.isArray(events) ? events.filter((e) => typeof e === "string") : [];
+  const result = planServiceGeneration({
+    type: template,
+    name,
+    workspaceRoot,
+    port: typeof port === "number" ? port : void 0,
+    events: eventsList
+  });
+  if (result.ok && result.changes.length > 0) {
+    const planHash = computePlanHash(result.changes);
+    const extendedResult = {
+      ...result,
+      planHash
+    };
+    cachePlan({
+      planHash,
+      effects: result.changes,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      source: "generate_service",
+      metadata: {
+        template,
+        name,
+        port: typeof port === "number" ? port : void 0
+      }
+    });
+    if (autoReview === true) {
+      extendedResult.review = runInlineReview(result.changes, workspaceRoot);
+    }
+    if (dryRun === false) {
+      return applyPlanEffects(extendedResult, workspaceRoot);
+    }
+    return extendedResult;
+  }
+  return result;
+};
+
+// src/tools/services-generate/mode-nl.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join6 } from "path";
+import {
+  loadCapabilitiesConfig,
+  lowerSpecToCapabilities,
+  parseServicePrompt,
+  planServiceGeneration as planServiceGeneration2
+} from "@crossdelta/platform-sdk/facade";
+
+// src/tools/services-generate/npm-verifier.ts
+var parsePackageJson = (content) => {
+  try {
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+};
+var extractNpmPackages = (pkg) => {
+  const allDeps = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {}
+  };
+  return Object.entries(allDeps).filter(([_, version]) => !version.startsWith("workspace:")).map(([name, version]) => ({ name, version }));
+};
+var normalizeVersion = (version) => version.replace(/^\^/, "");
+var createCorrection = (name, generatedVersion, actualVersion) => ({
+  name,
+  generatedVersion,
+  actualVersion: actualVersion ?? generatedVersion,
+  corrected: actualVersion !== null && normalizeVersion(generatedVersion) !== actualVersion
+});
+var applyCorrections = (pkg, corrections) => {
+  const corrected = { ...pkg };
+  for (const correction of corrections.filter((c) => c.corrected)) {
+    if (corrected.dependencies?.[correction.name]) {
+      corrected.dependencies = {
+        ...corrected.dependencies,
+        [correction.name]: `^${correction.actualVersion}`
+      };
+    }
+    if (corrected.devDependencies?.[correction.name]) {
+      corrected.devDependencies = {
+        ...corrected.devDependencies,
+        [correction.name]: `^${correction.actualVersion}`
+      };
+    }
+  }
+  return corrected;
+};
+var fetchNpmVersion = async (packageName) => {
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
+    if (!response.ok) return null;
+    const data = await response.json();
+    return data.version ?? null;
+  } catch {
+    return null;
+  }
+};
+var isFileWriteEffect = (effect) => effect.kind === "file:write";
+var verifyAndCorrectPackageJson = async (content) => {
+  const pkg = parsePackageJson(content);
+  if (!pkg) {
+    return {
+      correctedContent: content,
+      result: { corrections: [], hasCorrections: false }
+    };
+  }
+  const packages = extractNpmPackages(pkg);
+  if (packages.length === 0) {
+    return {
+      correctedContent: content,
+      result: { corrections: [], hasCorrections: false }
+    };
+  }
+  const corrections = await Promise.all(
+    packages.map(async ({ name, version }) => {
+      const actualVersion = await fetchNpmVersion(name);
+      return createCorrection(name, version, actualVersion);
+    })
+  );
+  const hasCorrections = corrections.some((c) => c.corrected);
+  const correctedPkg = hasCorrections ? applyCorrections(pkg, corrections) : pkg;
+  return {
+    correctedContent: JSON.stringify(correctedPkg, null, 2),
+    result: {
+      corrections: corrections.filter((c) => c.corrected),
+      hasCorrections
+    }
+  };
+};
+var verifyAndCorrectNpmVersions = async (changes) => {
+  const pkgIndex = changes.findIndex((c) => isFileWriteEffect(c) && c.path.endsWith("package.json"));
+  if (pkgIndex === -1) {
+    return {
+      correctedChanges: changes,
+      result: { corrections: [], hasCorrections: false }
+    };
+  }
+  const pkgChange = changes[pkgIndex];
+  const { correctedContent, result } = await verifyAndCorrectPackageJson(pkgChange.content);
+  const correctedChanges = [...changes];
+  const correctedFileEffect = {
+    kind: "file:write",
+    path: pkgChange.path,
+    content: correctedContent
+  };
+  correctedChanges[pkgIndex] = correctedFileEffect;
+  return { correctedChanges, result };
+};
+
+// src/tools/services-generate/mode-nl.ts
+var buildDiagnostics = (spec, serviceMeta, files, scaffoldCount, aiFilesCount, dependencies, envVars, templateType) => [
+  { level: "info", message: `Parsed from prompt: ${spec.serviceName}` },
+  { level: "info", message: `Template: ${templateType} (port ${serviceMeta.port})` },
+  { level: "info", message: `Scaffold files: ${scaffoldCount} (ready to apply)` },
+  { level: "info", message: `Files for AI: ${aiFilesCount} (${files.map((f) => f.intent).join(", ")})` },
+  ...dependencies.length > 0 ? [{ level: "info", message: `Dependencies: ${dependencies.map((d) => d.name).join(", ")}` }] : [],
+  ...envVars.length > 0 ? [{ level: "info", message: `Env vars: ${envVars.map((e) => e.key).join(", ")}` }] : []
+];
+var normalizeFiles = (files) => files.map((f) => ({
+  path: f.path,
+  intent: f.intent,
+  inputs: f.inputs ?? {},
+  layer: f.layer,
+  kind: f.kind
+}));
+var extractEventsFromSpec = (spec) => spec.triggers.filter((t) => t.type === "event" && !!t.eventType).map((t) => t.eventType);
+var extractDependencies = (deps) => Object.entries(deps).map(([name, version]) => ({
+  name,
+  version,
+  dev: false
+}));
+var buildServiceResult = (spec, serviceMeta, serviceDir, correctedChanges, metadata, dependencies, verificationCorrections, templateType, scaffoldArtifacts) => ({
+  ok: true,
+  operation: "generate_service",
+  summary: `Planned ${spec.serviceName}: ${correctedChanges.length} scaffold files + ${metadata.files.length} files for AI to generate`,
+  data: serviceMeta,
+  artifacts: [
+    ...scaffoldArtifacts,
+    { type: "service", path: serviceDir, description: `Generated service ${spec.serviceName}` }
+  ],
+  changes: correctedChanges,
+  files: normalizeFiles(metadata.files),
+  dependencies,
+  envVars: metadata.envVars.map((ev) => ({
+    key: ev.key,
+    description: ev.description ?? "",
+    required: ev.required ?? false
+  })),
+  postCommands: metadata.postCommands,
+  diagnostics: [
+    ...buildDiagnostics(
+      spec,
+      serviceMeta,
+      metadata.files,
+      correctedChanges.length,
+      metadata.files.length,
+      dependencies,
+      metadata.envVars,
+      templateType
+    ),
+    ...verificationCorrections.map((c) => ({
+      level: "info",
+      message: `\u{1F4E6} Corrected ${c.name}: ${c.generatedVersion} \u2192 ^${c.actualVersion}`
+    }))
+  ]
+});
+var executeNLMode = async (prompt, workspaceRoot, options) => {
+  const pkgPath = join6(workspaceRoot, "package.json");
+  const pkg = existsSync3(pkgPath) ? JSON.parse(readFileSync3(pkgPath, "utf-8")) : null;
+  const workspaceConfig = loadCapabilitiesConfig(pkg);
+  const parseResult = await parseServicePrompt(prompt, { workspaceConfig });
+  if (!parseResult.complete) {
+    const fields = toMcpElicitFields(parseResult.fields);
+    return createElicitResult("Additional information needed", fields);
+  }
+  const spec = parseResult.spec;
+  const events = extractEventsFromSpec(spec);
+  const serviceDir = `services/${spec.serviceName}`;
+  const metadata = lowerSpecToCapabilities(spec, serviceDir);
+  const templateType = options.template || "hono-bun";
+  const scaffoldResult = planServiceGeneration2({
+    type: templateType,
+    name: spec.serviceName,
+    workspaceRoot,
+    events,
+    envVars: metadata.envVars
+  });
+  if (!scaffoldResult.ok) {
+    return {
+      ok: false,
+      operation: "generate_service",
+      summary: scaffoldResult.summary,
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "error", message: scaffoldResult.summary }]
+    };
+  }
+  if (!scaffoldResult.data) {
+    return {
+      ok: false,
+      operation: "generate_service",
+      summary: "Service scaffold generation failed: no data returned",
+      artifacts: [],
+      changes: [],
+      diagnostics: [{ level: "error", message: "No service metadata returned from scaffold" }]
+    };
+  }
+  const dependencies = extractDependencies(metadata.dependencies);
+  const { correctedChanges, result: verificationResult } = await verifyAndCorrectNpmVersions(scaffoldResult.changes);
+  const serviceMeta = scaffoldResult.data;
+  const result = buildServiceResult(
+    spec,
+    serviceMeta,
+    serviceDir,
+    correctedChanges,
+    metadata,
+    dependencies,
+    verificationResult.corrections,
+    templateType,
+    scaffoldResult.artifacts ?? []
+  );
+  if (result.changes.length > 0) {
+    result.planHash = computePlanHash(result.changes);
+    cachePlan({
+      planHash: result.planHash,
+      effects: result.changes,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      source: "generate_service",
+      metadata: { prompt, serviceName: spec.serviceName, filesToGenerate: metadata.files.length }
+    });
+  }
+  if (options.autoReview === true) {
+    result.review = runInlineReview(result.changes, workspaceRoot);
+  }
+  if (options.dryRun === false) {
+    return applyPlanEffects(result, workspaceRoot);
+  }
+  return result;
+};
+
+// src/tools/services-generate/index.ts
+var execute3 = async (args2) => {
+  const { prompt, template, workspaceUri, dryRun, autoReview } = args2;
+  const workspaceRoot = typeof workspaceUri === "string" ? workspaceUri : findWorkspaceRoot3();
+  if (typeof prompt === "string" && prompt.trim().length > 0) {
+    return executeNLMode(prompt, workspaceRoot, {
+      dryRun,
+      autoReview,
+      template
+    });
+  }
+  return executeExplicitMode(args2, workspaceRoot, { dryRun, autoReview });
+};
+var servicesGenerateTool = {
+  name: "generate_service",
+  description: 'Plan generation of a new microservice from a natural language prompt. Example: "Erstelle notification-service, h\xF6rt auf order.created, sendet Push via Pusher Beams". Returns a structured plan with files, config, and environment variables. By default runs in plan-only mode (dryRun=true). After showing the plan, ask if user wants to apply it.\n\n\u{1F4DA} IMPORTANT: Before generating services, read the generator documentation:\n1. First, read docs://generators to discover available documentation\n2. Then read the relevant docs (e.g., docs://generators/service for main guidelines)\n\nThese resources contain up-to-date package versions, naming conventions, and best practices. Always verify package versions on npm - do not hallucinate versions!',
+  inputSchema: {
+    type: "object",
+    properties: {
+      prompt: {
+        type: "string",
+        description: 'Natural language prompt describing the service. Example: "Erstelle notification-service, h\xF6rt auf order.created, sendet Push via Pusher Beams". When provided, uses capabilities pipeline for intelligent generation.'
+      },
+      template: {
+        type: "string",
+        enum: ["hono-bun", "nest"],
+        description: "Service template type. Required when not using prompt mode."
+      },
+      name: {
+        type: "string",
+        description: "Service name in kebab-case. Required when not using prompt mode."
+      },
+      workspaceUri: {
+        type: "string",
+        description: "Optional workspace root path. Auto-detected if omitted."
+      },
+      port: {
+        type: "number",
+        description: "Optional explicit port number. Auto-allocated if omitted."
+      },
+      events: {
+        type: "array",
+        items: { type: "string" },
+        description: 'Event types to consume (e.g., ["order.created"]). Only for explicit mode.'
+      },
+      dryRun: {
+        type: "boolean",
+        description: "Plan-only mode (default: true). When true, returns plan without writing files.",
+        default: true
+      },
+      autoReview: {
+        type: "boolean",
+        description: "Include inline plan validation (default: false).",
+        default: false
+      }
+    },
+    required: []
+  },
+  execute: execute3
+};
+
+// src/tools/workspace-scan.ts
+import {
+  createContextFromWorkspace as createContextFromWorkspace4
+} from "@crossdelta/platform-sdk/facade";
+var normalizeInput = (args2) => ({
+  workspaceRoot: typeof args2.workspaceRoot === "string" ? args2.workspaceRoot : void 0
+});
+var buildScanMeta = (context, loadedPlugins) => ({
+  workspaceRoot: context.workspace.workspaceRoot,
+  contracts: context.workspace.contracts,
+  availableServices: context.workspace.availableServices,
+  loadedPlugins
+});
+var createScanResult = (meta) => ({
+  ok: true,
+  operation: "scan_workspace",
+  summary: `Workspace scanned: ${meta.availableServices.length} services, contracts at ${meta.contracts.packageName}`,
+  artifacts: [],
+  changes: [],
+  // Read-only: no changes
+  diagnostics: [],
+  data: meta
+});
+var createScanError = (error) => ({
+  ok: false,
+  operation: "scan_workspace",
+  summary: `Failed to scan workspace: ${error.message}`,
+  artifacts: [],
+  changes: [],
+  // Read-only: no changes
+  diagnostics: [
+    {
+      level: "error",
+      message: error.message
+    }
+  ]
+});
+var execute4 = async (args2, pluginModules = []) => {
+  try {
+    const input = normalizeInput(args2);
+    const context = await createContextFromWorkspace4(input.workspaceRoot);
+    const meta = buildScanMeta(context, pluginModules);
+    return createScanResult(meta);
+  } catch (error) {
+    return createScanError(error instanceof Error ? error : new Error(String(error)));
+  }
+};
+var workspaceScanInputSchema = {
+  type: "object",
+  properties: {
+    workspaceRoot: {
+      type: "string",
+      description: "Optional: Absolute path to workspace root. If omitted, auto-discovers from current directory."
+    }
+  },
+  required: []
+};
+var createWorkspaceScanTool = (pluginModules) => ({
+  name: "scan_workspace",
+  description: "Scan the current workspace and return a read-only snapshot including workspace root, contracts configuration, discovered services, and loaded plugins. Does not write any files.",
+  inputSchema: workspaceScanInputSchema,
+  execute: async (args2) => execute4(args2, pluginModules)
+});
+
+// src/server.ts
+var isOperationResult = (result) => {
+  return typeof result === "object" && result !== null && "ok" in result && "operation" in result && "summary" in result;
+};
+var readTemplateFileResource = async (uri) => {
+  const templateFileMatch = uri.match(/^templates:\/\/([^/]+)\/file\/(.+)$/);
+  if (!templateFileMatch) return null;
+  const [, templateName, filePath] = templateFileMatch;
+  if (!templateName || !filePath) {
+    throw new Error(`Invalid template file URI: ${uri}`);
+  }
+  try {
+    const content = await readTemplateFile(templateName, filePath);
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "text/plain",
+          text: content
+        }
+      ]
+    };
+  } catch (error) {
+    throw new Error(`Failed to read template file: ${error instanceof Error ? error.message : String(error)}`);
+  }
+};
+var readTemplateStructureResource = async (uri) => {
+  const templateStructureMatch = uri.match(/^templates:\/\/([^/]+)$/);
+  if (!templateStructureMatch) return null;
+  const [, templateName] = templateStructureMatch;
+  if (!templateName || templateName === "list") {
+    return null;
+  }
+  try {
+    const content = await readTemplateStructure(templateName);
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: "application/json",
+          text: content
+        }
+      ]
+    };
+  } catch (error) {
+    throw new Error(`Failed to read template structure: ${error instanceof Error ? error.message : String(error)}`);
+  }
+};
+var completeTemplateName = async () => {
+  const templates = await listTemplates();
+  return {
+    completion: {
+      values: templates,
+      total: templates.length,
+      hasMore: false
+    }
+  };
+};
+var completeTemplatePath = async (uri) => {
+  const templateMatch = uri.match(/templates:\/\/([^/]+)/);
+  if (!templateMatch?.[1]) {
+    return {
+      completion: {
+        values: [],
+        total: 0,
+        hasMore: false
+      }
+    };
+  }
+  const templateName = templateMatch[1];
+  try {
+    const files = await listTemplateFiles(templateName);
+    return {
+      completion: {
+        values: files,
+        total: files.length,
+        hasMore: false
+      }
+    };
+  } catch {
+    return {
+      completion: {
+        values: [],
+        total: 0,
+        hasMore: false
+      }
+    };
+  }
+};
+var normalizeToOperationResult = (result, toolName) => {
+  if (isOperationResult(result)) {
+    return result;
+  }
+  const legacyResult = result;
+  return {
+    ok: legacyResult.ok ?? true,
+    operation: legacyResult.operation ?? toolName,
+    summary: legacyResult.summary ?? (legacyResult.output ? Array.isArray(legacyResult.output) ? legacyResult.output.join("\n") : legacyResult.output : `Executed ${toolName}`),
+    artifacts: [],
+    changes: legacyResult.effects ?? [],
+    diagnostics: []
+  };
+};
+var buildTools = (pluginTools, pluginModules) => {
+  const workspaceScanTool = createWorkspaceScanTool(pluginModules);
+  return [servicesGenerateTool, planReviewTool, applyChangesTool, workspaceScanTool, ...pluginTools];
+};
+var buildResources = async (pluginModules, workspaceRoot) => {
+  const generatorDocsResources = await createAllGeneratorDocResources();
+  const templatesListResource = createTemplatesListResource();
+  return [
+    createWorkspaceSummaryResource(pluginModules, workspaceRoot),
+    createServicesResource(workspaceRoot),
+    createContractsResource(workspaceRoot),
+    ...generatorDocsResources,
+    templatesListResource
+    // Only discovery resource, not individual templates
+  ];
+};
+var registerHandlers = (server, tools, resources) => {
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: tools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.inputSchema
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name: toolName, arguments: args2 } = request.params;
+    const tool = tools.find((t) => t.name === toolName);
+    if (!tool) {
+      return formatErrorAsMcpResponse(new Error(`Unknown tool: ${toolName}`), toolName);
+    }
+    try {
+      const result = await tool.execute(args2 ?? {});
+      const normalizedResult = normalizeToOperationResult(result, toolName);
+      const elicitEffect = normalizedResult.changes.find(isElicitInputEffect4);
+      if (elicitEffect) {
+        return formatElicitationAsMcpResponse(elicitEffect, toolName);
+      }
+      return formatOperationResultAsMcpResponse(normalizedResult);
+    } catch (error) {
+      return formatErrorAsMcpResponse(error instanceof Error ? error : new Error(String(error)), toolName);
+    }
+  });
+  server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+    resources: resources.map((r) => r.resource)
+  }));
+  server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
+    resourceTemplates: [createTemplateFileResourceTemplate()]
+  }));
+  server.setRequestHandler(CompleteRequestSchema, async (request) => {
+    const { ref, argument } = request.params;
+    if (ref.type === "ref/resource" && ref.uri?.startsWith("templates://")) {
+      if (argument.name === "template") {
+        return await completeTemplateName();
+      }
+      if (argument.name === "path" && ref.uri) {
+        return await completeTemplatePath(ref.uri);
+      }
+    }
+    return {
+      completion: {
+        values: [],
+        total: 0,
+        hasMore: false
+      }
+    };
+  });
+  server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+    const { uri } = request.params;
+    const templateFileResult = await readTemplateFileResource(uri);
+    if (templateFileResult) return templateFileResult;
+    const templateStructureResult = await readTemplateStructureResource(uri);
+    if (templateStructureResult) return templateStructureResult;
+    const resource = resources.find((r) => r.resource.uri === uri);
+    if (!resource) {
+      throw new Error(`Unknown resource: ${uri}`);
+    }
+    const content = await resource.read(uri);
+    return { contents: [content] };
+  });
+};
+var createMcpServerFromWorkspace = async (options) => {
+  const { name, version, workspaceRoot, plugins: pluginModules, logger } = options;
+  const context = await createContextFromWorkspace5(workspaceRoot, logger);
+  const loadedPlugins = await loadPlugins(pluginModules, context);
+  const pluginTools = collectExecutableToolSpecs(loadedPlugins, context);
+  const discoveredRoot = context.workspace.workspaceRoot;
+  const tools = buildTools(pluginTools, pluginModules);
+  const resources = await buildResources(pluginModules, discoveredRoot);
+  const server = new Server({ name, version }, { capabilities: { tools: {}, resources: {}, completions: {} } });
+  registerHandlers(server, tools, resources);
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  logger?.info(
+    `MCP server '${name}' started with ${tools.length} tools, ${resources.length} resources (auto-discovered workspace)`
+  );
+};
+
+// src/cli.ts
+var args = process.argv.slice(2);
+if (!args.includes("--stdio")) {
+  console.error("Usage: pf-mcp --stdio");
+  console.error("");
+  console.error("The --stdio flag is required for MCP server communication.");
+  console.error("This server is designed to be used with VS Code Copilot Agent Mode.");
+  process.exit(1);
+}
+createMcpServerFromWorkspace({
+  name: "pf-mcp",
+  version: "0.1.0",
+  plugins: []
+}).catch((error) => {
+  console.error("Failed to start MCP server:", error);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map